System

Abstract

A system is provided.SOLUTION: A system comprising a plurality of sensors and a network device for monitoring document usage, the system comprising: server means for receiving and storing document manipulation data in real-time; artificial intelligence means for analyzing the received manipulation data and detecting anomalous behavior; and management means for issuing an alert and performing a management action when anomalous behavior is detected.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The technology of the present disclosure relates to a system. [Background technology]

[0002] Patent document 1 discloses a persona chatbot control method performed by at least one processor, the method including the steps of receiving a user utterance, adding the user utterance to a prompt including an instruction sentence related to a description of the chatbot character, encoding the prompt, and inputting the encoded prompt into a language model to generate a chatbot utterance in response to the user utterance. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2022-180282 Summary of the Invention [Problem to be solved by the invention]

[0004] Conventional document monitoring and management systems have had difficulty responding quickly and efficiently to dynamically changing threats. Furthermore, human error and delays often occur when monitoring document usage in real time and detecting abnormal behavior. As a result, it has been difficult to effectively reduce the risk of information leaks and unauthorized use. The purpose of this invention is to solve these problems and realize highly efficient and accurate document management. [Means for solving the problem]

[0005] The present invention provides a system including a plurality of sensors and a network device for monitoring document usage, which includes a server means for receiving and storing document operation data in real time, an artificial intelligence means for analyzing the received operation data and detecting abnormal behavior, and a management means for issuing an alert and taking management action when abnormal behavior is detected, thereby enabling a rapid and efficient response to dynamically changing threats. Specifically, the server means encrypts the operation data and receives it in real time, and the artificial intelligence means analyzes the operation data and calculates an abnormal behavior score, and determines that the behavior is abnormal when a certain threshold is exceeded, thereby effectively reducing the risk of information leakage and unauthorized use.

[0006] A "sensor" is a device that monitors the usage of a document and detects its operation data.

[0007] A "network device" is a communication device for transferring data sent from sensors and terminals to a server.

[0008] "Server means" refers to a central data processing system for receiving, storing, and analyzing document operation data.

[0009] "Artificial intelligence means" refers to algorithms and software for analyzing accumulated operational data and detecting abnormal behavior.

[0010] "Management" is a system that issues alerts when abnormal behavior is detected and takes necessary management action.

[0011] "Operation data" is historical information about operations performed by a user on a document, and includes metadata such as a timestamp and a user ID.

[0012] "Real-time" refers to data processing and communication occurring almost instantly, without delay.

[0013] "Abnormal behavior" refers to document manipulation behavior that deviates from normal usage patterns and is deemed to pose a risk of information leakage or unauthorized use.

[0014] An "alert" is a warning message that notifies an administrator when abnormal behavior is detected.

[0015] "Administrative actions" are specific countermeasures implemented when abnormal behavior is detected, including access restrictions and document encryption. [Brief explanation of the drawings]

[0016] [Figure 1] 1 is a conceptual diagram showing an example of the configuration of a data processing system according to a first embodiment. [Figure 2] 1 is a conceptual diagram showing an example of main functions of a data processing device and a smart device according to a first embodiment. [Figure 3] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a second embodiment. [Figure 4] FIG. 10 is a conceptual diagram showing an example of main functions of a data processing device and smart glasses according to a second embodiment. [Figure 5] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a third embodiment. [Figure 6] FIG. 11 is a conceptual diagram showing an example of main functions of a data processing device and a headset-type terminal according to a third embodiment. [Figure 7] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a fourth embodiment. [Figure 8] FIG. 10 is a conceptual diagram showing an example of main functions of a data processing device and a robot according to a fourth embodiment. [Figure 9] 1 shows an emotion map onto which multiple emotions are mapped. [Figure 10] 1 shows an emotion map onto which multiple emotions are mapped. [Figure 11] FIG. 3 is a sequence diagram showing a processing flow of the data processing system according to the first embodiment. [Figure 12] FIG. 10 is a sequence diagram showing the flow of processing in the data processing system in Application Example 1. [Figure 13] FIG. 10 is a sequence diagram showing the flow of processing in the data processing system according to the second embodiment when an emotion engine is combined. [Figure 14] FIG. 10 is a sequence diagram showing the flow of processing in the data processing system in Application Example 2 when an emotion engine is combined. DETAILED DESCRIPTION OF THE INVENTION

[0017] An example of an embodiment of a system according to the technology of the present disclosure will be described below with reference to the accompanying drawings.

[0018] First, the terms used in the following description will be explained.

[0019] In the following embodiments, a coded processor (hereinafter simply referred to as a "processor") may be a single arithmetic device or a combination of multiple arithmetic devices. Furthermore, a processor may be a single type of arithmetic device or a combination of multiple types of arithmetic devices. Examples of arithmetic devices include a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), a GPGPU (General-Purpose computing on Graphics Processing Units), and an APU (Accelerated Processing Unit).

[0020] In the following embodiments, a coded RAM (Random Access Memory) is a memory in which information is temporarily stored and is used as a working memory by a processor.

[0021] In the following embodiments, the coded storage is one or more non-volatile storage devices that store various programs, various parameters, etc. Examples of non-volatile storage devices include flash memory (SSD (Solid State Drive)), magnetic disks (e.g., hard disks), and magnetic tapes.

[0022] In the following embodiments, a communication I / F (Interface) with a symbol is an interface including a communication processor, an antenna, etc. The communication I / F controls communication between multiple computers. Examples of communication standards applied to the communication I / F include wireless communication standards including 5G (5th Generation Mobile Communication System), Wi-Fi (registered trademark), Bluetooth (registered trademark), etc.

[0023] In the following embodiments, "A and / or B" is synonymous with "at least one of A and B." In other words, "A and / or B" means that it may be only A, only B, or a combination of A and B. Furthermore, in this specification, the same concept as "A and / or B" is also applied when three or more things are expressed connected by "and / or."

[0024] [First embodiment]

[0025] FIG. 1 shows an example of the configuration of a data processing system 10 according to the first embodiment.

[0026] 1, a data processing system 10 includes a data processing device 12 and a smart device 14. An example of the data processing device 12 is a server.

[0027] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" according to the technology of the present disclosure. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0028] The smart device 14 includes a computer 36, a reception device 38, an output device 40, a camera 42, and a communication I / F 44. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The reception device 38, the output device 40, and the camera 42 are also connected to the bus 52.

[0029] The reception device 38 includes a touch panel 38A, a microphone 38B, and the like, and receives user input. The touch panel 38A detects contact with an indicator (for example, a pen or a finger) to receive user input by the touch of the indicator. The microphone 38B detects the user's voice to receive user input by voice. The control unit 46A transmits data indicating the user input received by the touch panel 38A and the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the data indicating the user input.

[0030] The output device 40 includes a display 40A and a speaker 40B, and presents data to the user 20 by outputting the data in a form of expression that the user 20 can perceive (for example, audio and / or text). The display 40A displays visible information such as text and images in accordance with instructions from the processor 46. The speaker 40B outputs audio in accordance with instructions from the processor 46. The camera 42 is a compact digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor.

[0031] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 control the exchange of various information between the processor 46 and the processor 28 via the network 54.

[0032] FIG. 2 shows an example of the main functions of the data processing device 12 and the smart device 14.

[0033] 2, in the data processing device 12, a specific process is performed by the processor 28. A specific processing program 56 is stored in the storage 32. The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific process is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0034] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0035] In the smart device 14, the processor 46 performs the reception output process. The storage 50 stores a reception output program 60. The reception output program 60 is used in conjunction with the specific processing program 56 by the data processing system 10. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output process is realized by the processor 46 operating as the control unit 46A in accordance with the reception output program 60 executed on the RAM 48.

[0036] Next, a description will be given of the specific processing performed by the specific processing unit 290 of the data processing device 12. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0037] The document monitoring and management system of the present invention is implemented as follows: First, multiple sensors and network devices are installed and connected to a server. Then, client software is installed on the terminal and configured to enable real-time communication with the server.

[0038] Initial Setup

[0039] Initial Server Configuration

[0040] The server registers sensors and network devices, sets communication protocols, and initially starts up the AI ​​engine and database, verifying their operation.

[0041] Setting up the device

[0042] Dedicated client software is installed on the terminal, and a connection test is performed to communicate with the server.

[0043] Registering Users

[0044] The user registers their account on the server and sets the required authentication information and permission level.

[0045] Document Monitoring

[0046] Start working on the document

[0047] When a user opens a document, the device monitors the operation in real time, and the operation data is encrypted and sent to the server in real time.

[0048] Receiving and storing data

[0049] The server accumulates the received operation data and stores it in a database. The data includes metadata such as the operation type, timestamp, and user ID.

[0050] Data analysis and anomaly detection

[0051] Data analysis

[0052] The server's AI engine analyzes the received and accumulated operation data, specifically analyzing operation patterns and distinguishing between normal and abnormal operations.

[0053] Scoring abnormal behavior

[0054] The AI ​​engine calculates an anomaly score for each operation, and if the score exceeds a certain threshold, it determines that the behavior is abnormal.

[0055] Alerts and take administrative actions

[0056] Generate alerts

[0057] The server generates an alert and notifies the administrator if abnormal behavior is detected, such as when a user attempts to copy a large number of documents.

[0058] Performing administrative actions

[0059] When abnormal behavior is detected, the server immediately takes administrative action on the device, such as restricting access, encrypting documents, and automatically locking the device, effectively preventing information leaks and unauthorized use.

[0060] Continuous learning and improvement

[0061] New data collection and analysis

[0062] The server constantly collects new operation data, allowing the AI ​​engine to continuously learn, which is used to update the operation pattern recognition model.

[0063] Model feedback and adjustment

[0064] The server receives feedback from administrators and adjusts the AI ​​engine model accordingly, allowing it to quickly respond to new threats and operational patterns.

[0065] Specific examples

[0066] For example, if a user attempts to copy a large amount of data outside of normal working hours, the server's AI engine will determine this operation as an anomaly and assign a score. If the anomaly score exceeds a threshold, the server will immediately issue an alert and take administrative action, such as temporarily restricting the user's access. It can also take other measures, such as changing documents to read-only mode.

[0067] The document monitoring and management system according to the present invention has been described above. This system makes it possible to respond quickly and efficiently to dynamically changing threats, and effectively reduce the risk of information leakage and unauthorized use.

[0068] The processing flow will be explained below.

[0069] Step 1:

[0070] The server connects to sensors and network devices, sets up communication protocols, and initially starts up the AI ​​engine and database, verifying their operation.

[0071] Step 2:

[0072] Dedicated client software is installed on the device, and a connection test is performed to ensure the device communicates with the server and that it is operating normally.

[0073] Step 3:

[0074] The user registers their account on the server and sets the required authentication information and permission level.

[0075] Step 4:

[0076] When a user opens a document, the device monitors the operation in real time, and the operation data is encrypted and sent to the server in real time.

[0077] Step 5:

[0078] The server receives the operation data sent from the device and stores it in a database. The operation data includes metadata such as the type of operation, timestamp, and user ID.

[0079] Step 6:

[0080] The server's AI engine analyzes the accumulated operation data, specifically analyzing operation patterns and distinguishing between normal and abnormal operations.

[0081] Step 7:

[0082] The AI ​​engine calculates an anomaly score for each operation, and if this score exceeds a set threshold, it is deemed to be an abnormal behavior.

[0083] Step 8:

[0084] The server will alert administrators in real time when abnormal behavior is detected, which will be sent as a warning message.

[0085] Step 9:

[0086] If the server detects any abnormal behavior, it immediately takes administrative action on the device, such as restricting access or automatically encrypting documents.

[0087] Step 10:

[0088] The server continuously collects new operation data, and the AI ​​engine continuously learns, improving the accuracy of the operation pattern recognition model.

[0089] Step 11:

[0090] The server receives feedback from administrators and incorporates it into the AI ​​engine's models, allowing it to respond quickly to new threats and operational patterns.

[0091] The above are the specific processing steps of the document monitoring and management system. This process ensures that the system can monitor in real time, detect abnormal behavior, and respond quickly.

[0092] Example 1

[0093] Next, a description will be given of Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0094] Conventional document monitoring and management systems have difficulty monitoring user operations in real time, which can result in delayed detection of abnormal behavior. Furthermore, management actions after an abnormality is detected may not be implemented quickly enough, increasing the risk of information leaks and unauthorized use. Furthermore, because the system relied on static models, it was difficult to respond to new threats and operation patterns.

[0095] The specific processing by the specific processing unit 290 of the data processing device 12 in the first embodiment is realized by the following means.

[0096] In this invention, the server includes an initial setting means for registering sensors and network devices and setting communication protocols, a terminal setup means for installing client software and enabling real-time communication with the server, a user registration means for registering user accounts and setting authentication information and authority levels, a document monitoring means for monitoring user document operations, a data transmission means for encrypting operation data and transmitting it to the server in real time, a database means for storing received operation data, an artificial intelligence means for analyzing the received and stored operation data, anomaly detection means for analyzing operation patterns and detecting abnormal behavior, a management means for issuing an alert and taking management action when abnormal behavior is detected, and a learning means for collecting new operation data and continuously learning and improving. This enables real-time monitoring of document operations, rapid anomaly detection, and the execution of management action.

[0097] A "sensor" is a device for detecting physical environmental conditions and document manipulation status.

[0098] A "network device" is a device that connects sensors and terminals to servers and performs data communication.

[0099] The "initial setting means" is a means having the function of registering sensors and network devices and setting communication protocols.

[0100] The "terminal setup means" is a means having a function for installing client software and enabling real-time communication with the server.

[0101] The "user registration means" is a means having the function of registering a user's account and setting authentication information and authority level.

[0102] The "document monitoring means" is a means having a function of monitoring operations when a user operates a document.

[0103] The "data transmission means" is a means having a function of encrypting operation data and transmitting it to the server in real time.

[0104] The "database means" is a means having a function of storing received operation data.

[0105] "Artificial intelligence means" means means having the function of analyzing received and stored operational data.

[0106] The "abnormality detection means" is a means having a function of analyzing operation patterns and detecting abnormal behavior.

[0107] A "management means" is a means that has the function of issuing an alert and taking management action when abnormal behavior is detected.

[0108] A "learning means" is a means that has the ability to collect new operational data and continuously learn and improve.

[0109] The document monitoring and management system of the present invention connects multiple sensors and network devices to a server, and monitors and manages data in real time as users manipulate documents. This system includes an initial setting means, a terminal setup means, a user registration means, a document monitoring means, a data transmission means, a database means, an artificial intelligence means, an anomaly detection means, a management means, and a learning means.

[0110] First, the server registers sensors and network devices and configures communication protocols. This includes registering information from sensors and network devices in a database and configuring communication protocols (e.g., TCP / IP, HTTP). The server also starts AI engines such as TENSORFLOW (registered trademark) and PyTorch, and databases such as MySQL (registered trademark) and PostgreSQL, and checks their operation.

[0111] Next, dedicated client software is installed on the device and configured to enable real-time communication with the server. The user uses this to perform a connection test with the server and confirm that communication is normal. For example, a connection test can be performed by sending and receiving simple messages.

[0112] Users register their accounts on the server and set the required authentication information and permission levels. They enter information such as their name and email address using a special registration form, which is then sent to the server, which stores this information in a database.

[0113] When a user operates on a document, the client software on the device monitors the operation in real time. The operation data (e.g., copy, edit) is encrypted (e.g., AES-256) and sent to the server. The server receives it and stores it in a database. The operation data includes metadata such as the type of operation, timestamp, and user ID.

[0114] The server's AI engine analyzes the received and accumulated operation data and distinguishes between normal and abnormal operations. For example, copying a large amount of data late at night is not a normal operation and is therefore assigned a high anomaly score. If the anomaly score exceeds a certain threshold, the server determines that the behavior is abnormal and immediately alerts the administrator. At the same time, the server takes management actions on the device, such as restricting access, encrypting documents, and automatically locking them.

[0115] In addition, the server constantly collects new operational data, enabling the AI ​​engine to continuously learn. This data is used to update the operational pattern recognition model. By receiving feedback from administrators and adjusting the AI ​​engine model accordingly, it is possible to quickly respond to new threats and operational patterns.

[0116] Specific examples

[0117] For example, if a user attempts to copy a large amount of data outside of normal working hours, the server's AI engine will determine this operation as an anomaly and assign a score. If the anomaly score exceeds a threshold, the server will immediately issue an alert and take administrative action, such as temporarily restricting the user's access. It can also take other measures, such as changing documents to read-only mode.

[0118] Prompt Sentence Examples

[0119] "Please describe the system behavior that detects a user attempting to copy a large amount of data outside of normal working hours, determines this to be anomalous behavior, and issues an alert."

[0120] The document monitoring and management system according to the present invention has been described above. This system makes it possible to respond quickly and efficiently to dynamically changing threats, and effectively reduce the risk of information leakage and unauthorized use.

[0121] The flow of the identification process in the first embodiment will be described with reference to FIG.

[0122] Step 1:

[0123] Initial Setup

[0124] Input: Sensor and network device information

[0125] Output: Sensors and network devices are registered on the server and communication protocols are configured.

[0126] Specific behavior:

[0127] The server receives device information from sensors and network devices and registers it in a database. The server also sets the protocols (e.g., TCP / IP, HTTP / HTTPS) for communicating with sensors and network devices and performs connection tests with each device. This ensures that sensors and network devices are correctly registered on the server and can communicate normally.

[0128] Step 2:

[0129] Setting up the device

[0130] Input: Client software, terminal information

[0131] Output: The device is now able to communicate with the server in real time.

[0132] Specific behavior:

[0133] The device user downloads and installs dedicated client software, which attempts to connect to the server and performs a communication test to verify successful communication with the server. Specifically, it sends and receives simple messages from the server to the device to verify that a connection has been established.

[0134] Step 3:

[0135] Registering Users

[0136] Input: User personal information (name, email address, etc.), authentication information, permission level

[0137] Output: Registered user information, configured authentication information and permission level

[0138] Specific behavior:

[0139] Users use the server's registration form to enter personal information such as their name, email address, and password, and then submit it to the server. The server stores the information in a database, and the administrator assigns the appropriate permission level (e.g., view only, edit) to each user, creating an account that allows the user to access the system.

[0140] Step 4:

[0141] Document Monitoring

[0142] Input: User document operations (e.g., opening or editing a document)

[0143] Output: Encrypted operation data

[0144] Specific behavior:

[0145] When a user opens a document on a device, dedicated software captures the operation details in real time. The captured operation data is encrypted (e.g., AES-256) and sent to the server. This ensures that the user's document operation information is securely sent to the server.

[0146] Step 5:

[0147] Receiving and storing data

[0148] Input: Encrypted operational data

[0149] Output: Operational data stored in a database

[0150] Specific behavior:

[0151] The server receives the encrypted operation data sent from the device. The received data is decrypted and stored in a database. This data includes metadata such as the type of operation, timestamp, and user ID, and is accumulated in the database.

[0152] Step 6:

[0153] Data analysis and anomaly detection

[0154] Input: Operational data stored in the database

[0155] Output: Anomaly score and abnormal behavior detection results

[0156] Specific behavior:

[0157] The server's AI engine analyzes the operation data stored in the database. It distinguishes between normal and abnormal operations based on specific operation patterns and time periods. It calculates an anomaly score, and if the score exceeds a certain threshold, it determines that the operation is abnormal.

[0158] Step 7:

[0159] Alerts and take administrative actions

[0160] Input: Anomalous behavior detection results

[0161] Output: Alert to administrator and administrative action taken

[0162] Specific behavior:

[0163] If abnormal behavior is detected, the server immediately generates an alert and notifies the administrator. In addition, the server performs management actions on the device, such as restricting access, encrypting documents, and automatically locking the device, thereby preventing information leaks and unauthorized use.

[0164] Step 8:

[0165] Continuous learning and improvement

[0166] Input: New operation data, feedback from administrators

[0167] Output: Updated and improved AI engine model

[0168] Specific behavior:

[0169] The server constantly collects new operational data, allowing the AI ​​engine to continuously learn. This data is used to update the operational pattern recognition model. It also receives feedback from administrators and adjusts the AI ​​engine model accordingly to quickly respond to new threats and operational patterns.

[0170] (Application example 1)

[0171] Next, a description will be given of Application Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0172] While conventional document monitoring and management systems excel at monitoring document operation data, they are not adequate for monitoring the operation data of machines such as factory robots in real time and detecting abnormal behavior. As a result, it is difficult to effectively mitigate the risk of potential abnormal behavior or unauthorized use occurring within the factory. There is a need to solve this issue and provide a system that can monitor and manage a wide range of data, including the operation data of industrial products.

[0173] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 1 is realized by the following means.

[0174] In this invention, the server includes means for receiving and storing document operation data and machine operation data based on the operation data in real time, means for analyzing the received operation data and machine operation data and detecting abnormal behavior, means for issuing an alert and executing management action when abnormal behavior is detected, means for monitoring the operation of industrial products and detecting abnormal robot behavior as abnormal behavior, means for encrypting and transmitting the industrial product operations at regular intervals, and means for calculating an abnormal industrial product operation score and restricting the robot's operation as management action. This makes it possible to respond quickly and efficiently to dynamically changing threats and effectively reduce the risk of information leaks and unauthorized use.

[0175] "Document operation data" is information about operations (for example, viewing, editing, copying, etc.) performed by a user on a document.

[0176] "Machine operation data" is information about operations performed by industrial products or factory robots (e.g., moving, picking, placing parts, etc.).

[0177] A "sensor" is a device that detects a physical or environmental condition and converts it into an electrical signal.

[0178] A "network device" is a device for performing data communication, enabling data transfer with a server or client device.

[0179] A "server" is a central management system that provides services to client devices over a network.

[0180] "Artificial intelligence" is a technology that analyzes data and recognizes patterns to support decision-making.

[0181] An "alert" is a notification that notifies an administrator when abnormal behavior is detected.

[0182] "Administrative actions" are measures such as access restrictions and operational controls that are taken when abnormal behavior is detected.

[0183] "Abnormal behavior" is behavior that deviates from normal operation patterns and suggests security risks or fraudulent use.

[0184] The "score" is a numerical value that indicates the degree of abnormal behavior.

[0185] "Encryption" is a conversion process performed to ensure secure transmission of data.

[0186] "Industrial products" is a general term for machines and equipment manufactured and operated within a factory.

[0187] "Operation restrictions" are management measures that prohibit or restrict specific operations.

[0188] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention is a system for monitoring operation data of documents and industrial products, and detecting and managing abnormal behavior.

[0189] First, a server is set up to receive and store document and industrial product operation data in real time. The server includes the following main components:

[0190] 1. Sensors and network devices:

[0191] Sensors are devices that detect physical or environmental conditions and convert them into electrical signals, and network devices are devices that communicate with servers. These devices are deployed to monitor document usage and industrial product operation.

[0192] 2. Server means:

[0193] The server receives operational data and machine operation data in real time, stores them in encrypted form, and uses a database system (e.g., MySQL) to store and manage the received data.

[0194] 3. Artificial Intelligence Means:

[0195] An AI engine (e.g., TensorFlow) installed on the server analyzes the received operation data and machine operation data. Specifically, it learns operation patterns and distinguishes and analyzes normal and abnormal operations. It calculates a score for abnormal behavior and determines it as abnormal if it exceeds a threshold.

[0196] 4. Control measures:

[0197] If the server detects any abnormal behavior, it will send an alert to the administrator. It will then take administrative action, such as restricting or halting the robot's operation or controlling document access. Alert notifications are sent via email, SMS, or other methods.

[0198] Next, a specific method for monitoring robots and document operations will be described.

[0199] Factory robot monitoring examples:

[0200] 1. When a factory robot moves a part, this operation data (e.g., the robot's movement position, speed, time, etc.) is acquired by sensors.

[0201] 2. The acquired data is sent to a server via a network device, encrypted, and stored.

[0202] 3. The server's AI engine analyzes this data and detects abnormal behavior that differs from normal operation patterns.

[0203] 4. If abnormal behavior is detected, an alert is sent to the administrator and the robot's operations are restricted.

[0204] Example prompt sentence:

[0205] "I would like to develop software for a monitoring system for factory robots. Specifically, it would be a system that monitors robot operation data in real time and sends an alert to an administrator if unauthorized operation is detected. Please tell me about the specific implementation of data transmission and reception between the server and robots, anomaly detection using an AI engine, and management actions."

[0206] This system enables the server to respond quickly and efficiently to dynamically changing threats and comprehensively monitor and manage the operation data of industrial products, thereby effectively reducing the risk of potential abnormal operation or unauthorized use within the factory.

[0207] The flow of the specific processing in the application example 1 will be described with reference to FIG.

[0208] Step 1:

[0209] A user operates a document or industrial product that is being monitored. Specifically, the user starts the operation of a factory robot (moving or picking parts, etc.). Data on this operation (operation details, timestamp, user ID, etc.) is acquired through sensors.

[0210] Input: User actions

[0211] Output: Operation data

[0212] Step 2:

[0213] The terminal transmits the acquired operation data to the server via the network device. The operation data includes metadata such as the operation content, timestamp, and user ID. This data is encrypted before transmission.

[0214] Input: Retrieved operation data

[0215] Output: Encrypted operation data

[0216] Step 3:

[0217] The server receives the encrypted data sent from the device and stores it in a database, such as MySQL. The received data is automatically decrypted and saved for each required item.

[0218] Input: Encrypted operational data

[0219] Output: Operation data stored in a database

[0220] Step 4:

[0221] An AI engine (e.g., TensorFlow) on the server periodically scans the operation data in the database to detect anomalous patterns. The AI ​​engine identifies behavior that differs from normal operation patterns and calculates a score for the anomalous behavior.

[0222] Input: Operational data in the database

[0223] Output: Abnormal behavior score

[0224] Step 5:

[0225] The server evaluates the score of abnormal behavior calculated by the AI ​​engine and generates an alert if a certain threshold is exceeded, which is then sent to the administrator via email or SMS.

[0226] Input: Abnormal behavior score

[0227] Output: Alert notification

[0228] Step 6:

[0229] The server implements management actions when abnormal behavior is detected. Specifically, it temporarily restricts the operation of factory robots or changes document access permissions. Management actions include commands to enforce specified operation restrictions.

[0230] Input: Anomalous behavior detection results

[0231] Output: Management action taken

[0232] Step 7:

[0233] The server continuously updates the AI ​​engine's learning model based on newly collected data, and also incorporates feedback from administrators to improve the model's accuracy.

[0234] Input: New operational data and feedback from administrators

[0235] output: Updated AI engine learning model

[0236] Furthermore, an emotion engine that estimates the user's emotion may be combined. That is, the identification processing unit 290 may estimate the user's emotion using the emotion identification model 59 and perform identification processing using the user's emotion.

[0237] The document monitoring and management system of the present invention further incorporates an emotion engine that recognizes user emotions, enabling integrated analysis of document operation data and emotion data, enabling more precise detection of abnormal behavior. Specific embodiments are described below.

[0238] Initial Setup

[0239] Initial Server Configuration

[0240] The server connects to sensors and network devices, sets up communication protocols, starts up the AI ​​engine, emotion engine, and database, and checks their operation.

[0241] Setting up the device

[0242] The device is installed with dedicated client software. Hardware necessary for the emotion engine to function properly, such as a camera and microphone, is also connected. A connection test is performed to enable the device to communicate with the server, and normal operation is confirmed.

[0243] Registering Users

[0244] The user registers an account on the server, sets authentication information and permission levels, and obtains consent for the collection of the user's emotional data.

[0245] Document Monitoring and Emotion Recognition

[0246] Start working on the document

[0247] When a user opens a document, the device monitors the operation in real time. Along with the operation data, the emotion engine analyzes the user's facial expressions and voice to generate emotion data. This data is encrypted and sent to the server in real time.

[0248] Receiving and storing data

[0249] The server receives the operation data and emotion data sent from the device and stores them in a database, including metadata such as the type of operation, timestamp, and user ID.

[0250] Data analysis and anomaly detection

[0251] Data analysis

[0252] The server's AI engine analyzes the received and accumulated operation data and emotional data. Specifically, it analyzes both operation patterns and emotional patterns to distinguish between normal and abnormal operations.

[0253] Scoring abnormal behavior

[0254] The AI ​​engine calculates an anomaly score based on operation data and emotional data, and if this score exceeds a set threshold, it is determined to be abnormal behavior.

[0255] Alerts and take administrative actions

[0256] Generate alerts

[0257] The server will alert administrators in real time if any abnormal behavior is detected, which will be sent as a warning message.

[0258] Performing administrative actions

[0259] If the server detects any abnormal behavior, it will take administrative action such as restricting access to the device, automatically encrypting documents, or suspending document viewing, thereby effectively preventing information leaks and unauthorized use.

[0260] Continuous learning and improvement

[0261] New data collection and analysis

[0262] The server continuously collects new operational and emotional data, allowing the AI ​​engine to continuously learn. This data is used to update the operational and emotional pattern recognition model.

[0263] Model feedback and adjustment

[0264] The server receives feedback from administrators and reflects it in the AI ​​engine and emotion engine models, allowing it to quickly respond to new threats and operational and emotional patterns.

[0265] Specific examples

[0266] If a user opens a document outside of normal working hours and attempts to copy a large amount of data, the server's AI engine will recognize this operation as an anomaly. At the same time, if the emotion engine detects anxiety or impatience in the user's facial expression, the anomaly score will increase. If this score exceeds a threshold, the server will immediately issue an alert and take administrative action, temporarily restricting the user's access. Furthermore, the server can take measures such as changing the document to read-only.

[0267] The document monitoring and management system according to the present invention has been described above. By incorporating emotion recognition functionality, this system can respond more accurately to dynamically changing threats, effectively reducing the risk of information leaks and unauthorized use.

[0268] The processing flow will be explained below.

[0269] Step 1:

[0270] The server connects to sensors and network devices, sets up communication protocols, starts up the AI ​​engine, emotion engine, and database, and checks their operation.

[0271] Step 2:

[0272] Dedicated client software is installed on the device. In order for the emotion engine to function properly, the device must be connected to the necessary hardware, such as a camera and microphone. The device then performs a connection test to communicate with the server to confirm proper operation.

[0273] Step 3:

[0274] The user registers their account on the server, sets their authentication information and permission level, and also obtains consent for the collection of the user's emotional data.

[0275] Step 4:

[0276] When a user opens a document, the device monitors the operation in real time and captures the operation data. At the same time, the emotion engine analyzes the user's facial expressions and voice to generate emotion data. This data is encrypted and sent to the server in real time.

[0277] Step 5:

[0278] The server receives the operation data and emotion data sent from the device and stores them in a database, including metadata such as the type of operation, timestamp, and user ID.

[0279] Step 6:

[0280] The server's AI engine analyzes the accumulated operation data and emotional data. Specifically, it analyzes both operation patterns and emotional patterns to distinguish between normal and abnormal operations.

[0281] Step 7:

[0282] The AI ​​engine calculates an anomaly score based on operation data and emotional data, and if this score exceeds a set threshold, it is determined to be abnormal behavior.

[0283] Step 8:

[0284] If the server detects any abnormal behavior, it will send an alert to the administrator in real time. The alert will be sent as a warning message.

[0285] Step 9:

[0286] If the server detects any abnormal behavior, it will take administrative action such as restricting access to the device, automatically encrypting documents, or suspending document viewing, thereby effectively preventing information leaks and unauthorized use.

[0287] Step 10:

[0288] The server continuously collects new operation and emotion data, which the AI ​​engine continuously learns from. This data is used to update the operation and emotion pattern recognition model.

[0289] Step 11:

[0290] The server receives feedback from administrators and reflects it in the AI ​​engine and emotion engine models, allowing it to quickly respond to new threats and operational and emotional patterns.

[0291] The above are the specific processing steps of the document monitoring and management system combined with the emotion engine. This process ensures that the system can monitor and detect abnormal behavior in real time and respond quickly.

[0292] Example 2

[0293] Next, a description will be given of Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0294] In recent years, the risk of information leakage and unauthorized use has increased, and there is a problem that existing systems have difficulty accurately detecting abnormal behavior, especially when changes in emotions affect document operations. An object of the present invention is to provide a document monitoring and management system that can more accurately detect abnormal behavior through multifaceted data analysis, including emotional data.

[0295] The identification process by the identification processing unit 290 of the data processing device 12 in the second embodiment is realized by the following means. In this invention, the server includes means for receiving and storing document operation data and emotion data in real time, means for analyzing the received operation data and emotion data and detecting abnormal behavior, and means for issuing an alert and executing management action when abnormal behavior is detected. This enables precise and prompt detection of abnormal behavior, including risks associated with emotional changes.

[0296] A "sensor" is a device that gathers information from the environment.

[0297] A "network device" is a device that enables data communication between different devices.

[0298] A "server" is a computer system that provides data in response to requests from clients.

[0299] "Operation data" is data that is generated when a user operates a document.

[0300] "Emotion data" refers to data relating to emotions analyzed from the user's facial expressions and voice.

[0301] "Real-time" refers to data generation and processing occurring without delay.

[0302] "Storage" refers to the continuous storage of data.

[0303] "Artificial intelligence" is a technology that analyzes large amounts of data and learns, recognizes, and judges like a human being.

[0304] "Analysis" refers to the detailed investigation and analysis of data.

[0305] "Abnormal behavior" refers to behavior that deviates from normal operating patterns.

[0306] An "alert" is a warning that notifies you of the occurrence of an abnormality or emergency.

[0307] "Administrative actions" are measures or procedures that are implemented when abnormal behavior is detected.

[0308] "Encryption" is a technology that converts data into a format that cannot be deciphered by third parties.

[0309] A "threshold" refers to a specific standard or limit value that, if exceeded, is deemed abnormal.

[0310] The document monitoring and management system of the present invention combines an emotion engine that recognizes user emotions and performs an integrated analysis of document operation data and emotion data, thereby enabling more precise detection of abnormal behavior.

[0311] Initial Setup

[0312] Initial Server Configuration

[0313] The server connects to sensors and network devices and configures communication protocols, specifically TCP / IP and HTTP, and ensures security through firewalls. Next, the server starts up the AI ​​engine, emotion engine, and database, and performs self-diagnosis to confirm proper operation.

[0314] Setting up the device

[0315] The device installs dedicated client software, which automatically performs initial setup after installation. The device also connects to the hardware necessary for the emotion engine to function properly, such as a camera and microphone. The device then performs a connection test to communicate with the server, confirming that data is being sent and received normally.

[0316] Registering Users

[0317] The user accesses the server and registers for an account. They enter information such as their name, email address, and password to create an account. The server then stores the user's authentication information and sets their access permission level. The user also digitally signs a consent form for the acquisition of emotion data, and the server stores this information.

[0318] Document Monitoring and Emotion Recognition

[0319] Start working on the document

[0320] When a user opens a document, the device monitors the operation in real time. The user's operations (e.g., keyboard input, mouse clicks) are generated as operation data. At the same time, the emotion engine analyzes the video and audio captured by the camera and microphone to generate emotion data.

[0321] Receiving and storing data

[0322] The device encrypts the generated operation data and emotion data and transmits them in real time to the server. The server receives this data and stores it in a database, along with metadata such as the type of operation, timestamp, and user ID.

[0323] Data analysis and anomaly detection

[0324] Data analysis

[0325] The server's AI engine analyzes the received and accumulated operation and emotion data, extracting normal operation and emotion patterns and applying algorithms to detect abnormal behavior.

[0326] Scoring abnormal behavior

[0327] The server's AI engine calculates an anomaly score based on the operation data and emotion data. If this score exceeds a set threshold, the server determines that the behavior is abnormal.

[0328] Alerts and take administrative actions

[0329] Generate alerts

[0330] If the server detects any abnormal behavior, it will send a real-time warning message to the administrator, who will then check the alert and take action as necessary.

[0331] Performing administrative actions

[0332] If the server detects any abnormal behavior, it will take the following administrative actions on the device: restrict access and suspend the user's account. It will also automatically encrypt documents and change them to read-only to restrict further operations.

[0333] Continuous learning and improvement

[0334] New data collection and analysis

[0335] The server continuously collects new operation and emotion data and stores it in a database, which updates the operation and emotion pattern recognition model of the AI ​​engine.

[0336] Model feedback and adjustment

[0337] The server receives feedback from administrators and reflects it in the AI ​​engine and emotion engine models, allowing it to quickly respond to new threats and operational and emotional patterns.

[0338] Specific examples

[0339] If a user attempts to open a document and copy a large amount of data outside of normal working hours, the server's AI engine will recognize this action as an anomaly. At the same time, if the emotion engine detects anxiety or impatience in the user's facial expression, the anomaly score will increase. If this score exceeds a threshold, the server will immediately issue an alert and temporarily restrict the user's access. Additionally, changing the document to read-only can prevent information leaks.

[0340] Prompt Sentence Examples

[0341] "Please provide an overview of the following anomalous behavior detection system that combines data manipulation and sentiment analysis."

[0342] The above explanation has shown a specific embodiment of the document monitoring and management system of the present invention. By combining this system with emotion recognition functions, it can effectively reduce the risk of information leakage and unauthorized use.

[0343] The flow of the identification process in the second embodiment will be described with reference to FIG.

[0344] Step 1: Initial Server Setup

[0345] Input: Sensors and network devices

[0346] How it works: The server physically connects to sensors and network devices and configures communication protocols such as TCP / IP and HTTP.

[0347] Data processing: Install the necessary drivers and recognize connected devices.

[0348] Output: The connected device is working properly and the communication protocol is set.

[0349] Step 2: Initial launch of the AI ​​engine, emotion engine, and database

[0350] Input: AI engine, emotion engine, database

[0351] What happens: The server starts these engines and databases.

[0352] Data calculation: Each engine and database performs self-diagnosis to confirm normal operation.

[0353] Output: A working engine and database

[0354] Step 3: Install the client software

[0355] Input: Client software

[0356] How it works: The device downloads and installs the dedicated client software.

[0357] Data calculation: After installation, the initial settings will be performed automatically.

[0358] Output: Installed client software

[0359] Step 4: Connecting the camera and microphone

[0360] Input: Camera, Microphone

[0361] Action: The device connects the camera and microphone and installs the device drivers.

[0362] Data processing: Check that the device is working properly.

[0363] Output: A properly connected camera and microphone

[0364] Step 5: Test the connection

[0365] Input: terminal, server

[0366] Action: The device will perform a connection test with the server.

[0367] Data calculation: Tests data transmission and reception to ensure normal communication.

[0368] Output: Terminal and server that communicate normally

[0369] Step 6: User Account Registration

[0370] Input: User information (name, email address, password)

[0371] How it works: A user accesses the server and enters information into an account registration form.

[0372] Data processing: The server stores the entered information and creates an account.

[0373] Output: Registered user account

[0374] Step 7: Configure credentials and privilege levels

[0375] Input: User account information

[0376] How it works: The server stores the user's authentication information and sets access privileges.

[0377] Data processing: Parsing and storing information to set user permission levels.

[0378] Output: User account with credentials and privilege level

[0379] Step 8: Obtaining consent for emotional data collection

[0380] Input: User consent

[0381] How it works: The user electronically signs a consent form for emotional data collection.

[0382] Data processing: The server stores the consent information.

[0383] Output: User account with saved consent information

[0384] Step 9: Open the document

[0385] Input: The document selected by the user

[0386] How it works: When a user opens a document, the device monitors the activity.

[0387] Data processing: Generate operational data for the document.

[0388] Output: Generated operation data

[0389] Step 10: Generate emotion data

[0390] Input: Video from camera, audio from microphone

[0391] How it works: The emotion engine analyzes this data.

[0392] Data calculation: Generate emotion data from facial expressions and voice.

[0393] Output: Generated emotion data

[0394] Step 11: Encrypt and send data

[0395] Input: Operation data, emotion data

[0396] How it works: The device encrypts these data.

[0397] Data processing: Generate encrypted data.

[0398] Output: Encrypted operational and emotional data

[0399] Step 12: Receiving and storing data

[0400] Input: Encrypted operational and emotional data

[0401] Operation: The server receives data sent from the terminal.

[0402] Data processing: The received data is stored in a database.

[0403] Output: Accumulated operation data and emotion data

[0404] Step 13: Analyze the data

[0405] Input: Operational data and emotional data

[0406] How it works: The server's AI engine analyzes the data and extracts operation and emotion patterns.

[0407] Data arithmetic: Applying algorithms that distinguish between normal and abnormal operations.

[0408] Output: Abnormal behavior detection results

[0409] Step 14: Calculate the anomaly score

[0410] Input: Operational data and emotional data

[0411] How it works: The server's AI engine calculates the anomaly score.

[0412] Data calculation: Calculate the score and compare it with the set threshold.

[0413] Output: Abnormal behavior determination result

[0414] Step 15: Generate an alert

[0415] Input: Abnormal behavior determination result

[0416] How it works: The server sends real-time alert messages to the administrator.

[0417] Data processing: Generate alert messages.

[0418] Output: Alert sent to administrator

[0419] Step 16: Perform administrative actions

[0420] Input: Abnormal behavior determination result

[0421] How it works: The server restricts access to the device and automatically encrypts it.

[0422] Data manipulation: Restrictions such as changing documents to read-only.

[0423] Output: Administrative actions taken

[0424] Step 17: Collect and analyze new data

[0425] Input: New operational and emotional data

[0426] How it works: The server continuously collects new data and stores it in a database.

[0427] Data calculations: Updating the model based on new data.

[0428] Output: Updated action and emotion pattern recognition model

[0429] Step 18: Model feedback and refinement

[0430] Input: Admin feedback

[0431] How it works: The server analyzes the feedback and reflects it in the AI ​​engine and emotion engine models.

[0432] Data computation: Adjust models to adapt to new threats.

[0433] Output: Tuned AI Engine and Emotion Engine models

[0434] (Application example 2)

[0435] Next, a description will be given of Application Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0436] Conventional document monitoring systems detect abnormal behavior based solely on operation data, which limits their accuracy and can miss sophisticated fraudulent behavior. Furthermore, they do not take into account changes in user emotions, making dynamic and real-time anomaly detection difficult. Therefore, a method for detecting abnormal behavior with higher accuracy and preventing fraudulent use was needed.

[0437] The identification process by the identification processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means. In this invention, the server includes means for receiving and storing document operation data and emotion data in real time, means for analyzing the received operation data and emotion data and detecting anomalous behavior, means for issuing an alert and executing management action when anomalous behavior is detected, and means for analyzing the user's facial expressions and voice and generating emotion data. This makes it possible to detect anomalous behavior with high accuracy from both operation data and emotion data, effectively reducing the risk of information leaks and unauthorized use.

[0438] "Multiple sensors for monitoring document usage" refers to sensor devices that can monitor document operations and access status in real time.

[0439] A "network device" is a device for data communication, and is responsible for sending and receiving data between a server and a terminal via a network.

[0440] "Server means" refers to a computer system for storing, analyzing, and managing data, and is a device that has the function of receiving and storing document operation data and emotion data in real time.

[0441] "Document operation data" refers to data that records the history and content of operations that a user performs on a document.

[0442] "Emotional data" is data obtained by analyzing emotional information such as a user's facial expressions and voice.

[0443] "Artificial intelligence means" refers to systems that use technologies such as computer vision and voice analysis to analyze data and detect abnormal behavior.

[0444] A "controller" is a device or system that issues an alert when anomalous behavior is detected and takes control action such as access control or changing the state of a document.

[0445] "Emotion recognition means" is a device or system that analyzes a user's facial expressions and voice to generate emotion data.

[0446] The document monitoring and management system of the present invention, by combining an emotion recognition means for recognizing the user's emotions, performs an integrated analysis of document operation data and emotion data, making it possible to detect abnormal behavior with high accuracy.

[0447] Initial Setup

[0448] Initial Server Configuration

[0449] The server connects to sensors and network devices, sets up communication protocols, starts up the AI ​​engine, emotion recognition means, and database, and checks their operation.

[0450] Setting up the device

[0451] The device is installed with dedicated client software. Hardware necessary for the emotion recognition system to function properly, such as a camera and microphone, is also connected. A connection test is performed to enable the device to communicate with the server, and normal operation is confirmed.

[0452] Registering Users

[0453] The user registers an account on the server, sets authentication information and permission levels, and obtains consent for the collection of the user's emotional data.

[0454] Document Monitoring and Emotion Recognition

[0455] Start working on the document

[0456] When a user opens a document, the device monitors the operation in real time. Along with the operation data, the emotion recognition means analyzes the user's facial expressions and voice to generate emotion data. This data is encrypted and sent to the server in real time.

[0457] Receiving and storing data

[0458] The server receives the operation data and emotion data sent from the device and stores them in a database, including metadata such as the type of operation, timestamp, and user ID.

[0459] Data analysis and anomaly detection

[0460] Data analysis

[0461] The artificial intelligence means of the server analyzes the received and stored operation data and emotion data, specifically, analyzes both operation patterns and emotion patterns, and distinguishes between normal operations and abnormal operations.

[0462] Scoring abnormal behavior

[0463] The artificial intelligence means calculates an abnormality score based on the operation data and emotion data, and if the score exceeds a set threshold, it is determined to be an abnormal behavior.

[0464] Alerts and take administrative actions

[0465] Generate alerts

[0466] The server will alert administrators in real time if any abnormal behavior is detected, which will be sent as a warning message.

[0467] Performing administrative actions

[0468] If the server detects any abnormal behavior, it will take administrative action such as restricting access to the device, automatically encrypting documents, or suspending document viewing, thereby effectively preventing information leaks and unauthorized use.

[0469] Continuous learning and improvement

[0470] New data collection and analysis

[0471] The server continuously collects new operational and emotional data, allowing the artificial intelligence means to continuously learn. This data is used to update the operational and emotional pattern recognition models.

[0472] Model feedback and adjustment

[0473] The server receives feedback from administrators and incorporates it into its artificial intelligence and emotion recognition models, allowing it to quickly respond to new threats and operational and emotional patterns.

[0474] Specific examples

[0475] If a user opens a document outside of normal working hours and attempts to copy a large amount of data, the server's artificial intelligence system will recognize this operation as an anomaly. At the same time, if the emotion recognition system detects anxiety or impatience in the user's facial expression, the anomaly score will increase. If this score exceeds a threshold, the server will immediately issue an alert and take administrative action, temporarily restricting the user's access. Furthermore, the server can take measures such as changing the document to read-only.

[0476] Example prompts to input to the generative AI model

[0477] "If a user viewing an important document attempts to copy a large amount of data outside of working hours and shows signs of anxiety or impatience while doing so, write a Python program that will immediately alert an administrator and restrict the user's access to the document."

[0478] The flow of the specific processing in the application example 2 will be described with reference to FIG.

[0479] Step 1:

[0480] When a user opens a document, the device monitors the operation in real time. The device uses a camera and microphone to capture the user's facial expressions and voice, and analyzes these data using emotion recognition. The input is the user's document operation and real-time video and audio data, and the output is operation data and emotion data.

[0481] Step 2:

[0482] The emotion recognition means analyzes the captured video (facial expression) and audio data to detect the user's emotions. Data processing uses facial expression recognition algorithms and audio analysis algorithms to identify the user's emotional state. The input is the captured video and audio data, and the output is the user's emotional data.

[0483] Step 3:

[0484] The terminal encrypts the document's operation data and emotion data and transmits them to the server in real time. The input is the operation data and emotion data, and the output is the encrypted data.

[0485] Step 4:

[0486] The server stores the received operation data and emotion data in a database. Specifically, metadata such as the type of operation, timestamp, and user ID are attached to the data. The input is encrypted operation data and emotion data, and the output is the accumulated data stored in the database.

[0487] Step 5:

[0488] The server's artificial intelligence means analyzes the accumulated operation data and emotional data to detect abnormal behavior. It analyzes both operation patterns and emotional patterns to distinguish between normal and abnormal operations. The input is the accumulated operation data and emotional data, and the output is a score for abnormal behavior.

[0489] Step 6:

[0490] The artificial intelligence means calculates an anomaly score based on the operation data and emotion data. If the anomaly score exceeds a set threshold, it is judged as an abnormal behavior. The input is the analyzed operation data and emotion data, and the output is the anomaly score and its judgment result.

[0491] Step 7:

[0492] If the server detects abnormal behavior, it sends an alert to the administrator in real time. Specifically, a warning message is sent to the administrator's email or management console. The input is the anomaly score and its judgment result, and the output is the sent alert.

[0493] Step 8:

[0494] If the server detects abnormal behavior, it will take management actions such as restricting access to the device, automatically encrypting documents, or suspending document viewing. Specifically, it temporarily restricts user access and changes documents to read-only mode. The input is the anomaly score and its judgment result, and the output is the management action taken.

[0495] The specific processing unit 290 transmits the result of the specific processing to the smart device 14. In the smart device 14, the control unit 46A causes the output device 40 to output the result of the specific processing. The microphone 38B acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0496] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (registered trademark) (Internet search engine).<URL: https: / / openai.com / blog / chatgpt> ), Gemini (registered trademark) (Internet search <url: https: gemini.google.com ?hl="ja">) and other generation AIs. The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating voice, text data indicating text, and image data indicating an image is also input. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt, and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0497] In the above embodiment, an example in which the specific process is performed by the data processing device 12 has been given, but the technology of the present disclosure is not limited to this, and the specific process may be performed by the smart device 14.

[0498] [Second embodiment]

[0499] FIG. 3 shows an example of the configuration of a data processing system 210 according to the second embodiment.

[0500] 3, the data processing system 210 includes the data processing device 12 and smart glasses 214. An example of the data processing device 12 is a server.

[0501] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" according to the technology of the present disclosure. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0502] The smart glasses 214 include a computer 36, a microphone 238, a speaker 240, a camera 42, and a communication I / F 44. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, and the camera 42 are also connected to the bus 52.

[0503] The microphone 238 receives instructions and the like from the user 20 by receiving voice uttered by the user 20. The microphone 238 captures the voice uttered by the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio in accordance with instructions from the processor 46.

[0504] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the surroundings of user 20 (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[0505] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 control the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[0506] Fig. 4 shows an example of the main functions of the data processing device 12 and the smart glasses 214. As shown in Fig. 4, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0507] The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0508] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0509] In the smart glasses 214, the reception output process is performed by the processor 46. A reception output program 60 is stored in the storage 50. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output process is realized by the processor 46 operating as the control unit 46A in accordance with the reception output program 60 executed on the RAM 48.

[0510] Next, a description will be given of the identification process performed by the identification processing unit 290 of the data processing device 12. In the following description, the data processing device 12 will be referred to as the "server" and the smart glasses 214 will be referred to as the "terminal."

[0511] The document monitoring and management system of the present invention is implemented as follows: First, multiple sensors and network devices are installed and connected to a server. Then, client software is installed on the terminal and configured to enable real-time communication with the server.

[0512] Initial Setup

[0513] Initial Server Configuration

[0514] The server registers sensors and network devices, sets communication protocols, and initially starts up the AI ​​engine and database, verifying their operation.

[0515] Setting up the device

[0516] Dedicated client software is installed on the terminal, and a connection test is performed to communicate with the server.

[0517] Registering Users

[0518] The user registers their account on the server and sets the required authentication information and permission level.

[0519] Document Monitoring

[0520] Start working on the document

[0521] When a user opens a document, the device monitors the operation in real time, and the operation data is encrypted and sent to the server in real time.

[0522] Receiving and storing data

[0523] The server accumulates the received operation data and stores it in a database. The data includes metadata such as the operation type, timestamp, and user ID.

[0524] Data analysis and anomaly detection

[0525] Data analysis

[0526] The server's AI engine analyzes the received and accumulated operation data, specifically analyzing operation patterns and distinguishing between normal and abnormal operations.

[0527] Scoring abnormal behavior

[0528] The AI ​​engine calculates an anomaly score for each operation, and if the score exceeds a certain threshold, it determines that the behavior is abnormal.

[0529] Alerts and take administrative actions

[0530] Generate alerts

[0531] The server generates an alert and notifies the administrator if abnormal behavior is detected, such as when a user attempts to copy a large number of documents.

[0532] Performing administrative actions

[0533] When abnormal behavior is detected, the server immediately takes administrative action on the device, such as restricting access, encrypting documents, and automatically locking the device, effectively preventing information leaks and unauthorized use.

[0534] Continuous learning and improvement

[0535] New data collection and analysis

[0536] The server constantly collects new operation data, allowing the AI ​​engine to continuously learn, which is used to update the operation pattern recognition model.

[0537] Model feedback and adjustment

[0538] The server receives feedback from administrators and adjusts the AI ​​engine model accordingly, allowing it to quickly respond to new threats and operational patterns.

[0539] Specific examples

[0540] For example, if a user attempts to copy a large amount of data outside of normal working hours, the server's AI engine will determine this operation as an anomaly and assign a score. If the anomaly score exceeds a threshold, the server will immediately issue an alert and take administrative action, such as temporarily restricting the user's access. It can also take other measures, such as changing documents to read-only mode.

[0541] The document monitoring and management system according to the present invention has been described above. This system makes it possible to respond quickly and efficiently to dynamically changing threats, and effectively reduce the risk of information leakage and unauthorized use.

[0542] The processing flow will be explained below.

[0543] Step 1:

[0544] The server connects to sensors and network devices, sets up communication protocols, and initially starts up the AI ​​engine and database, verifying their operation.

[0545] Step 2:

[0546] Dedicated client software is installed on the device, and a connection test is performed to ensure the device communicates with the server and that it is operating normally.

[0547] Step 3:

[0548] The user registers their account on the server and sets the required authentication information and permission level.

[0549] Step 4:

[0550] When a user opens a document, the device monitors the operation in real time, and the operation data is encrypted and sent to the server in real time.

[0551] Step 5:

[0552] The server receives the operation data sent from the device and stores it in a database. The operation data includes metadata such as the type of operation, timestamp, and user ID.

[0553] Step 6:

[0554] The server's AI engine analyzes the accumulated operation data, specifically analyzing operation patterns and distinguishing between normal and abnormal operations.

[0555] Step 7:

[0556] The AI ​​engine calculates an anomaly score for each operation, and if this score exceeds a set threshold, it is deemed to be an abnormal behavior.

[0557] Step 8:

[0558] The server will alert administrators in real time when abnormal behavior is detected, which will be sent as a warning message.

[0559] Step 9:

[0560] If the server detects any abnormal behavior, it immediately takes administrative action on the device, such as restricting access or automatically encrypting documents.

[0561] Step 10:

[0562] The server continuously collects new operation data, and the AI ​​engine continuously learns, improving the accuracy of the operation pattern recognition model.

[0563] Step 11:

[0564] The server receives feedback from administrators and incorporates it into the AI ​​engine's models, allowing it to respond quickly to new threats and operational patterns.

[0565] The above are the specific processing steps of the document monitoring and management system. This process ensures that the system can monitor in real time, detect abnormal behavior, and respond quickly.

[0566] Example 1

[0567] Next, a description will be given of Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the smart glasses 214 will be referred to as a "terminal."

[0568] Conventional document monitoring and management systems have difficulty monitoring user operations in real time, which can result in delayed detection of abnormal behavior. Furthermore, management actions after an abnormality is detected may not be implemented quickly enough, increasing the risk of information leaks and unauthorized use. Furthermore, because the system relied on static models, it was difficult to respond to new threats and operation patterns.

[0569] The specific processing by the specific processing unit 290 of the data processing device 12 in the first embodiment is realized by the following means.

[0570] In this invention, the server includes an initial setting means for registering sensors and network devices and setting communication protocols, a terminal setup means for installing client software and enabling real-time communication with the server, a user registration means for registering user accounts and setting authentication information and authority levels, a document monitoring means for monitoring user document operations, a data transmission means for encrypting operation data and transmitting it to the server in real time, a database means for storing received operation data, an artificial intelligence means for analyzing the received and stored operation data, anomaly detection means for analyzing operation patterns and detecting abnormal behavior, a management means for issuing an alert and taking management action when abnormal behavior is detected, and a learning means for collecting new operation data and continuously learning and improving. This enables real-time monitoring of document operations, rapid anomaly detection, and the execution of management action.

[0571] A "sensor" is a device for detecting physical environmental conditions and document manipulation status.

[0572] A "network device" is a device that connects sensors and terminals to servers and performs data communication.

[0573] The "initial setting means" is a means having the function of registering sensors and network devices and setting communication protocols.

[0574] The "terminal setup means" is a means having a function for installing client software and enabling real-time communication with the server.

[0575] The "user registration means" is a means having the function of registering a user's account and setting authentication information and authority level.

[0576] The "document monitoring means" is a means having a function of monitoring operations when a user operates a document.

[0577] The "data transmission means" is a means having a function of encrypting operation data and transmitting it to the server in real time.

[0578] The "database means" is a means having a function of storing received operation data.

[0579] "Artificial intelligence means" means means having the function of analyzing received and stored operational data.

[0580] The "abnormality detection means" is a means having a function of analyzing operation patterns and detecting abnormal behavior.

[0581] A "management means" is a means that has the function of issuing an alert and taking management action when abnormal behavior is detected.

[0582] A "learning means" is a means that has the ability to collect new operational data and continuously learn and improve.

[0583] The document monitoring and management system of the present invention connects multiple sensors and network devices to a server, and monitors and manages data in real time as users manipulate documents. This system includes an initial setting means, a terminal setup means, a user registration means, a document monitoring means, a data transmission means, a database means, an artificial intelligence means, an anomaly detection means, a management means, and a learning means.

[0584] First, the server registers sensors and network devices and configures communication protocols. This includes registering information from sensors and network devices in a database and configuring communication protocols (e.g., TCP / IP, HTTP). The server also starts AI engines such as TensorFlow and PyTorch and databases such as MySQL and PostgreSQL, and checks their operation.

[0585] Next, dedicated client software is installed on the device and configured to enable real-time communication with the server. The user uses this to perform a connection test with the server and confirm that communication is normal. For example, a connection test can be performed by sending and receiving simple messages.

[0586] Users register their accounts on the server and set the required authentication information and permission levels. They enter information such as their name and email address using a special registration form, which is then sent to the server, which stores this information in a database.

[0587] When a user operates on a document, the client software on the device monitors the operation in real time. The operation data (e.g., copy, edit) is encrypted (e.g., AES-256) and sent to the server. The server receives it and stores it in a database. The operation data includes metadata such as the type of operation, timestamp, and user ID.

[0588] The server's AI engine analyzes the received and accumulated operation data and distinguishes between normal and abnormal operations. For example, copying a large amount of data late at night is not a normal operation and is therefore assigned a high anomaly score. If the anomaly score exceeds a certain threshold, the server determines that the behavior is abnormal and immediately alerts the administrator. At the same time, the server takes management actions on the device, such as restricting access, encrypting documents, and automatically locking them.

[0589] In addition, the server constantly collects new operational data, enabling the AI ​​engine to continuously learn. This data is used to update the operational pattern recognition model. By receiving feedback from administrators and adjusting the AI ​​engine model accordingly, it is possible to quickly respond to new threats and operational patterns.

[0590] Specific examples

[0591] For example, if a user attempts to copy a large amount of data outside of normal working hours, the server's AI engine will determine this operation as an anomaly and assign a score. If the anomaly score exceeds a threshold, the server will immediately issue an alert and take administrative action, such as temporarily restricting the user's access. It can also take other measures, such as changing documents to read-only mode.

[0592] Prompt Sentence Examples

[0593] "Please describe the system behavior that detects a user attempting to copy a large amount of data outside of normal working hours, determines this to be anomalous behavior, and issues an alert."

[0594] The document monitoring and management system according to the present invention has been described above. This system makes it possible to respond quickly and efficiently to dynamically changing threats, and effectively reduce the risk of information leakage and unauthorized use.

[0595] The flow of the identification process in the first embodiment will be described with reference to FIG.

[0596] Step 1:

[0597] Initial Setup

[0598] Input: Sensor and network device information

[0599] Output: Sensors and network devices are registered on the server and communication protocols are configured.

[0600] Specific behavior:

[0601] The server receives device information from sensors and network devices and registers it in a database. The server also sets the protocols (e.g., TCP / IP, HTTP / HTTPS) for communicating with sensors and network devices and performs connection tests with each device. This ensures that sensors and network devices are correctly registered on the server and can communicate normally.

[0602] Step 2:

[0603] Setting up the device

[0604] Input: Client software, terminal information

[0605] Output: The device is now able to communicate with the server in real time.

[0606] Specific behavior:

[0607] The device user downloads and installs dedicated client software, which attempts to connect to the server and performs a communication test to verify successful communication with the server. Specifically, it sends and receives simple messages from the server to the device to verify that a connection has been established.

[0608] Step 3:

[0609] Registering Users

[0610] Input: User personal information (name, email address, etc.), authentication information, permission level

[0611] Output: Registered user information, configured authentication information and permission level

[0612] Specific behavior:

[0613] Users use the server's registration form to enter personal information such as their name, email address, and password, and then submit it to the server. The server stores the information in a database, and the administrator assigns the appropriate permission level (e.g., view only, edit) to each user, creating an account that allows the user to access the system.

[0614] Step 4:

[0615] Document Monitoring

[0616] Input: User document operations (e.g., opening or editing a document)

[0617] Output: Encrypted operation data

[0618] Specific behavior:

[0619] When a user opens a document on a device, dedicated software captures the operation details in real time. The captured operation data is encrypted (e.g., AES-256) and sent to the server. This ensures that the user's document operation information is securely sent to the server.

[0620] Step 5:

[0621] Receiving and storing data

[0622] Input: Encrypted operational data

[0623] Output: Operational data stored in a database

[0624] Specific behavior:

[0625] The server receives the encrypted operation data sent from the device. The received data is decrypted and stored in a database. This data includes metadata such as the type of operation, timestamp, and user ID, and is accumulated in the database.

[0626] Step 6:

[0627] Data analysis and anomaly detection

[0628] Input: Operational data stored in the database

[0629] Output: Anomaly score and abnormal behavior detection results

[0630] Specific behavior:

[0631] The server's AI engine analyzes the operation data stored in the database. It distinguishes between normal and abnormal operations based on specific operation patterns and time periods. It calculates an anomaly score, and if the score exceeds a certain threshold, it determines that the operation is abnormal.

[0632] Step 7:

[0633] Alerts and take administrative actions

[0634] Input: Anomalous behavior detection results

[0635] Output: Alert to administrator and administrative action taken

[0636] Specific behavior:

[0637] If abnormal behavior is detected, the server immediately generates an alert and notifies the administrator. In addition, the server performs management actions on the device, such as restricting access, encrypting documents, and automatically locking the device, thereby preventing information leaks and unauthorized use.

[0638] Step 8:

[0639] Continuous learning and improvement

[0640] Input: New operation data, feedback from administrators

[0641] Output: Updated and improved AI engine model

[0642] Specific behavior:

[0643] The server constantly collects new operational data, allowing the AI ​​engine to continuously learn. This data is used to update the operational pattern recognition model. It also receives feedback from administrators and adjusts the AI ​​engine model accordingly to quickly respond to new threats and operational patterns.

[0644] (Application example 1)

[0645] Next, a description will be given of Application Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the smart glasses 214 will be referred to as a "terminal."

[0646] While conventional document monitoring and management systems excel at monitoring document operation data, they are not adequate for monitoring the operation data of machines such as factory robots in real time and detecting abnormal behavior. As a result, it is difficult to effectively mitigate the risk of potential abnormal behavior or unauthorized use occurring within the factory. There is a need to solve this issue and provide a system that can monitor and manage a wide range of data, including the operation data of industrial products.

[0647] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 1 is realized by the following means.

[0648] In this invention, the server includes means for receiving and storing document operation data and machine operation data based on the operation data in real time, means for analyzing the received operation data and machine operation data and detecting abnormal behavior, means for issuing an alert and executing management action when abnormal behavior is detected, means for monitoring the operation of industrial products and detecting abnormal robot behavior as abnormal behavior, means for encrypting and transmitting the industrial product operations at regular intervals, and means for calculating an abnormal industrial product operation score and restricting the robot's operation as management action. This makes it possible to respond quickly and efficiently to dynamically changing threats and effectively reduce the risk of information leaks and unauthorized use.

[0649] "Document operation data" is information about operations (for example, viewing, editing, copying, etc.) performed by a user on a document.

[0650] "Machine operation data" is information about operations performed by industrial products or factory robots (e.g., moving, picking, placing parts, etc.).

[0651] A "sensor" is a device that detects a physical or environmental condition and converts it into an electrical signal.

[0652] A "network device" is a device for performing data communication, enabling data transfer with a server or client device.

[0653] A "server" is a central management system that provides services to client devices over a network.

[0654] "Artificial intelligence" is a technology that analyzes data and recognizes patterns to support decision-making.

[0655] An "alert" is a notification that notifies an administrator when abnormal behavior is detected.

[0656] "Administrative actions" are measures such as access restrictions and operational controls that are taken when abnormal behavior is detected.

[0657] "Abnormal behavior" is behavior that deviates from normal operation patterns and suggests security risks or fraudulent use.

[0658] The "score" is a numerical value that indicates the degree of abnormal behavior.

[0659] "Encryption" is a conversion process performed to ensure secure transmission of data.

[0660] "Industrial products" is a general term for machines and equipment manufactured and operated within a factory.

[0661] "Operation restrictions" are management measures that prohibit or restrict specific operations.

[0662] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention is a system for monitoring operation data of documents and industrial products, and detecting and managing abnormal behavior.

[0663] First, a server is set up to receive and store document and industrial product operation data in real time. The server includes the following main components:

[0664] 1. Sensors and network devices:

[0665] Sensors are devices that detect physical or environmental conditions and convert them into electrical signals, and network devices are devices that communicate with servers. These devices are deployed to monitor document usage and industrial product operation.

[0666] 2. Server means:

[0667] The server receives operational data and machine operation data in real time, stores them in encrypted form, and uses a database system (e.g., MySQL) to store and manage the received data.

[0668] 3. Artificial Intelligence Means:

[0669] An AI engine (e.g., TensorFlow) installed on the server analyzes the received operation data and machine operation data. Specifically, it learns operation patterns and distinguishes and analyzes normal and abnormal operations. It calculates a score for abnormal behavior and determines it as abnormal if it exceeds a threshold.

[0670] 4. Control measures:

[0671] If the server detects any abnormal behavior, it will send an alert to the administrator. It will then take administrative action, such as restricting or halting the robot's operation or controlling document access. Alert notifications are sent via email, SMS, or other methods.

[0672] Next, a specific method for monitoring robots and document operations will be described.

[0673] Factory robot monitoring examples:

[0674] 1. When a factory robot moves a part, this operation data (e.g., the robot's movement position, speed, time, etc.) is acquired by sensors.

[0675] 2. The acquired data is sent to a server via a network device, encrypted, and stored.

[0676] 3. The server's AI engine analyzes this data and detects abnormal behavior that differs from normal operation patterns.

[0677] 4. If abnormal behavior is detected, an alert is sent to the administrator and the robot's operations are restricted.

[0678] Example prompt sentence:

[0679] "I would like to develop software for a monitoring system for factory robots. Specifically, it would be a system that monitors robot operation data in real time and sends an alert to an administrator if unauthorized operation is detected. Please tell me about the specific implementation of data transmission and reception between the server and robots, anomaly detection using an AI engine, and management actions."

[0680] This system enables the server to respond quickly and efficiently to dynamically changing threats and comprehensively monitor and manage the operation data of industrial products, thereby effectively reducing the risk of potential abnormal operation or unauthorized use within the factory.

[0681] The flow of the specific processing in the application example 1 will be described with reference to FIG.

[0682] Step 1:

[0683] A user operates a document or industrial product that is being monitored. Specifically, the user starts the operation of a factory robot (moving or picking parts, etc.). Data on this operation (operation details, timestamp, user ID, etc.) is acquired through sensors.

[0684] Input: User actions

[0685] Output: Operation data

[0686] Step 2:

[0687] The terminal transmits the acquired operation data to the server via the network device. The operation data includes metadata such as the operation content, timestamp, and user ID. This data is encrypted before transmission.

[0688] Input: Retrieved operation data

[0689] Output: Encrypted operation data

[0690] Step 3:

[0691] The server receives the encrypted data sent from the device and stores it in a database, such as MySQL. The received data is automatically decrypted and saved for each required item.

[0692] Input: Encrypted operational data

[0693] Output: Operation data stored in a database

[0694] Step 4:

[0695] An AI engine (e.g., TensorFlow) on the server periodically scans the operation data in the database to detect anomalous patterns. The AI ​​engine identifies behavior that differs from normal operation patterns and calculates a score for the anomalous behavior.

[0696] Input: Operational data in the database

[0697] Output: Abnormal behavior score

[0698] Step 5:

[0699] The server evaluates the score of abnormal behavior calculated by the AI ​​engine and generates an alert if a certain threshold is exceeded, which is then sent to the administrator via email or SMS.

[0700] Input: Abnormal behavior score

[0701] Output: Alert notification

[0702] Step 6:

[0703] The server implements management actions when abnormal behavior is detected. Specifically, it temporarily restricts the operation of factory robots or changes document access permissions. Management actions include commands to enforce specified operation restrictions.

[0704] Input: Anomalous behavior detection results

[0705] Output: Management action taken

[0706] Step 7:

[0707] The server continuously updates the AI ​​engine's learning model based on newly collected data, and also incorporates feedback from administrators to improve the model's accuracy.

[0708] Input: New operational data and feedback from administrators

[0709] output: Updated AI engine learning model

[0710] Furthermore, an emotion engine that estimates the user's emotion may be further combined. That is, the identification processing unit 290 may estimate the user's emotion using the emotion identification model 59, and perform identification processing using the user's emotion.

[0711] The document monitoring and management system of the present invention further incorporates an emotion engine that recognizes user emotions, enabling integrated analysis of document operation data and emotion data, enabling more precise detection of abnormal behavior. Specific embodiments are described below.

[0712] Initial Setup

[0713] Initial Server Configuration

[0714] The server connects to sensors and network devices, sets up communication protocols, starts up the AI ​​engine, emotion engine, and database, and checks their operation.

[0715] Setting up the device

[0716] The device is installed with dedicated client software. Hardware necessary for the emotion engine to function properly, such as a camera and microphone, is also connected. A connection test is performed to enable the device to communicate with the server, and normal operation is confirmed.

[0717] Registering Users

[0718] The user registers an account on the server, sets authentication information and permission levels, and obtains consent for the collection of the user's emotional data.

[0719] Document Monitoring and Emotion Recognition

[0720] Start working on the document

[0721] When a user opens a document, the device monitors the operation in real time. Along with the operation data, the emotion engine analyzes the user's facial expressions and voice to generate emotion data. This data is encrypted and sent to the server in real time.

[0722] Receiving and storing data

[0723] The server receives the operation data and emotion data sent from the device and stores them in a database, including metadata such as the type of operation, timestamp, and user ID.

[0724] Data analysis and anomaly detection

[0725] Data analysis

[0726] The server's AI engine analyzes the received and accumulated operation data and emotional data. Specifically, it analyzes both operation patterns and emotional patterns to distinguish between normal and abnormal operations.

[0727] Scoring abnormal behavior

[0728] The AI ​​engine calculates an anomaly score based on operation data and emotional data, and if this score exceeds a set threshold, it is determined to be abnormal behavior.

[0729] Alerts and take administrative actions

[0730] Generate alerts

[0731] The server will alert administrators in real time if any abnormal behavior is detected, which will be sent as a warning message.

[0732] Performing administrative actions

[0733] If the server detects any abnormal behavior, it will take administrative action such as restricting access to the device, automatically encrypting documents, or suspending document viewing, thereby effectively preventing information leaks and unauthorized use.

[0734] Continuous learning and improvement

[0735] New data collection and analysis

[0736] The server continuously collects new operational and emotional data, allowing the AI ​​engine to continuously learn. This data is used to update the operational and emotional pattern recognition model.

[0737] Model feedback and adjustment

[0738] The server receives feedback from administrators and reflects it in the AI ​​engine and emotion engine models, allowing it to quickly respond to new threats and operational and emotional patterns.

[0739] Specific examples

[0740] If a user opens a document outside of normal working hours and attempts to copy a large amount of data, the server's AI engine will recognize this operation as an anomaly. At the same time, if the emotion engine detects anxiety or impatience in the user's facial expression, the anomaly score will increase. If this score exceeds a threshold, the server will immediately issue an alert and take administrative action, temporarily restricting the user's access. Furthermore, the server can take measures such as changing the document to read-only.

[0741] The document monitoring and management system according to the present invention has been described above. By incorporating emotion recognition functionality, this system can respond more accurately to dynamically changing threats, effectively reducing the risk of information leaks and unauthorized use.

[0742] The processing flow will be explained below.

[0743] Step 1:

[0744] The server connects to sensors and network devices, sets up communication protocols, starts up the AI ​​engine, emotion engine, and database, and checks their operation.

[0745] Step 2:

[0746] Dedicated client software is installed on the device. In order for the emotion engine to function properly, the device must be connected to the necessary hardware, such as a camera and microphone. The device then performs a connection test to communicate with the server to confirm proper operation.

[0747] Step 3:

[0748] The user registers their account on the server, sets their authentication information and permission level, and also obtains consent for the collection of the user's emotional data.

[0749] Step 4:

[0750] When a user opens a document, the device monitors the operation in real time and captures the operation data. At the same time, the emotion engine analyzes the user's facial expressions and voice to generate emotion data. This data is encrypted and sent to the server in real time.

[0751] Step 5:

[0752] The server receives the operation data and emotion data sent from the device and stores them in a database, including metadata such as the type of operation, timestamp, and user ID.

[0753] Step 6:

[0754] The server's AI engine analyzes the accumulated operation data and emotional data. Specifically, it analyzes both operation patterns and emotional patterns to distinguish between normal and abnormal operations.

[0755] Step 7:

[0756] The AI ​​engine calculates an anomaly score based on operation data and emotional data, and if this score exceeds a set threshold, it is determined to be abnormal behavior.

[0757] Step 8:

[0758] If the server detects any abnormal behavior, it will send an alert to the administrator in real time. The alert will be sent as a warning message.

[0759] Step 9:

[0760] If the server detects any abnormal behavior, it will take administrative action such as restricting access to the device, automatically encrypting documents, or suspending document viewing, thereby effectively preventing information leaks and unauthorized use.

[0761] Step 10:

[0762] The server continuously collects new operation and emotion data, which the AI ​​engine continuously learns from. This data is used to update the operation and emotion pattern recognition model.

[0763] Step 11:

[0764] The server receives feedback from administrators and reflects it in the AI ​​engine and emotion engine models, allowing it to quickly respond to new threats and operational and emotional patterns.

[0765] The above are the specific processing steps of the document monitoring and management system combined with the emotion engine. This process ensures that the system can monitor and detect abnormal behavior in real time and respond quickly.

[0766] Example 2

[0767] Next, a description will be given of Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the smart glasses 214 will be referred to as a "terminal."

[0768] In recent years, the risk of information leakage and unauthorized use has increased, and there is a problem that existing systems have difficulty accurately detecting abnormal behavior, especially when changes in emotions affect document operations. An object of the present invention is to provide a document monitoring and management system that can more accurately detect abnormal behavior through multifaceted data analysis, including emotional data.

[0769] The identification process by the identification processing unit 290 of the data processing device 12 in the second embodiment is realized by the following means. In this invention, the server includes means for receiving and storing document operation data and emotion data in real time, means for analyzing the received operation data and emotion data and detecting abnormal behavior, and means for issuing an alert and executing management action when abnormal behavior is detected. This enables precise and prompt detection of abnormal behavior, including risks associated with emotional changes.

[0770] A "sensor" is a device that gathers information from the environment.

[0771] A "network device" is a device that enables data communication between different devices.

[0772] A "server" is a computer system that provides data in response to requests from clients.

[0773] "Operation data" is data that is generated when a user operates a document.

[0774] "Emotion data" refers to data relating to emotions analyzed from the user's facial expressions and voice.

[0775] "Real-time" refers to data generation and processing occurring without delay.

[0776] "Storage" refers to the continuous storage of data.

[0777] "Artificial intelligence" is a technology that analyzes large amounts of data and learns, recognizes, and judges like a human being.

[0778] "Analysis" refers to the detailed investigation and analysis of data.

[0779] "Abnormal behavior" refers to behavior that deviates from normal operating patterns.

[0780] An "alert" is a warning that notifies you of the occurrence of an abnormality or emergency.

[0781] "Administrative actions" are measures or procedures that are implemented when abnormal behavior is detected.

[0782] "Encryption" is a technology that converts data into a format that cannot be deciphered by third parties.

[0783] A "threshold" refers to a specific standard or limit value that, if exceeded, is deemed abnormal.

[0784] The document monitoring and management system of the present invention combines an emotion engine that recognizes user emotions and performs an integrated analysis of document operation data and emotion data, thereby enabling more precise detection of abnormal behavior.

[0785] Initial Setup

[0786] Initial Server Configuration

[0787] The server connects to sensors and network devices and configures communication protocols, specifically TCP / IP and HTTP, and ensures security through firewalls. Next, the server starts up the AI ​​engine, emotion engine, and database, and performs self-diagnosis to confirm proper operation.

[0788] Setting up the device

[0789] The device installs dedicated client software, which automatically performs initial setup after installation. The device also connects to the hardware necessary for the emotion engine to function properly, such as a camera and microphone. The device then performs a connection test to communicate with the server, confirming that data is being sent and received normally.

[0790] Registering Users

[0791] The user accesses the server and registers for an account. They enter information such as their name, email address, and password to create an account. The server then stores the user's authentication information and sets their access permission level. The user also digitally signs a consent form for the acquisition of emotion data, and the server stores this information.

[0792] Document Monitoring and Emotion Recognition

[0793] Start working on the document

[0794] When a user opens a document, the device monitors the operation in real time. The user's operations (e.g., keyboard input, mouse clicks) are generated as operation data. At the same time, the emotion engine analyzes the video and audio captured by the camera and microphone to generate emotion data.

[0795] Receiving and storing data

[0796] The device encrypts the generated operation data and emotion data and transmits them in real time to the server. The server receives this data and stores it in a database, along with metadata such as the type of operation, timestamp, and user ID.

[0797] Data analysis and anomaly detection

[0798] Data analysis

[0799] The server's AI engine analyzes the received and accumulated operation and emotion data, extracting normal operation and emotion patterns and applying algorithms to detect abnormal behavior.

[0800] Scoring abnormal behavior

[0801] The server's AI engine calculates an anomaly score based on the operation data and emotion data. If this score exceeds a set threshold, the server determines that the behavior is abnormal.

[0802] Alerts and take administrative actions

[0803] Generate alerts

[0804] If the server detects any abnormal behavior, it will send a real-time warning message to the administrator, who will then check the alert and take action as necessary.

[0805] Performing administrative actions

[0806] If the server detects any abnormal behavior, it will take the following administrative actions on the device: restrict access and suspend the user's account. It will also automatically encrypt documents and change them to read-only to restrict further operations.

[0807] Continuous learning and improvement

[0808] New data collection and analysis

[0809] The server continuously collects new operation and emotion data and stores it in a database, which updates the operation and emotion pattern recognition model of the AI ​​engine.

[0810] Model feedback and adjustment

[0811] The server receives feedback from administrators and reflects it in the AI ​​engine and emotion engine models, allowing it to quickly respond to new threats and operational and emotional patterns.

[0812] Specific examples

[0813] If a user attempts to open a document and copy a large amount of data outside of normal working hours, the server's AI engine will recognize this action as an anomaly. At the same time, if the emotion engine detects anxiety or impatience in the user's facial expression, the anomaly score will increase. If this score exceeds a threshold, the server will immediately issue an alert and temporarily restrict the user's access. Additionally, changing the document to read-only can prevent information leaks.

[0814] Prompt Sentence Examples

[0815] "Please provide an overview of the following anomalous behavior detection system that combines data manipulation and sentiment analysis."

[0816] The above explanation has shown a specific embodiment of the document monitoring and management system of the present invention. By combining this system with emotion recognition functions, it can effectively reduce the risk of information leakage and unauthorized use.

[0817] The flow of the identification process in the second embodiment will be described with reference to FIG.

[0818] Step 1: Initial Server Setup

[0819] Input: Sensors and network devices

[0820] How it works: The server physically connects to sensors and network devices and configures communication protocols such as TCP / IP and HTTP.

[0821] Data processing: Install the necessary drivers and recognize connected devices.

[0822] Output: The connected device is working properly and the communication protocol is set.

[0823] Step 2: Initial launch of the AI ​​engine, emotion engine, and database

[0824] Input: AI engine, emotion engine, database

[0825] What happens: The server starts these engines and databases.

[0826] Data calculation: Each engine and database performs self-diagnosis to confirm normal operation.

[0827] Output: A working engine and database

[0828] Step 3: Install the client software

[0829] Input: Client software

[0830] How it works: The device downloads and installs the dedicated client software.

[0831] Data calculation: After installation, the initial settings will be performed automatically.

[0832] Output: Installed client software

[0833] Step 4: Connecting the camera and microphone

[0834] Input: Camera, Microphone

[0835] Action: The device connects the camera and microphone and installs the device drivers.

[0836] Data processing: Check that the device is working properly.

[0837] Output: A properly connected camera and microphone

[0838] Step 5: Test the connection

[0839] Input: terminal, server

[0840] Action: The device will perform a connection test with the server.

[0841] Data calculation: Tests data transmission and reception to ensure normal communication.

[0842] Output: Terminal and server that communicate normally

[0843] Step 6: User Account Registration

[0844] Input: User information (name, email address, password)

[0845] How it works: A user accesses the server and enters information into an account registration form.

[0846] Data processing: The server stores the entered information and creates an account.

[0847] Output: Registered user account

[0848] Step 7: Configure credentials and privilege levels

[0849] Input: User account information

[0850] How it works: The server stores the user's authentication information and sets access privileges.

[0851] Data processing: Parsing and storing information to set user permission levels.

[0852] Output: User account with credentials and privilege level

[0853] Step 8: Obtaining consent for emotional data collection

[0854] Input: User consent

[0855] How it works: The user electronically signs a consent form for emotional data collection.

[0856] Data processing: The server stores the consent information.

[0857] Output: User account with saved consent information

[0858] Step 9: Open the document

[0859] Input: The document selected by the user

[0860] How it works: When a user opens a document, the device monitors the activity.

[0861] Data processing: Generate operational data for the document.

[0862] Output: Generated operation data

[0863] Step 10: Generate emotion data

[0864] Input: Video from camera, audio from microphone

[0865] How it works: The emotion engine analyzes this data.

[0866] Data calculation: Generate emotion data from facial expressions and voice.

[0867] Output: Generated emotion data

[0868] Step 11: Encrypt and send data

[0869] Input: Operation data, emotion data

[0870] How it works: The device encrypts these data.

[0871] Data processing: Generate encrypted data.

[0872] Output: Encrypted operational and emotional data

[0873] Step 12: Receiving and storing data

[0874] Input: Encrypted operational and emotional data

[0875] Operation: The server receives data sent from the terminal.

[0876] Data processing: The received data is stored in a database.

[0877] Output: Accumulated operation data and emotion data

[0878] Step 13: Analyze the data

[0879] Input: Operational data and emotional data

[0880] How it works: The server's AI engine analyzes the data and extracts operation and emotion patterns.

[0881] Data arithmetic: Applying algorithms that distinguish between normal and abnormal operations.

[0882] Output: Abnormal behavior detection results

[0883] Step 14: Calculate the anomaly score

[0884] Input: Operational data and emotional data

[0885] How it works: The server's AI engine calculates the anomaly score.

[0886] Data calculation: Calculate the score and compare it with the set threshold.

[0887] Output: Abnormal behavior determination result

[0888] Step 15: Generate an alert

[0889] Input: Abnormal behavior determination result

[0890] How it works: The server sends real-time alert messages to the administrator.

[0891] Data processing: Generate alert messages.

[0892] Output: Alert sent to administrator

[0893] Step 16: Perform administrative actions

[0894] Input: Abnormal behavior determination result

[0895] How it works: The server restricts access to the device and automatically encrypts it.

[0896] Data manipulation: Restrictions such as changing documents to read-only.

[0897] Output: Administrative actions taken

[0898] Step 17: Collect and analyze new data

[0899] Input: New operational and emotional data

[0900] How it works: The server continuously collects new data and stores it in a database.

[0901] Data calculations: Updating the model based on new data.

[0902] Output: Updated action and emotion pattern recognition model

[0903] Step 18: Model feedback and refinement

[0904] Input: Admin feedback

[0905] How it works: The server analyzes the feedback and reflects it in the AI ​​engine and emotion engine models.

[0906] Data computation: Adjust models to adapt to new threats.

[0907] Output: Tuned AI Engine and Emotion Engine models

[0908] (Application example 2)

[0909] Next, a description will be given of Application Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the smart glasses 214 will be referred to as a "terminal."

[0910] Conventional document monitoring systems detect abnormal behavior based solely on operation data, which limits their accuracy and can miss sophisticated fraudulent behavior. Furthermore, they do not take into account changes in user emotions, making dynamic and real-time anomaly detection difficult. Therefore, a method for detecting abnormal behavior with higher accuracy and preventing fraudulent use was needed.

[0911] The identification process by the identification processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means. In this invention, the server includes means for receiving and storing document operation data and emotion data in real time, means for analyzing the received operation data and emotion data and detecting anomalous behavior, means for issuing an alert and executing management action when anomalous behavior is detected, and means for analyzing the user's facial expressions and voice and generating emotion data. This makes it possible to detect anomalous behavior with high accuracy from both operation data and emotion data, effectively reducing the risk of information leaks and unauthorized use.

[0912] "Multiple sensors for monitoring document usage" refers to sensor devices that can monitor document operations and access status in real time.

[0913] A "network device" is a device for data communication, and is responsible for sending and receiving data between a server and a terminal via a network.

[0914] "Server means" refers to a computer system for storing, analyzing, and managing data, and is a device that has the function of receiving and storing document operation data and emotion data in real time.

[0915] "Document operation data" refers to data that records the history and content of operations that a user performs on a document.

[0916] "Emotional data" is data obtained by analyzing emotional information such as a user's facial expressions and voice.

[0917] "Artificial intelligence means" refers to systems that use technologies such as computer vision and voice analysis to analyze data and detect abnormal behavior.

[0918] A "controller" is a device or system that issues an alert when anomalous behavior is detected and takes control action such as access control or changing the state of a document.

[0919] "Emotion recognition means" is a device or system that analyzes a user's facial expressions and voice to generate emotion data.

[0920] The document monitoring and management system of the present invention, by combining an emotion recognition means for recognizing the user's emotions, performs an integrated analysis of document operation data and emotion data, making it possible to detect abnormal behavior with high accuracy.

[0921] Initial Setup

[0922] Initial Server Configuration

[0923] The server connects to sensors and network devices, sets up communication protocols, starts up the AI ​​engine, emotion recognition means, and database, and checks their operation.

[0924] Setting up the device

[0925] The device is installed with dedicated client software. Hardware necessary for the emotion recognition system to function properly, such as a camera and microphone, is also connected. A connection test is performed to enable the device to communicate with the server, and normal operation is confirmed.

[0926] Registering Users

[0927] The user registers an account on the server, sets authentication information and permission levels, and obtains consent for the collection of the user's emotional data.

[0928] Document Monitoring and Emotion Recognition

[0929] Start working on the document

[0930] When a user opens a document, the device monitors the operation in real time. Along with the operation data, the emotion recognition means analyzes the user's facial expressions and voice to generate emotion data. This data is encrypted and sent to the server in real time.

[0931] Receiving and storing data

[0932] The server receives the operation data and emotion data sent from the device and stores them in a database, including metadata such as the type of operation, timestamp, and user ID.

[0933] Data analysis and anomaly detection

[0934] Data analysis

[0935] The artificial intelligence means of the server analyzes the received and stored operation data and emotion data, specifically, analyzes both operation patterns and emotion patterns, and distinguishes between normal operations and abnormal operations.

[0936] Scoring abnormal behavior

[0937] The artificial intelligence means calculates an abnormality score based on the operation data and emotion data, and if the score exceeds a set threshold, it is determined to be an abnormal behavior.

[0938] Alerts and take administrative actions

[0939] Generate alerts

[0940] The server will alert administrators in real time if any abnormal behavior is detected, which will be sent as a warning message.

[0941] Performing administrative actions

[0942] If the server detects any abnormal behavior, it will take administrative action such as restricting access to the device, automatically encrypting documents, or suspending document viewing, thereby effectively preventing information leaks and unauthorized use.

[0943] Continuous learning and improvement

[0944] New data collection and analysis

[0945] The server continuously collects new operational and emotional data, allowing the artificial intelligence means to continuously learn. This data is used to update the operational and emotional pattern recognition models.

[0946] Model feedback and adjustment

[0947] The server receives feedback from administrators and incorporates it into its artificial intelligence and emotion recognition models, allowing it to quickly respond to new threats and operational and emotional patterns.

[0948] Specific examples

[0949] If a user opens a document outside of normal working hours and attempts to copy a large amount of data, the server's artificial intelligence system will recognize this operation as an anomaly. At the same time, if the emotion recognition system detects anxiety or impatience in the user's facial expression, the anomaly score will increase. If this score exceeds a threshold, the server will immediately issue an alert and take administrative action, temporarily restricting the user's access. Furthermore, the server can take measures such as changing the document to read-only.

[0950] Example prompts to input to the generative AI model

[0951] "If a user viewing an important document attempts to copy a large amount of data outside of working hours and shows signs of anxiety or impatience while doing so, write a Python program that will immediately alert an administrator and restrict the user's access to the document."

[0952] The flow of the specific processing in the application example 2 will be described with reference to FIG.

[0953] Step 1:

[0954] When a user opens a document, the device monitors the operation in real time. The device uses a camera and microphone to capture the user's facial expressions and voice, and analyzes these data using emotion recognition. The input is the user's document operation and real-time video and audio data, and the output is operation data and emotion data.

[0955] Step 2:

[0956] The emotion recognition means analyzes the captured video (facial expression) and audio data to detect the user's emotions. Data processing uses facial expression recognition algorithms and audio analysis algorithms to identify the user's emotional state. The input is the captured video and audio data, and the output is the user's emotional data.

[0957] Step 3:

[0958] The terminal encrypts the document's operation data and emotion data and transmits them to the server in real time. The input is the operation data and emotion data, and the output is the encrypted data.

[0959] Step 4:

[0960] The server stores the received operation data and emotion data in a database. Specifically, metadata such as the type of operation, timestamp, and user ID are attached to the data. The input is encrypted operation data and emotion data, and the output is the accumulated data stored in the database.

[0961] Step 5:

[0962] The server's artificial intelligence means analyzes the accumulated operation data and emotional data to detect abnormal behavior. It analyzes both operation patterns and emotional patterns to distinguish between normal and abnormal operations. The input is the accumulated operation data and emotional data, and the output is a score for abnormal behavior.

[0963] Step 6:

[0964] The artificial intelligence means calculates an anomaly score based on the operation data and emotion data. If the anomaly score exceeds a set threshold, it is judged as an abnormal behavior. The input is the analyzed operation data and emotion data, and the output is the anomaly score and its judgment result.

[0965] Step 7:

[0966] If the server detects abnormal behavior, it sends an alert to the administrator in real time. Specifically, a warning message is sent to the administrator's email or management console. The input is the anomaly score and its judgment result, and the output is the sent alert.

[0967] Step 8:

[0968] If the server detects abnormal behavior, it will take management actions such as restricting access to the device, automatically encrypting documents, or suspending document viewing. Specifically, it temporarily restricts user access and changes documents to read-only mode. The input is the anomaly score and its judgment result, and the output is the management action taken.

[0969] The specific processing unit 290 transmits the result of the specific processing to the smart glasses 214. In the smart glasses 214, the control unit 46A causes the speaker 240 to output the result of the specific processing. The microphone 238 acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0970] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (Internet Search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search <url: https: gemini.google.com ?hl="ja">) and other generation AIs. The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating voice, text data indicating text, and image data indicating an image is also input. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt, and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0971] In the above embodiment, an example in which the specific processing is performed by the data processing device 12 has been given, but the technology of the present disclosure is not limited to this, and the specific processing may be performed by the smart glasses 214.

[0972] [Third embodiment]

[0973] FIG. 5 shows an example of the configuration of a data processing system 310 according to the third embodiment.

[0974] 5, the data processing system 310 includes the data processing device 12 and a headset type terminal 314. An example of the data processing device 12 is a server.

[0975] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" according to the technology of the present disclosure. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0976] The headset type terminal 314 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication I / F 44, and a display 343. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, the camera 42, and the display 343 are also connected to the bus 52.

[0977] The microphone 238 receives instructions and the like from the user 20 by receiving voice uttered by the user 20. The microphone 238 captures the voice uttered by the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio in accordance with instructions from the processor 46.

[0978] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the surroundings of user 20 (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[0979] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 control the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[0980] Fig. 6 shows an example of the main functions of the data processing device 12 and the headset type terminal 314. As shown in Fig. 6, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0981] The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0982] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0983] In the headset type terminal 314, a reception output process is performed by the processor 46. A reception output program 60 is stored in the storage 50. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output process is realized by the processor 46 operating as the control unit 46A in accordance with the reception output program 60 executed on the RAM 48.

[0984] Next, a description will be given of the identification process performed by the identification processing unit 290 of the data processing device 12. In the following description, the data processing device 12 will be referred to as the "server" and the headset type terminal 314 will be referred to as the "terminal."

[0985] The document monitoring and management system of the present invention is implemented as follows: First, multiple sensors and network devices are installed and connected to a server. Then, client software is installed on the terminal and configured to enable real-time communication with the server.

[0986] Initial Setup

[0987] Initial Server Configuration

[0988] The server registers sensors and network devices, sets communication protocols, and initially starts up the AI ​​engine and database, verifying their operation.

[0989] Setting up the device

[0990] Dedicated client software is installed on the terminal, and a connection test is performed to communicate with the server.

[0991] Registering Users

[0992] The user registers their account on the server and sets the required authentication information and permission level.

[0993] Document Monitoring

[0994] Start working on the document

[0995] When a user opens a document, the device monitors the operation in real time, and the operation data is encrypted and sent to the server in real time.

[0996] Receiving and storing data

[0997] The server accumulates the received operation data and stores it in a database. The data includes metadata such as the operation type, timestamp, and user ID.

[0998] Data analysis and anomaly detection

[0999] Data analysis

[1000] The server's AI engine analyzes the received and accumulated operation data, specifically analyzing operation patterns and distinguishing between normal and abnormal operations.

[1001] Scoring abnormal behavior

[1002] The AI ​​engine calculates an anomaly score for each operation, and if the score exceeds a certain threshold, it determines that the behavior is abnormal.

[1003] Alerts and take administrative actions

[1004] Generate alerts

[1005] The server generates an alert and notifies the administrator if abnormal behavior is detected, such as when a user attempts to copy a large number of documents.

[1006] Performing administrative actions

[1007] When abnormal behavior is detected, the server immediately takes administrative action on the device, such as restricting access, encrypting documents, and automatically locking the device, effectively preventing information leaks and unauthorized use.

[1008] Continuous learning and improvement

[1009] New data collection and analysis

[1010] The server constantly collects new operation data, allowing the AI ​​engine to continuously learn, which is used to update the operation pattern recognition model.

[1011] Model feedback and adjustment

[1012] The server receives feedback from administrators and adjusts the AI ​​engine model accordingly, allowing it to quickly respond to new threats and operational patterns.

[1013] Specific examples

[1014] For example, if a user attempts to copy a large amount of data outside of normal working hours, the server's AI engine will determine this operation as an anomaly and assign a score. If the anomaly score exceeds a threshold, the server will immediately issue an alert and take administrative action, such as temporarily restricting the user's access. It can also take other measures, such as changing documents to read-only mode.

[1015] The document monitoring and management system according to the present invention has been described above. This system makes it possible to respond quickly and efficiently to dynamically changing threats, and effectively reduce the risk of information leakage and unauthorized use.

[1016] The processing flow will be explained below.

[1017] Step 1:

[1018] The server connects to sensors and network devices, sets up communication protocols, and initially starts up the AI ​​engine and database, verifying their operation.

[1019] Step 2:

[1020] Dedicated client software is installed on the device, and a connection test is performed to ensure the device communicates with the server and that it is operating normally.

[1021] Step 3:

[1022] The user registers their account on the server and sets the required authentication information and permission level.

[1023] Step 4:

[1024] When a user opens a document, the device monitors the operation in real time, and the operation data is encrypted and sent to the server in real time.

[1025] Step 5:

[1026] The server receives the operation data sent from the device and stores it in a database. The operation data includes metadata such as the type of operation, timestamp, and user ID.

[1027] Step 6:

[1028] The server's AI engine analyzes the accumulated operation data, specifically analyzing operation patterns and distinguishing between normal and abnormal operations.

[1029] Step 7:

[1030] The AI ​​engine calculates an anomaly score for each operation, and if this score exceeds a set threshold, it is deemed to be an abnormal behavior.

[1031] Step 8:

[1032] The server will alert administrators in real time when abnormal behavior is detected, which will be sent as a warning message.

[1033] Step 9:

[1034] If the server detects any abnormal behavior, it immediately takes administrative action on the device, such as restricting access or automatically encrypting documents.

[1035] Step 10:

[1036] The server continuously collects new operation data, and the AI ​​engine continuously learns, improving the accuracy of the operation pattern recognition model.

[1037] Step 11:

[1038] The server receives feedback from administrators and incorporates it into the AI ​​engine's models, allowing it to respond quickly to new threats and operational patterns.

[1039] The above are the specific processing steps of the document monitoring and management system. This process ensures that the system can monitor in real time, detect abnormal behavior, and respond quickly.

[1040] Example 1

[1041] Next, a description will be given of Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the headset type terminal 314 will be referred to as a "terminal."

[1042] Conventional document monitoring and management systems have difficulty monitoring user operations in real time, which can result in delayed detection of abnormal behavior. Furthermore, management actions after an abnormality is detected may not be implemented quickly enough, increasing the risk of information leaks and unauthorized use. Furthermore, because the system relied on static models, it was difficult to respond to new threats and operation patterns.

[1043] The specific processing by the specific processing unit 290 of the data processing device 12 in the first embodiment is realized by the following means.

[1044] In this invention, the server includes an initial setting means for registering sensors and network devices and setting communication protocols, a terminal setup means for installing client software and enabling real-time communication with the server, a user registration means for registering user accounts and setting authentication information and authority levels, a document monitoring means for monitoring user document operations, a data transmission means for encrypting operation data and transmitting it to the server in real time, a database means for storing received operation data, an artificial intelligence means for analyzing the received and stored operation data, anomaly detection means for analyzing operation patterns and detecting abnormal behavior, a management means for issuing an alert and taking management action when abnormal behavior is detected, and a learning means for collecting new operation data and continuously learning and improving. This enables real-time monitoring of document operations, rapid anomaly detection, and the execution of management action.

[1045] A "sensor" is a device for detecting physical environmental conditions and document manipulation status.

[1046] A "network device" is a device that connects sensors and terminals to servers and performs data communication.

[1047] The "initial setting means" is a means having the function of registering sensors and network devices and setting communication protocols.

[1048] The "terminal setup means" is a means having a function for installing client software and enabling real-time communication with the server.

[1049] The "user registration means" is a means having the function of registering a user's account and setting authentication information and authority level.

[1050] The "document monitoring means" is a means having a function of monitoring operations when a user operates a document.

[1051] The "data transmission means" is a means having a function of encrypting operation data and transmitting it to the server in real time.

[1052] The "database means" is a means having a function of storing received operation data.

[1053] "Artificial intelligence means" means means having the function of analyzing received and stored operational data.

[1054] The "abnormality detection means" is a means having a function of analyzing operation patterns and detecting abnormal behavior.

[1055] A "management means" is a means that has the function of issuing an alert and taking management action when abnormal behavior is detected.

[1056] A "learning means" is a means that has the ability to collect new operational data and continuously learn and improve.

[1057] The document monitoring and management system of the present invention connects multiple sensors and network devices to a server, and monitors and manages data in real time as users manipulate documents. This system includes an initial setting means, a terminal setup means, a user registration means, a document monitoring means, a data transmission means, a database means, an artificial intelligence means, an anomaly detection means, a management means, and a learning means.

[1058] First, the server registers sensors and network devices and configures communication protocols. This includes registering information from sensors and network devices in a database and configuring communication protocols (e.g., TCP / IP, HTTP). The server also starts AI engines such as TensorFlow and PyTorch and databases such as MySQL and PostgreSQL, and checks their operation.

[1059] Next, dedicated client software is installed on the device and configured to enable real-time communication with the server. The user uses this to perform a connection test with the server and confirm that communication is normal. For example, a connection test can be performed by sending and receiving simple messages.

[1060] Users register their accounts on the server and set the required authentication information and permission levels. They enter information such as their name and email address using a special registration form, which is then sent to the server, which stores this information in a database.

[1061] When a user operates on a document, the client software on the device monitors the operation in real time. The operation data (e.g., copy, edit) is encrypted (e.g., AES-256) and sent to the server. The server receives it and stores it in a database. The operation data includes metadata such as the type of operation, timestamp, and user ID.

[1062] The server's AI engine analyzes the received and accumulated operation data and distinguishes between normal and abnormal operations. For example, copying a large amount of data late at night is not a normal operation and is therefore assigned a high anomaly score. If the anomaly score exceeds a certain threshold, the server determines that the behavior is abnormal and immediately alerts the administrator. At the same time, the server takes management actions on the device, such as restricting access, encrypting documents, and automatically locking them.

[1063] In addition, the server constantly collects new operational data, enabling the AI ​​engine to continuously learn. This data is used to update the operational pattern recognition model. By receiving feedback from administrators and adjusting the AI ​​engine model accordingly, it is possible to quickly respond to new threats and operational patterns.

[1064] Specific examples

[1065] For example, if a user attempts to copy a large amount of data outside of normal working hours, the server's AI engine will determine this operation as an anomaly and assign a score. If the anomaly score exceeds a threshold, the server will immediately issue an alert and take administrative action, such as temporarily restricting the user's access. It can also take other measures, such as changing documents to read-only mode.

[1066] Prompt Sentence Examples

[1067] "Please describe the system behavior that detects a user attempting to copy a large amount of data outside of normal working hours, determines this to be anomalous behavior, and issues an alert."

[1068] The document monitoring and management system according to the present invention has been described above. This system makes it possible to respond quickly and efficiently to dynamically changing threats, and effectively reduce the risk of information leakage and unauthorized use.

[1069] The flow of the identification process in the first embodiment will be described with reference to FIG.

[1070] Step 1:

[1071] Initial Setup

[1072] Input: Sensor and network device information

[1073] Output: Sensors and network devices are registered on the server and communication protocols are configured.

[1074] Specific behavior:

[1075] The server receives device information from sensors and network devices and registers it in a database. The server also sets the protocols (e.g., TCP / IP, HTTP / HTTPS) for communicating with sensors and network devices and performs connection tests with each device. This ensures that sensors and network devices are correctly registered on the server and can communicate normally.

[1076] Step 2:

[1077] Setting up the device

[1078] Input: Client software, terminal information

[1079] Output: The device is now able to communicate with the server in real time.

[1080] Specific behavior:

[1081] The device user downloads and installs dedicated client software, which attempts to connect to the server and performs a communication test to verify successful communication with the server. Specifically, it sends and receives simple messages from the server to the device to verify that a connection has been established.

[1082] Step 3:

[1083] Registering Users

[1084] Input: User personal information (name, email address, etc.), authentication information, permission level

[1085] Output: Registered user information, configured authentication information and permission level

[1086] Specific behavior:

[1087] Users use the server's registration form to enter personal information such as their name, email address, and password, and then submit it to the server. The server stores the information in a database, and the administrator assigns the appropriate permission level (e.g., view only, edit) to each user, creating an account that allows the user to access the system.

[1088] Step 4:

[1089] Document Monitoring

[1090] Input: User document operations (e.g., opening or editing a document)

[1091] Output: Encrypted operation data

[1092] Specific behavior:

[1093] When a user opens a document on a device, dedicated software captures the operation details in real time. The captured operation data is encrypted (e.g., AES-256) and sent to the server. This ensures that the user's document operation information is securely sent to the server.

[1094] Step 5:

[1095] Receiving and storing data

[1096] Input: Encrypted operational data

[1097] Output: Operational data stored in a database

[1098] Specific behavior:

[1099] The server receives the encrypted operation data sent from the device. The received data is decrypted and stored in a database. This data includes metadata such as the type of operation, timestamp, and user ID, and is accumulated in the database.

[1100] Step 6:

[1101] Data analysis and anomaly detection

[1102] Input: Operational data stored in the database

[1103] Output: Anomaly score and abnormal behavior detection results

[1104] Specific behavior:

[1105] The server's AI engine analyzes the operation data stored in the database. It distinguishes between normal and abnormal operations based on specific operation patterns and time periods. It calculates an anomaly score, and if the score exceeds a certain threshold, it determines that the operation is abnormal.

[1106] Step 7:

[1107] Alerts and take administrative actions

[1108] Input: Anomalous behavior detection results

[1109] Output: Alert to administrator and administrative action taken

[1110] Specific behavior:

[1111] If abnormal behavior is detected, the server immediately generates an alert and notifies the administrator. In addition, the server performs management actions on the device, such as restricting access, encrypting documents, and automatically locking the device, thereby preventing information leaks and unauthorized use.

[1112] Step 8:

[1113] Continuous learning and improvement

[1114] Input: New operation data, feedback from administrators

[1115] Output: Updated and improved AI engine model

[1116] Specific behavior:

[1117] The server constantly collects new operational data, allowing the AI ​​engine to continuously learn. This data is used to update the operational pattern recognition model. It also receives feedback from administrators and adjusts the AI ​​engine model accordingly to quickly respond to new threats and operational patterns.

[1118] (Application example 1)

[1119] Next, a description will be given of Application Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the headset type terminal 314 will be referred to as a "terminal."

[1120] While conventional document monitoring and management systems excel at monitoring document operation data, they are not adequate for monitoring the operation data of machines such as factory robots in real time and detecting abnormal behavior. As a result, it is difficult to effectively mitigate the risk of potential abnormal behavior or unauthorized use occurring within the factory. There is a need to solve this issue and provide a system that can monitor and manage a wide range of data, including the operation data of industrial products.

[1121] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 1 is realized by the following means.

[1122] In this invention, the server includes means for receiving and storing document operation data and machine operation data based on the operation data in real time, means for analyzing the received operation data and machine operation data and detecting abnormal behavior, means for issuing an alert and executing management action when abnormal behavior is detected, means for monitoring the operation of industrial products and detecting abnormal robot behavior as abnormal behavior, means for encrypting and transmitting the industrial product operations at regular intervals, and means for calculating an abnormal industrial product operation score and restricting the robot's operation as management action. This makes it possible to respond quickly and efficiently to dynamically changing threats and effectively reduce the risk of information leaks and unauthorized use.

[1123] "Document operation data" is information about operations (for example, viewing, editing, copying, etc.) performed by a user on a document.

[1124] "Machine operation data" is information about operations performed by industrial products or factory robots (e.g., moving, picking, placing parts, etc.).

[1125] A "sensor" is a device that detects a physical or environmental condition and converts it into an electrical signal.

[1126] A "network device" is a device for performing data communication, enabling data transfer with a server or client device.

[1127] A "server" is a central management system that provides services to client devices over a network.

[1128] "Artificial intelligence" is a technology that analyzes data and recognizes patterns to support decision-making.

[1129] An "alert" is a notification that notifies an administrator when abnormal behavior is detected.

[1130] "Administrative actions" are measures such as access restrictions and operational controls that are taken when abnormal behavior is detected.

[1131] "Abnormal behavior" is behavior that deviates from normal operation patterns and suggests security risks or fraudulent use.

[1132] The "score" is a numerical value that indicates the degree of abnormal behavior.

[1133] "Encryption" is a conversion process performed to ensure secure transmission of data.

[1134] "Industrial products" is a general term for machines and equipment manufactured and operated within a factory.

[1135] "Operation restrictions" are management measures that prohibit or restrict specific operations.

[1136] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention is a system for monitoring operation data of documents and industrial products, and detecting and managing abnormal behavior.

[1137] First, a server is set up to receive and store document and industrial product operation data in real time. The server includes the following main components:

[1138] 1. Sensors and network devices:

[1139] Sensors are devices that detect physical or environmental conditions and convert them into electrical signals, and network devices are devices that communicate with servers. These devices are deployed to monitor document usage and industrial product operation.

[1140] 2. Server means:

[1141] The server receives operational data and machine operation data in real time, stores them in encrypted form, and uses a database system (e.g., MySQL) to store and manage the received data.

[1142] 3. Artificial Intelligence Means:

[1143] An AI engine (e.g., TensorFlow) installed on the server analyzes the received operation data and machine operation data. Specifically, it learns operation patterns and distinguishes and analyzes normal and abnormal operations. It calculates a score for abnormal behavior and determines it as abnormal if it exceeds a threshold.

[1144] 4. Control measures:

[1145] If the server detects any abnormal behavior, it will send an alert to the administrator. It will then take administrative action, such as restricting or halting the robot's operation or controlling document access. Alert notifications are sent via email, SMS, or other methods.

[1146] Next, a specific method for monitoring robots and document operations will be described.

[1147] Factory robot monitoring examples:

[1148] 1. When a factory robot moves a part, this operation data (e.g., the robot's movement position, speed, time, etc.) is acquired by sensors.

[1149] 2. The acquired data is sent to a server via a network device, encrypted, and stored.

[1150] 3. The server's AI engine analyzes this data and detects abnormal behavior that differs from normal operation patterns.

[1151] 4. If abnormal behavior is detected, an alert is sent to the administrator and the robot's operations are restricted.

[1152] Example prompt sentence:

[1153] "I would like to develop software for a monitoring system for factory robots. Specifically, it would be a system that monitors robot operation data in real time and sends an alert to an administrator if unauthorized operation is detected. Please tell me about the specific implementation of data transmission and reception between the server and robots, anomaly detection using an AI engine, and management actions."

[1154] This system enables the server to respond quickly and efficiently to dynamically changing threats and comprehensively monitor and manage the operation data of industrial products, thereby effectively reducing the risk of potential abnormal operation or unauthorized use within the factory.

[1155] The flow of the specific processing in the application example 1 will be described with reference to FIG.

[1156] Step 1:

[1157] A user operates a document or industrial product that is being monitored. Specifically, the user starts the operation of a factory robot (moving or picking parts, etc.). Data on this operation (operation details, timestamp, user ID, etc.) is acquired through sensors.

[1158] Input: User actions

[1159] Output: Operation data

[1160] Step 2:

[1161] The terminal transmits the acquired operation data to the server via the network device. The operation data includes metadata such as the operation content, timestamp, and user ID. This data is encrypted before transmission.

[1162] Input: Retrieved operation data

[1163] Output: Encrypted operation data

[1164] Step 3:

[1165] The server receives the encrypted data sent from the device and stores it in a database, such as MySQL. The received data is automatically decrypted and saved for each required item.

[1166] Input: Encrypted operational data

[1167] Output: Operation data stored in a database

[1168] Step 4:

[1169] An AI engine (e.g., TensorFlow) on the server periodically scans the operation data in the database to detect anomalous patterns. The AI ​​engine identifies behavior that differs from normal operation patterns and calculates a score for the anomalous behavior.

[1170] Input: Operational data in the database

[1171] Output: Abnormal behavior score

[1172] Step 5:

[1173] The server evaluates the score of abnormal behavior calculated by the AI ​​engine and generates an alert if a certain threshold is exceeded, which is then sent to the administrator via email or SMS.

[1174] Input: Abnormal behavior score

[1175] Output: Alert notification

[1176] Step 6:

[1177] The server implements management actions when abnormal behavior is detected. Specifically, it temporarily restricts the operation of factory robots or changes document access permissions. Management actions include commands to enforce specified operation restrictions.

[1178] Input: Anomalous behavior detection results

[1179] Output: Management action taken

[1180] Step 7:

[1181] The server continuously updates the AI ​​engine's learning model based on newly collected data, and also incorporates feedback from administrators to improve the model's accuracy.

[1182] Input: New operational data and feedback from administrators

[1183] output: Updated AI engine learning model

[1184] Furthermore, an emotion engine that estimates the user's emotion may be further combined. That is, the identification processing unit 290 may estimate the user's emotion using the emotion identification model 59, and perform identification processing using the user's emotion.

[1185] The document monitoring and management system of the present invention further incorporates an emotion engine that recognizes user emotions, enabling integrated analysis of document operation data and emotion data, enabling more precise detection of abnormal behavior. Specific embodiments are described below.

[1186] Initial Setup

[1187] Initial Server Configuration

[1188] The server connects to sensors and network devices, sets up communication protocols, starts up the AI ​​engine, emotion engine, and database, and checks their operation.

[1189] Setting up the device

[1190] The device is installed with dedicated client software. Hardware necessary for the emotion engine to function properly, such as a camera and microphone, is also connected. A connection test is performed to enable the device to communicate with the server, and normal operation is confirmed.

[1191] Registering Users

[1192] The user registers an account on the server, sets authentication information and permission levels, and obtains consent for the collection of the user's emotional data.

[1193] Document Monitoring and Emotion Recognition

[1194] Start working on the document

[1195] When a user opens a document, the device monitors the operation in real time. Along with the operation data, the emotion engine analyzes the user's facial expressions and voice to generate emotion data. This data is encrypted and sent to the server in real time.

[1196] Receiving and storing data

[1197] The server receives the operation data and emotion data sent from the device and stores them in a database, including metadata such as the type of operation, timestamp, and user ID.

[1198] Data analysis and anomaly detection

[1199] Data analysis

[1200] The server's AI engine analyzes the received and accumulated operation data and emotional data. Specifically, it analyzes both operation patterns and emotional patterns to distinguish between normal and abnormal operations.

[1201] Scoring abnormal behavior

[1202] The AI ​​engine calculates an anomaly score based on operation data and emotional data, and if this score exceeds a set threshold, it is determined to be abnormal behavior.

[1203] Alerts and take administrative actions

[1204] Generate alerts

[1205] The server will alert administrators in real time if any abnormal behavior is detected, which will be sent as a warning message.

[1206] Performing administrative actions

[1207] If the server detects any abnormal behavior, it will take administrative action such as restricting access to the device, automatically encrypting documents, or suspending document viewing, thereby effectively preventing information leaks and unauthorized use.

[1208] Continuous learning and improvement

[1209] New data collection and analysis

[1210] The server continuously collects new operational and emotional data, allowing the AI ​​engine to continuously learn. This data is used to update the operational and emotional pattern recognition model.

[1211] Model feedback and adjustment

[1212] The server receives feedback from administrators and reflects it in the AI ​​engine and emotion engine models, allowing it to quickly respond to new threats and operational and emotional patterns.

[1213] Specific examples

[1214] If a user opens a document outside of normal working hours and attempts to copy a large amount of data, the server's AI engine will recognize this operation as an anomaly. At the same time, if the emotion engine detects anxiety or impatience in the user's facial expression, the anomaly score will increase. If this score exceeds a threshold, the server will immediately issue an alert and take administrative action, temporarily restricting the user's access. Furthermore, the server can take measures such as changing the document to read-only.

[1215] The document monitoring and management system according to the present invention has been described above. By incorporating emotion recognition functionality, this system can respond more accurately to dynamically changing threats, effectively reducing the risk of information leaks and unauthorized use.

[1216] The processing flow will be explained below.

[1217] Step 1:

[1218] The server connects to sensors and network devices, sets up communication protocols, starts up the AI ​​engine, emotion engine, and database, and checks their operation.

[1219] Step 2:

[1220] Dedicated client software is installed on the device. In order for the emotion engine to function properly, the device must be connected to the necessary hardware, such as a camera and microphone. The device then performs a connection test to communicate with the server to confirm proper operation.

[1221] Step 3:

[1222] The user registers their account on the server, sets their authentication information and permission level, and also obtains consent for the collection of the user's emotional data.

[1223] Step 4:

[1224] When a user opens a document, the device monitors the operation in real time and captures the operation data. At the same time, the emotion engine analyzes the user's facial expressions and voice to generate emotion data. This data is encrypted and sent to the server in real time.

[1225] Step 5:

[1226] The server receives the operation data and emotion data sent from the device and stores them in a database, including metadata such as the type of operation, timestamp, and user ID.

[1227] Step 6:

[1228] The server's AI engine analyzes the accumulated operation data and emotional data. Specifically, it analyzes both operation patterns and emotional patterns to distinguish between normal and abnormal operations.

[1229] Step 7:

[1230] The AI ​​engine calculates an anomaly score based on operation data and emotional data, and if this score exceeds a set threshold, it is determined to be abnormal behavior.

[1231] Step 8:

[1232] If the server detects any abnormal behavior, it will send an alert to the administrator in real time. The alert will be sent as a warning message.

[1233] Step 9:

[1234] If the server detects any abnormal behavior, it will take administrative action such as restricting access to the device, automatically encrypting documents, or suspending document viewing, thereby effectively preventing information leaks and unauthorized use.

[1235] Step 10:

[1236] The server continuously collects new operation and emotion data, which the AI ​​engine continuously learns from. This data is used to update the operation and emotion pattern recognition model.

[1237] Step 11:

[1238] The server receives feedback from administrators and reflects it in the AI ​​engine and emotion engine models, allowing it to quickly respond to new threats and operational and emotional patterns.

[1239] The above are the specific processing steps of the document monitoring and management system combined with the emotion engine. This process ensures that the system can monitor and detect abnormal behavior in real time and respond quickly.

[1240] Example 2

[1241] Next, a description will be given of Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the headset type terminal 314 will be referred to as a "terminal."

[1242] In recent years, the risk of information leakage and unauthorized use has increased, and there is a problem that existing systems have difficulty accurately detecting abnormal behavior, especially when changes in emotions affect document operations. An object of the present invention is to provide a document monitoring and management system that can more accurately detect abnormal behavior through multifaceted data analysis, including emotional data.

[1243] The identification process by the identification processing unit 290 of the data processing device 12 in the second embodiment is realized by the following means. In this invention, the server includes means for receiving and storing document operation data and emotion data in real time, means for analyzing the received operation data and emotion data and detecting abnormal behavior, and means for issuing an alert and executing management action when abnormal behavior is detected. This enables precise and prompt detection of abnormal behavior, including risks associated with emotional changes.

[1244] A "sensor" is a device that gathers information from the environment.

[1245] A "network device" is a device that enables data communication between different devices.

[1246] A "server" is a computer system that provides data in response to requests from clients.

[1247] "Operation data" is data that is generated when a user operates a document.

[1248] "Emotion data" refers to data relating to emotions analyzed from the user's facial expressions and voice.

[1249] "Real-time" refers to data generation and processing occurring without delay.

[1250] "Storage" refers to the continuous storage of data.

[1251] "Artificial intelligence" is a technology that analyzes large amounts of data and learns, recognizes, and judges like a human being.

[1252] "Analysis" refers to the detailed investigation and analysis of data.

[1253] "Abnormal behavior" refers to behavior that deviates from normal operating patterns.

[1254] An "alert" is a warning that notifies you of the occurrence of an abnormality or emergency.

[1255] "Administrative actions" are measures or procedures that are implemented when abnormal behavior is detected.

[1256] "Encryption" is a technology that converts data into a format that cannot be deciphered by third parties.

[1257] A "threshold" refers to a specific standard or limit value that, if exceeded, is deemed abnormal.

[1258] The document monitoring and management system of the present invention combines an emotion engine that recognizes user emotions and performs an integrated analysis of document operation data and emotion data, thereby enabling more precise detection of abnormal behavior.

[1259] Initial Setup

[1260] Initial Server Configuration

[1261] The server connects to sensors and network devices and configures communication protocols, specifically TCP / IP and HTTP, and ensures security through firewalls. Next, the server starts up the AI ​​engine, emotion engine, and database, and performs self-diagnosis to confirm proper operation.

[1262] Setting up the device

[1263] The device installs dedicated client software, which automatically performs initial setup after installation. The device also connects to the hardware necessary for the emotion engine to function properly, such as a camera and microphone. The device then performs a connection test to communicate with the server, confirming that data is being sent and received normally.

[1264] Registering Users

[1265] The user accesses the server and registers for an account. They enter information such as their name, email address, and password to create an account. The server then stores the user's authentication information and sets their access permission level. The user also digitally signs a consent form for the acquisition of emotion data, and the server stores this information.

[1266] Document Monitoring and Emotion Recognition

[1267] Start working on the document

[1268] When a user opens a document, the device monitors the operation in real time. The user's operations (e.g., keyboard input, mouse clicks) are generated as operation data. At the same time, the emotion engine analyzes the video and audio captured by the camera and microphone to generate emotion data.

[1269] Receiving and storing data

[1270] The device encrypts the generated operation data and emotion data and transmits them in real time to the server. The server receives this data and stores it in a database, along with metadata such as the type of operation, timestamp, and user ID.

[1271] Data analysis and anomaly detection

[1272] Data analysis

[1273] The server's AI engine analyzes the received and accumulated operation and emotion data, extracting normal operation and emotion patterns and applying algorithms to detect abnormal behavior.

[1274] Scoring abnormal behavior

[1275] The server's AI engine calculates an anomaly score based on the operation data and emotion data. If this score exceeds a set threshold, the server determines that the behavior is abnormal.

[1276] Alerts and take administrative actions

[1277] Generate alerts

[1278] If the server detects any abnormal behavior, it will send a real-time warning message to the administrator, who will then check the alert and take action as necessary.

[1279] Performing administrative actions

[1280] If the server detects any abnormal behavior, it will take the following administrative actions on the device: restrict access and suspend the user's account. It will also automatically encrypt documents and change them to read-only to restrict further operations.

[1281] Continuous learning and improvement

[1282] New data collection and analysis

[1283] The server continuously collects new operation and emotion data and stores it in a database, which updates the operation and emotion pattern recognition model of the AI ​​engine.

[1284] Model feedback and adjustment

[1285] The server receives feedback from administrators and reflects it in the AI ​​engine and emotion engine models, allowing it to quickly respond to new threats and operational and emotional patterns.

[1286] Specific examples

[1287] If a user attempts to open a document and copy a large amount of data outside of normal working hours, the server's AI engine will recognize this action as an anomaly. At the same time, if the emotion engine detects anxiety or impatience in the user's facial expression, the anomaly score will increase. If this score exceeds a threshold, the server will immediately issue an alert and temporarily restrict the user's access. Additionally, changing the document to read-only can prevent information leaks.

[1288] Prompt Sentence Examples

[1289] "Please provide an overview of the following anomalous behavior detection system that combines data manipulation and sentiment analysis."

[1290] The above explanation has shown a specific embodiment of the document monitoring and management system of the present invention. By combining this system with emotion recognition functions, it can effectively reduce the risk of information leakage and unauthorized use.

[1291] The flow of the identification process in the second embodiment will be described with reference to FIG.

[1292] Step 1: Initial Server Setup

[1293] Input: Sensors and network devices

[1294] How it works: The server physically connects to sensors and network devices and configures communication protocols such as TCP / IP and HTTP.

[1295] Data processing: Install the necessary drivers and recognize connected devices.

[1296] Output: The connected device is working properly and the communication protocol is set.

[1297] Step 2: Initial launch of the AI ​​engine, emotion engine, and database

[1298] Input: AI engine, emotion engine, database

[1299] What happens: The server starts these engines and databases.

[1300] Data calculation: Each engine and database performs self-diagnosis to confirm normal operation.

[1301] Output: A working engine and database

[1302] Step 3: Install the client software

[1303] Input: Client software

[1304] How it works: The device downloads and installs the dedicated client software.

[1305] Data calculation: After installation, the initial settings will be performed automatically.

[1306] Output: Installed client software

[1307] Step 4: Connecting the camera and microphone

[1308] Input: Camera, Microphone

[1309] Action: The device connects the camera and microphone and installs the device drivers.

[1310] Data processing: Check that the device is working properly.

[1311] Output: A properly connected camera and microphone

[1312] Step 5: Test the connection

[1313] Input: terminal, server

[1314] Action: The device will perform a connection test with the server.

[1315] Data calculation: Tests data transmission and reception to ensure normal communication.

[1316] Output: Terminal and server that communicate normally

[1317] Step 6: User Account Registration

[1318] Input: User information (name, email address, password)

[1319] How it works: A user accesses the server and enters information into an account registration form.

[1320] Data processing: The server stores the entered information and creates an account.

[1321] Output: Registered user account

[1322] Step 7: Configure credentials and privilege levels

[1323] Input: User account information

[1324] How it works: The server stores the user's authentication information and sets access privileges.

[1325] Data processing: Parsing and storing information to set user permission levels.

[1326] Output: User account with credentials and privilege level

[1327] Step 8: Obtaining consent for emotional data collection

[1328] Input: User consent

[1329] How it works: The user electronically signs a consent form for emotional data collection.

[1330] Data processing: The server stores the consent information.

[1331] Output: User account with saved consent information

[1332] Step 9: Open the document

[1333] Input: The document selected by the user

[1334] How it works: When a user opens a document, the device monitors the activity.

[1335] Data processing: Generate operational data for the document.

[1336] Output: Generated operation data

[1337] Step 10: Generate emotion data

[1338] Input: Video from camera, audio from microphone

[1339] How it works: The emotion engine analyzes this data.

[1340] Data calculation: Generate emotion data from facial expressions and voice.

[1341] Output: Generated emotion data

[1342] Step 11: Encrypt and send data

[1343] Input: Operation data, emotion data

[1344] How it works: The device encrypts these data.

[1345] Data processing: Generate encrypted data.

[1346] Output: Encrypted operational and emotional data

[1347] Step 12: Receiving and storing data

[1348] Input: Encrypted operational and emotional data

[1349] Operation: The server receives data sent from the terminal.

[1350] Data processing: The received data is stored in a database.

[1351] Output: Accumulated operation data and emotion data

[1352] Step 13: Analyze the data

[1353] Input: Operational data and emotional data

[1354] How it works: The server's AI engine analyzes the data and extracts operation and emotion patterns.

[1355] Data arithmetic: Applying algorithms that distinguish between normal and abnormal operations.

[1356] Output: Abnormal behavior detection results

[1357] Step 14: Calculate the anomaly score

[1358] Input: Operational data and emotional data

[1359] How it works: The server's AI engine calculates the anomaly score.

[1360] Data calculation: Calculate the score and compare it with the set threshold.

[1361] Output: Abnormal behavior determination result

[1362] Step 15: Generate an alert

[1363] Input: Abnormal behavior determination result

[1364] How it works: The server sends real-time alert messages to the administrator.

[1365] Data processing: Generate alert messages.

[1366] Output: Alert sent to administrator

[1367] Step 16: Perform administrative actions

[1368] Input: Abnormal behavior determination result

[1369] How it works: The server restricts access to the device and automatically encrypts it.

[1370] Data manipulation: Restrictions such as changing documents to read-only.

[1371] Output: Administrative actions taken

[1372] Step 17: Collect and analyze new data

[1373] Input: New operational and emotional data

[1374] How it works: The server continuously collects new data and stores it in a database.

[1375] Data calculations: Updating the model based on new data.

[1376] Output: Updated action and emotion pattern recognition model

[1377] Step 18: Model feedback and refinement

[1378] Input: Admin feedback

[1379] How it works: The server analyzes the feedback and reflects it in the AI ​​engine and emotion engine models.

[1380] Data computation: Adjust models to adapt to new threats.

[1381] Output: Tuned AI Engine and Emotion Engine models

[1382] (Application example 2)

[1383] Next, a description will be given of Application Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the headset type terminal 314 will be referred to as a "terminal."

[1384] Conventional document monitoring systems detect abnormal behavior based solely on operation data, which limits their accuracy and can miss sophisticated fraudulent behavior. Furthermore, they do not take into account changes in user emotions, making dynamic and real-time anomaly detection difficult. Therefore, a method for detecting abnormal behavior with higher accuracy and preventing fraudulent use was needed.

[1385] The identification process by the identification processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means. In this invention, the server includes means for receiving and storing document operation data and emotion data in real time, means for analyzing the received operation data and emotion data and detecting anomalous behavior, means for issuing an alert and executing management action when anomalous behavior is detected, and means for analyzing the user's facial expressions and voice and generating emotion data. This makes it possible to detect anomalous behavior with high accuracy from both operation data and emotion data, effectively reducing the risk of information leaks and unauthorized use.

[1386] "Multiple sensors for monitoring document usage" refers to sensor devices that can monitor document operations and access status in real time.

[1387] A "network device" is a device for data communication, and is responsible for sending and receiving data between a server and a terminal via a network.

[1388] "Server means" refers to a computer system for storing, analyzing, and managing data, and is a device that has the function of receiving and storing document operation data and emotion data in real time.

[1389] "Document operation data" refers to data that records the history and content of operations that a user performs on a document.

[1390] "Emotional data" is data obtained by analyzing emotional information such as a user's facial expressions and voice.

[1391] "Artificial intelligence means" refers to systems that use technologies such as computer vision and voice analysis to analyze data and detect abnormal behavior.

[1392] A "controller" is a device or system that issues an alert when anomalous behavior is detected and takes control action such as access control or changing the state of a document.

[1393] "Emotion recognition means" is a device or system that analyzes a user's facial expressions and voice to generate emotion data.

[1394] The document monitoring and management system of the present invention, by combining an emotion recognition means for recognizing the user's emotions, performs an integrated analysis of document operation data and emotion data, making it possible to detect abnormal behavior with high accuracy.

[1395] Initial Setup

[1396] Initial Server Configuration

[1397] The server connects to sensors and network devices, sets up communication protocols, starts up the AI ​​engine, emotion recognition means, and database, and checks their operation.

[1398] Setting up the device

[1399] The device is installed with dedicated client software. Hardware necessary for the emotion recognition system to function properly, such as a camera and microphone, is also connected. A connection test is performed to enable the device to communicate with the server, and normal operation is confirmed.

[1400] Registering Users

[1401] The user registers an account on the server, sets authentication information and permission levels, and obtains consent for the collection of the user's emotional data.

[1402] Document Monitoring and Emotion Recognition

[1403] Start working on the document

[1404] When a user opens a document, the device monitors the operation in real time. Along with the operation data, the emotion recognition means analyzes the user's facial expressions and voice to generate emotion data. This data is encrypted and sent to the server in real time.

[1405] Receiving and storing data

[1406] The server receives the operation data and emotion data sent from the device and stores them in a database, including metadata such as the type of operation, timestamp, and user ID.

[1407] Data analysis and anomaly detection

[1408] Data analysis

[1409] The artificial intelligence means of the server analyzes the received and stored operation data and emotion data, specifically, analyzes both operation patterns and emotion patterns, and distinguishes between normal operations and abnormal operations.

[1410] Scoring abnormal behavior

[1411] The artificial intelligence means calculates an abnormality score based on the operation data and emotion data, and if the score exceeds a set threshold, it is determined to be an abnormal behavior.

[1412] Alerts and take administrative actions

[1413] Generate alerts

[1414] The server will alert administrators in real time if any abnormal behavior is detected, which will be sent as a warning message.

[1415] Performing administrative actions

[1416] If the server detects any abnormal behavior, it will take administrative action such as restricting access to the device, automatically encrypting documents, or suspending document viewing, thereby effectively preventing information leaks and unauthorized use.

[1417] Continuous learning and improvement

[1418] New data collection and analysis

[1419] The server continuously collects new operational and emotional data, allowing the artificial intelligence means to continuously learn. This data is used to update the operational and emotional pattern recognition models.

[1420] Model feedback and adjustment

[1421] The server receives feedback from administrators and incorporates it into its artificial intelligence and emotion recognition models, allowing it to quickly respond to new threats and operational and emotional patterns.

[1422] Specific examples

[1423] If a user opens a document outside of normal working hours and attempts to copy a large amount of data, the server's artificial intelligence system will recognize this operation as an anomaly. At the same time, if the emotion recognition system detects anxiety or impatience in the user's facial expression, the anomaly score will increase. If this score exceeds a threshold, the server will immediately issue an alert and take administrative action, temporarily restricting the user's access. Furthermore, the server can take measures such as changing the document to read-only.

[1424] Example prompts to input to the generative AI model

[1425] "If a user viewing an important document attempts to copy a large amount of data outside of working hours and shows signs of anxiety or impatience while doing so, write a Python program that will immediately alert an administrator and restrict the user's access to the document."

[1426] The flow of the specific processing in the application example 2 will be described with reference to FIG.

[1427] Step 1:

[1428] When a user opens a document, the device monitors the operation in real time. The device uses a camera and microphone to capture the user's facial expressions and voice, and analyzes these data using emotion recognition. The input is the user's document operation and real-time video and audio data, and the output is operation data and emotion data.

[1429] Step 2:

[1430] The emotion recognition means analyzes the captured video (facial expression) and audio data to detect the user's emotions. Data processing uses facial expression recognition algorithms and audio analysis algorithms to identify the user's emotional state. The input is the captured video and audio data, and the output is the user's emotional data.

[1431] Step 3:

[1432] The terminal encrypts the document's operation data and emotion data and transmits them to the server in real time. The input is the operation data and emotion data, and the output is the encrypted data.

[1433] Step 4:

[1434] The server stores the received operation data and emotion data in a database. Specifically, metadata such as the type of operation, timestamp, and user ID are attached to the data. The input is encrypted operation data and emotion data, and the output is the accumulated data stored in the database.

[1435] Step 5:

[1436] The server's artificial intelligence means analyzes the accumulated operation data and emotional data to detect abnormal behavior. It analyzes both operation patterns and emotional patterns to distinguish between normal and abnormal operations. The input is the accumulated operation data and emotional data, and the output is a score for abnormal behavior.

[1437] Step 6:

[1438] The artificial intelligence means calculates an anomaly score based on the operation data and emotion data. If the anomaly score exceeds a set threshold, it is judged as an abnormal behavior. The input is the analyzed operation data and emotion data, and the output is the anomaly score and its judgment result.

[1439] Step 7:

[1440] If the server detects abnormal behavior, it sends an alert to the administrator in real time. Specifically, a warning message is sent to the administrator's email or management console. The input is the anomaly score and its judgment result, and the output is the sent alert.

[1441] Step 8:

[1442] If the server detects abnormal behavior, it will take management actions such as restricting access to the device, automatically encrypting documents, or suspending document viewing. Specifically, it temporarily restricts user access and changes documents to read-only mode. The input is the anomaly score and its judgment result, and the output is the management action taken.

[1443] The specific processing unit 290 transmits the result of the specific processing to the headset type terminal 314. In the headset type terminal 314, the control unit 46A causes the speaker 240 and the display 343 to output the result of the specific processing. The microphone 238 acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[1444] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (Internet Search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search <url: https: gemini.google.com ?hl="ja">) and other generation AIs. The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating voice, text data indicating text, and image data indicating an image is also input. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt, and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[1445] In the above embodiment, an example was given in which the specific processing is performed by the data processing device 12, but the technology of the present disclosure is not limited to this, and the specific processing may be performed by the headset type terminal 314.

[1446] [Fourth embodiment]

[1447] FIG. 7 shows an example of the configuration of a data processing system 410 according to the fourth embodiment.

[1448] 7, a data processing system 410 includes a data processing device 12 and a robot 414. An example of the data processing device 12 is a server.

[1449] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" according to the technology of the present disclosure. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[1450] The robot 414 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication I / F 44, and a control target 443. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, the camera 42, and the control target 443 are also connected to the bus 52.

[1451] The microphone 238 receives instructions and the like from the user 20 by receiving voice uttered by the user 20. The microphone 238 captures the voice uttered by the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio in accordance with instructions from the processor 46.

[1452] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the surroundings of user 20 (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[1453] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 control the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[1454] The control object 443 includes a display device, LEDs in the eyes, and motors for driving the arms, hands, and feet. The posture and gestures of the robot 414 are controlled by controlling the motors of the arms, hands, and feet. Some of the emotions of the robot 414 can be expressed by controlling these motors. In addition, the facial expressions of the robot 414 can also be expressed by controlling the light emission state of the LEDs in the eyes of the robot 414.

[1455] Fig. 8 shows an example of the main functions of the data processing device 12 and the robot 414. As shown in Fig. 8, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[1456] The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[1457] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[1458] In the robot 414, the processor 46 performs the reception output process. A reception output program 60 is stored in the storage 50. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output process is realized by the processor 46 operating as the control unit 46A in accordance with the reception output program 60 executed on the RAM 48.

[1459] Next, a description will be given of the specific processing performed by the specific processing unit 290 of the data processing device 12. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[1460] The document monitoring and management system of the present invention is implemented as follows: First, multiple sensors and network devices are installed and connected to a server. Then, client software is installed on the terminal and configured to enable real-time communication with the server.

[1461] Initial Setup

[1462] Initial Server Configuration

[1463] The server registers sensors and network devices, sets communication protocols, and initially starts up the AI ​​engine and database, verifying their operation.

[1464] Setting up the device

[1465] Dedicated client software is installed on the terminal, and a connection test is performed to communicate with the server.

[1466] Registering Users

[1467] The user registers their account on the server and sets the required authentication information and permission level.

[1468] Document Monitoring

[1469] Start working on the document

[1470] When a user opens a document, the device monitors the operation in real time, and the operation data is encrypted and sent to the server in real time.

[1471] Receiving and storing data

[1472] The server accumulates the received operation data and stores it in a database. The data includes metadata such as the operation type, timestamp, and user ID.

[1473] Data analysis and anomaly detection

[1474] Data analysis

[1475] The server's AI engine analyzes the received and accumulated operation data, specifically analyzing operation patterns and distinguishing between normal and abnormal operations.

[1476] Scoring abnormal behavior

[1477] The AI ​​engine calculates an anomaly score for each operation, and if the score exceeds a certain threshold, it determines that the behavior is abnormal.

[1478] Alerts and take administrative actions

[1479] Generate alerts

[1480] The server generates an alert and notifies the administrator if abnormal behavior is detected, such as when a user attempts to copy a large number of documents.

[1481] Performing administrative actions

[1482] When abnormal behavior is detected, the server immediately takes administrative action on the device, such as restricting access, encrypting documents, and automatically locking the device, effectively preventing information leaks and unauthorized use.

[1483] Continuous learning and improvement

[1484] New data collection and analysis

[1485] The server constantly collects new operation data, allowing the AI ​​engine to continuously learn, which is used to update the operation pattern recognition model.

[1486] Model feedback and adjustment

[1487] The server receives feedback from administrators and adjusts the AI ​​engine model accordingly, allowing it to quickly respond to new threats and operational patterns.

[1488] Specific examples

[1489] For example, if a user attempts to copy a large amount of data outside of normal working hours, the server's AI engine will determine this operation as an anomaly and assign a score. If the anomaly score exceeds a threshold, the server will immediately issue an alert and take administrative action, such as temporarily restricting the user's access. It can also take other measures, such as changing documents to read-only mode.

[1490] The document monitoring and management system according to the present invention has been described above. This system makes it possible to respond quickly and efficiently to dynamically changing threats, and effectively reduce the risk of information leakage and unauthorized use.

[1491] The processing flow will be explained below.

[1492] Step 1:

[1493] The server connects to sensors and network devices, sets up communication protocols, and initially starts up the AI ​​engine and database, verifying their operation.

[1494] Step 2:

[1495] Dedicated client software is installed on the device, and a connection test is performed to ensure the device communicates with the server and that it is operating normally.

[1496] Step 3:

[1497] The user registers their account on the server and sets the required authentication information and permission level.

[1498] Step 4:

[1499] When a user opens a document, the device monitors the operation in real time, and the operation data is encrypted and sent to the server in real time.

[1500] Step 5:

[1501] The server receives the operation data sent from the device and stores it in a database. The operation data includes metadata such as the type of operation, timestamp, and user ID.

[1502] Step 6:

[1503] The server's AI engine analyzes the accumulated operation data, specifically analyzing operation patterns and distinguishing between normal and abnormal operations.

[1504] Step 7:

[1505] The AI ​​engine calculates an anomaly score for each operation, and if this score exceeds a set threshold, it is deemed to be an abnormal behavior.

[1506] Step 8:

[1507] The server will alert administrators in real time when abnormal behavior is detected, which will be sent as a warning message.

[1508] Step 9:

[1509] If the server detects any abnormal behavior, it immediately takes administrative action on the device, such as restricting access or automatically encrypting documents.

[1510] Step 10:

[1511] The server continuously collects new operation data, and the AI ​​engine continuously learns, improving the accuracy of the operation pattern recognition model.

[1512] Step 11:

[1513] The server receives feedback from administrators and incorporates it into the AI ​​engine's models, allowing it to respond quickly to new threats and operational patterns.

[1514] The above are the specific processing steps of the document monitoring and management system. This process ensures that the system can monitor in real time, detect abnormal behavior, and respond quickly.

[1515] Example 1

[1516] Next, a description will be given of Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[1517] Conventional document monitoring and management systems have difficulty monitoring user operations in real time, which can result in delayed detection of abnormal behavior. Furthermore, management actions after an abnormality is detected may not be implemented quickly enough, increasing the risk of information leaks and unauthorized use. Furthermore, because the system relied on static models, it was difficult to respond to new threats and operation patterns.

[1518] The specific processing by the specific processing unit 290 of the data processing device 12 in the first embodiment is realized by the following means.

[1519] In this invention, the server includes an initial setting means for registering sensors and network devices and setting communication protocols, a terminal setup means for installing client software and enabling real-time communication with the server, a user registration means for registering user accounts and setting authentication information and authority levels, a document monitoring means for monitoring user document operations, a data transmission means for encrypting operation data and transmitting it to the server in real time, a database means for storing received operation data, an artificial intelligence means for analyzing the received and stored operation data, anomaly detection means for analyzing operation patterns and detecting abnormal behavior, a management means for issuing an alert and taking management action when abnormal behavior is detected, and a learning means for collecting new operation data and continuously learning and improving. This enables real-time monitoring of document operations, rapid anomaly detection, and the execution of management action.

[1520] A "sensor" is a device for detecting physical environmental conditions and document manipulation status.

[1521] A "network device" is a device that connects sensors and terminals to servers and performs data communication.

[1522] The "initial setting means" is a means having the function of registering sensors and network devices and setting communication protocols.

[1523] The "terminal setup means" is a means having a function for installing client software and enabling real-time communication with the server.

[1524] The "user registration means" is a means having the function of registering a user's account and setting authentication information and authority level.

[1525] The "document monitoring means" is a means having a function of monitoring operations when a user operates a document.

[1526] The "data transmission means" is a means having a function of encrypting operation data and transmitting it to the server in real time.

[1527] The "database means" is a means having a function of storing received operation data.

[1528] "Artificial intelligence means" means means having the function of analyzing received and stored operational data.

[1529] The "abnormality detection means" is a means having a function of analyzing operation patterns and detecting abnormal behavior.

[1530] A "management means" is a means that has the function of issuing an alert and taking management action when abnormal behavior is detected.

[1531] A "learning means" is a means that has the ability to collect new operational data and continuously learn and improve.

[1532] The document monitoring and management system of the present invention connects multiple sensors and network devices to a server, and monitors and manages data in real time as users manipulate documents. This system includes an initial setting means, a terminal setup means, a user registration means, a document monitoring means, a data transmission means, a database means, an artificial intelligence means, an anomaly detection means, a management means, and a learning means.

[1533] First, the server registers sensors and network devices and configures communication protocols. This includes registering information from sensors and network devices in a database and configuring communication protocols (e.g., TCP / IP, HTTP). The server also starts AI engines such as TensorFlow and PyTorch and databases such as MySQL and PostgreSQL, and checks their operation.

[1534] Next, dedicated client software is installed on the device and configured to enable real-time communication with the server. The user uses this to perform a connection test with the server and confirm that communication is normal. For example, a connection test can be performed by sending and receiving simple messages.

[1535] Users register their accounts on the server and set the required authentication information and permission levels. They enter information such as their name and email address using a special registration form, which is then sent to the server, which stores this information in a database.

[1536] When a user operates on a document, the client software on the device monitors the operation in real time. The operation data (e.g., copy, edit) is encrypted (e.g., AES-256) and sent to the server. The server receives it and stores it in a database. The operation data includes metadata such as the type of operation, timestamp, and user ID.

[1537] The server's AI engine analyzes the received and accumulated operation data and distinguishes between normal and abnormal operations. For example, copying a large amount of data late at night is not a normal operation and is therefore assigned a high anomaly score. If the anomaly score exceeds a certain threshold, the server determines that the behavior is abnormal and immediately alerts the administrator. At the same time, the server takes management actions on the device, such as restricting access, encrypting documents, and automatically locking them.

[1538] In addition, the server constantly collects new operational data, enabling the AI ​​engine to continuously learn. This data is used to update the operational pattern recognition model. By receiving feedback from administrators and adjusting the AI ​​engine model accordingly, it is possible to quickly respond to new threats and operational patterns.

[1539] Specific examples

[1540] For example, if a user attempts to copy a large amount of data outside of normal working hours, the server's AI engine will determine this operation as an anomaly and assign a score. If the anomaly score exceeds a threshold, the server will immediately issue an alert and take administrative action, such as temporarily restricting the user's access. It can also take other measures, such as changing documents to read-only mode.

[1541] Prompt Sentence Examples

[1542] "Please describe the system behavior that detects a user attempting to copy a large amount of data outside of normal working hours, determines this to be anomalous behavior, and issues an alert."

[1543] The document monitoring and management system according to the present invention has been described above. This system makes it possible to respond quickly and efficiently to dynamically changing threats, and effectively reduce the risk of information leakage and unauthorized use.

[1544] The flow of the identification process in the first embodiment will be described with reference to FIG.

[1545] Step 1:

[1546] Initial Setup

[1547] Input: Sensor and network device information

[1548] Output: Sensors and network devices are registered on the server and communication protocols are configured.

[1549] Specific behavior:

[1550] The server receives device information from sensors and network devices and registers it in a database. The server also sets the protocols (e.g., TCP / IP, HTTP / HTTPS) for communicating with sensors and network devices and performs connection tests with each device. This ensures that sensors and network devices are correctly registered on the server and can communicate normally.

[1551] Step 2:

[1552] Setting up the device

[1553] Input: Client software, terminal information

[1554] Output: The device is now able to communicate with the server in real time.

[1555] Specific behavior:

[1556] The device user downloads and installs dedicated client software, which attempts to connect to the server and performs a communication test to verify successful communication with the server. Specifically, it sends and receives simple messages from the server to the device to verify that a connection has been established.

[1557] Step 3:

[1558] Registering Users

[1559] Input: User personal information (name, email address, etc.), authentication information, permission level

[1560] Output: Registered user information, configured authentication information and permission level

[1561] Specific behavior:

[1562] Users use the server's registration form to enter personal information such as their name, email address, and password, and then submit it to the server. The server stores the information in a database, and the administrator assigns the appropriate permission level (e.g., view only, edit) to each user, creating an account that allows the user to access the system.

[1563] Step 4:

[1564] Document Monitoring

[1565] Input: User document operations (e.g., opening or editing a document)

[1566] Output: Encrypted operation data

[1567] Specific behavior:

[1568] When a user opens a document on a device, dedicated software captures the operation details in real time. The captured operation data is encrypted (e.g., AES-256) and sent to the server. This ensures that the user's document operation information is securely sent to the server.

[1569] Step 5:

[1570] Receiving and storing data

[1571] Input: Encrypted operational data

[1572] Output: Operational data stored in a database

[1573] Specific behavior:

[1574] The server receives the encrypted operation data sent from the device. The received data is decrypted and stored in a database. This data includes metadata such as the type of operation, timestamp, and user ID, and is accumulated in the database.

[1575] Step 6:

[1576] Data analysis and anomaly detection

[1577] Input: Operational data stored in the database

[1578] Output: Anomaly score and abnormal behavior detection results

[1579] Specific behavior:

[1580] The server's AI engine analyzes the operation data stored in the database. It distinguishes between normal and abnormal operations based on specific operation patterns and time periods. It calculates an anomaly score, and if the score exceeds a certain threshold, it determines that the operation is abnormal.

[1581] Step 7:

[1582] Alerts and take administrative actions

[1583] Input: Anomalous behavior detection results

[1584] Output: Alert to administrator and administrative action taken

[1585] Specific behavior:

[1586] If abnormal behavior is detected, the server immediately generates an alert and notifies the administrator. In addition, the server performs management actions on the device, such as restricting access, encrypting documents, and automatically locking the device, thereby preventing information leaks and unauthorized use.

[1587] Step 8:

[1588] Continuous learning and improvement

[1589] Input: New operation data, feedback from administrators

[1590] Output: Updated and improved AI engine model

[1591] Specific behavior:

[1592] The server constantly collects new operational data, allowing the AI ​​engine to continuously learn. This data is used to update the operational pattern recognition model. It also receives feedback from administrators and adjusts the AI ​​engine model accordingly to quickly respond to new threats and operational patterns.

[1593] (Application example 1)

[1594] Next, a description will be given of Application Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[1595] While conventional document monitoring and management systems excel at monitoring document operation data, they are not adequate for monitoring the operation data of machines such as factory robots in real time and detecting abnormal behavior. As a result, it is difficult to effectively mitigate the risk of potential abnormal behavior or unauthorized use occurring within the factory. There is a need to solve this issue and provide a system that can monitor and manage a wide range of data, including the operation data of industrial products.

[1596] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 1 is realized by the following means.

[1597] In this invention, the server includes means for receiving and storing document operation data and machine operation data based on the operation data in real time, means for analyzing the received operation data and machine operation data and detecting abnormal behavior, means for issuing an alert and executing management action when abnormal behavior is detected, means for monitoring the operation of industrial products and detecting abnormal robot behavior as abnormal behavior, means for encrypting and transmitting the industrial product operations at regular intervals, and means for calculating an abnormal industrial product operation score and restricting the robot's operation as management action. This makes it possible to respond quickly and efficiently to dynamically changing threats and effectively reduce the risk of information leaks and unauthorized use.

[1598] "Document operation data" is information about operations (for example, viewing, editing, copying, etc.) performed by a user on a document.

[1599] "Machine operation data" is information about operations performed by industrial products or factory robots (e.g., moving, picking, placing parts, etc.).

[1600] A "sensor" is a device that detects a physical or environmental condition and converts it into an electrical signal.

[1601] A "network device" is a device for performing data communication, enabling data transfer with a server or client device.

[1602] A "server" is a central management system that provides services to client devices over a network.

[1603] "Artificial intelligence" is a technology that analyzes data and recognizes patterns to support decision-making.

[1604] An "alert" is a notification that notifies an administrator when abnormal behavior is detected.

[1605] "Administrative actions" are measures such as access restrictions and operational controls that are taken when abnormal behavior is detected.

[1606] "Abnormal behavior" is behavior that deviates from normal operation patterns and suggests security risks or fraudulent use.

[1607] The "score" is a numerical value that indicates the degree of abnormal behavior.

[1608] "Encryption" is a conversion process performed to ensure secure transmission of data.

[1609] "Industrial products" is a general term for machines and equipment manufactured and operated within a factory.

[1610] "Operation restrictions" are management measures that prohibit or restrict specific operations.

[1611] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention is a system for monitoring operation data of documents and industrial products, and detecting and managing abnormal behavior.

[1612] First, a server is set up to receive and store document and industrial product operation data in real time. The server includes the following main components:

[1613] 1. Sensors and network devices:

[1614] Sensors are devices that detect physical or environmental conditions and convert them into electrical signals, and network devices are devices that communicate with servers. These devices are deployed to monitor document usage and industrial product operation.

[1615] 2. Server means:

[1616] The server receives operational data and machine operation data in real time, stores them in encrypted form, and uses a database system (e.g., MySQL) to store and manage the received data.

[1617] 3. Artificial Intelligence Means:

[1618] An AI engine (e.g., TensorFlow) installed on the server analyzes the received operation data and machine operation data. Specifically, it learns operation patterns and distinguishes and analyzes normal and abnormal operations. It calculates a score for abnormal behavior and determines it as abnormal if it exceeds a threshold.

[1619] 4. Control measures:

[1620] If the server detects any abnormal behavior, it will send an alert to the administrator. It will then take administrative action, such as restricting or halting the robot's operation or controlling document access. Alert notifications are sent via email, SMS, or other methods.

[1621] Next, a specific method for monitoring robots and document operations will be described.

[1622] Factory robot monitoring examples:

[1623] 1. When a factory robot moves a part, this operation data (e.g., the robot's movement position, speed, time, etc.) is acquired by sensors.

[1624] 2. The acquired data is sent to a server via a network device, encrypted, and stored.

[1625] 3. The server's AI engine analyzes this data and detects abnormal behavior that differs from normal operation patterns.

[1626] 4. If abnormal behavior is detected, an alert is sent to the administrator and the robot's operations are restricted.

[1627] Example prompt sentence:

[1628] "I would like to develop software for a monitoring system for factory robots. Specifically, it would be a system that monitors robot operation data in real time and sends an alert to an administrator if unauthorized operation is detected. Please tell me about the specific implementation of data transmission and reception between the server and robots, anomaly detection using an AI engine, and management actions."

[1629] This system enables the server to respond quickly and efficiently to dynamically changing threats and comprehensively monitor and manage the operation data of industrial products, thereby effectively reducing the risk of potential abnormal operation or unauthorized use within the factory.

[1630] The flow of the specific processing in the application example 1 will be described with reference to FIG.

[1631] Step 1:

[1632] A user operates a document or industrial product that is being monitored. Specifically, the user starts the operation of a factory robot (moving or picking parts, etc.). Data on this operation (operation details, timestamp, user ID, etc.) is acquired through sensors.

[1633] Input: User actions

[1634] Output: Operation data

[1635] Step 2:

[1636] The terminal transmits the acquired operation data to the server via the network device. The operation data includes metadata such as the operation content, timestamp, and user ID. This data is encrypted before transmission.

[1637] Input: Retrieved operation data

[1638] Output: Encrypted operation data

[1639] Step 3:

[1640] The server receives the encrypted data sent from the device and stores it in a database, such as MySQL. The received data is automatically decrypted and saved for each required item.

[1641] Input: Encrypted operational data

[1642] Output: Operation data stored in a database

[1643] Step 4:

[1644] An AI engine (e.g., TensorFlow) on the server periodically scans the operation data in the database to detect anomalous patterns. The AI ​​engine identifies behavior that differs from normal operation patterns and calculates a score for the anomalous behavior.

[1645] Input: Operational data in the database

[1646] Output: Abnormal behavior score

[1647] Step 5:

[1648] The server evaluates the score of abnormal behavior calculated by the AI ​​engine and generates an alert if a certain threshold is exceeded, which is then sent to the administrator via email or SMS.

[1649] Input: Abnormal behavior score

[1650] Output: Alert notification

[1651] Step 6:

[1652] The server implements management actions when abnormal behavior is detected. Specifically, it temporarily restricts the operation of factory robots or changes document access permissions. Management actions include commands to enforce specified operation restrictions.

[1653] Input: Anomalous behavior detection results

[1654] Output: Management action taken

[1655] Step 7:

[1656] The server continuously updates the AI ​​engine's learning model based on newly collected data, and also incorporates feedback from administrators to improve the model's accuracy.

[1657] Input: New operational data and feedback from administrators

[1658] output: Updated AI engine learning model

[1659] Furthermore, an emotion engine that estimates the user's emotion may be further combined. That is, the identification processing unit 290 may estimate the user's emotion using the emotion identification model 59, and perform identification processing using the user's emotion.

[1660] The document monitoring and management system of the present invention further incorporates an emotion engine that recognizes user emotions, enabling integrated analysis of document operation data and emotion data, enabling more precise detection of abnormal behavior. Specific embodiments are described below.

[1661] Initial Setup

[1662] Initial Server Configuration

[1663] The server connects to sensors and network devices, sets up communication protocols, starts up the AI ​​engine, emotion engine, and database, and checks their operation.

[1664] Setting up the device

[1665] The device is installed with dedicated client software. Hardware necessary for the emotion engine to function properly, such as a camera and microphone, is also connected. A connection test is performed to enable the device to communicate with the server, and normal operation is confirmed.

[1666] Registering Users

[1667] The user registers an account on the server, sets authentication information and permission levels, and obtains consent for the collection of the user's emotional data.

[1668] Document Monitoring and Emotion Recognition

[1669] Start working on the document

[1670] When a user opens a document, the device monitors the operation in real time. Along with the operation data, the emotion engine analyzes the user's facial expressions and voice to generate emotion data. This data is encrypted and sent to the server in real time.

[1671] Receiving and storing data

[1672] The server receives the operation data and emotion data sent from the device and stores them in a database, including metadata such as the type of operation, timestamp, and user ID.

[1673] Data analysis and anomaly detection

[1674] Data analysis

[1675] The server's AI engine analyzes the received and accumulated operation data and emotional data. Specifically, it analyzes both operation patterns and emotional patterns to distinguish between normal and abnormal operations.

[1676] Scoring abnormal behavior

[1677] The AI ​​engine calculates an anomaly score based on operation data and emotional data, and if this score exceeds a set threshold, it is determined to be abnormal behavior.

[1678] Alerts and take administrative actions

[1679] Generate alerts

[1680] The server will alert administrators in real time if any abnormal behavior is detected, which will be sent as a warning message.

[1681] Performing administrative actions

[1682] If the server detects any abnormal behavior, it will take administrative action such as restricting access to the device, automatically encrypting documents, or suspending document viewing, thereby effectively preventing information leaks and unauthorized use.

[1683] Continuous learning and improvement

[1684] New data collection and analysis

[1685] The server continuously collects new operational and emotional data, allowing the AI ​​engine to continuously learn. This data is used to update the operational and emotional pattern recognition model.

[1686] Model feedback and adjustment

[1687] The server receives feedback from administrators and reflects it in the AI ​​engine and emotion engine models, allowing it to quickly respond to new threats and operational and emotional patterns.

[1688] Specific examples

[1689] If a user opens a document outside of normal working hours and attempts to copy a large amount of data, the server's AI engine will recognize this operation as an anomaly. At the same time, if the emotion engine detects anxiety or impatience in the user's facial expression, the anomaly score will increase. If this score exceeds a threshold, the server will immediately issue an alert and take administrative action, temporarily restricting the user's access. Furthermore, the server can take measures such as changing the document to read-only.

[1690] The document monitoring and management system according to the present invention has been described above. By incorporating emotion recognition functionality, this system can respond more accurately to dynamically changing threats, effectively reducing the risk of information leaks and unauthorized use.

[1691] The processing flow will be explained below.

[1692] Step 1:

[1693] The server connects to sensors and network devices, sets up communication protocols, starts up the AI ​​engine, emotion engine, and database, and checks their operation.

[1694] Step 2:

[1695] Dedicated client software is installed on the device. In order for the emotion engine to function properly, the device must be connected to the necessary hardware, such as a camera and microphone. The device then performs a connection test to communicate with the server to confirm proper operation.

[1696] Step 3:

[1697] The user registers their account on the server, sets their authentication information and permission level, and also obtains consent for the collection of the user's emotional data.

[1698] Step 4:

[1699] When a user opens a document, the device monitors the operation in real time and captures the operation data. At the same time, the emotion engine analyzes the user's facial expressions and voice to generate emotion data. This data is encrypted and sent to the server in real time.

[1700] Step 5:

[1701] The server receives the operation data and emotion data sent from the device and stores them in a database, including metadata such as the type of operation, timestamp, and user ID.

[1702] Step 6:

[1703] The server's AI engine analyzes the accumulated operation data and emotional data. Specifically, it analyzes both operation patterns and emotional patterns to distinguish between normal and abnormal operations.

[1704] Step 7:

[1705] The AI ​​engine calculates an anomaly score based on operation data and emotional data, and if this score exceeds a set threshold, it is determined to be abnormal behavior.

[1706] Step 8:

[1707] If the server detects any abnormal behavior, it will send an alert to the administrator in real time. The alert will be sent as a warning message.

[1708] Step 9:

[1709] If the server detects any abnormal behavior, it will take administrative action such as restricting access to the device, automatically encrypting documents, or suspending document viewing, thereby effectively preventing information leaks and unauthorized use.

[1710] Step 10:

[1711] The server continuously collects new operation and emotion data, which the AI ​​engine continuously learns from. This data is used to update the operation and emotion pattern recognition model.

[1712] Step 11:

[1713] The server receives feedback from administrators and reflects it in the AI ​​engine and emotion engine models, allowing it to quickly respond to new threats and operational and emotional patterns.

[1714] The above are the specific processing steps of the document monitoring and management system combined with the emotion engine. This process ensures that the system can monitor and detect abnormal behavior in real time and respond quickly.

[1715] Example 2

[1716] Next, a description will be given of Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[1717] In recent years, the risk of information leakage and unauthorized use has increased, and there is a problem that existing systems have difficulty accurately detecting abnormal behavior, especially when changes in emotions affect document operations. An object of the present invention is to provide a document monitoring and management system that can more accurately detect abnormal behavior through multifaceted data analysis, including emotional data.

[1718] The identification process by the identification processing unit 290 of the data processing device 12 in the second embodiment is realized by the following means. In this invention, the server includes means for receiving and storing document operation data and emotion data in real time, means for analyzing the received operation data and emotion data and detecting abnormal behavior, and means for issuing an alert and executing management action when abnormal behavior is detected. This enables precise and prompt detection of abnormal behavior, including risks associated with emotional changes.

[1719] A "sensor" is a device that gathers information from the environment.

[1720] A "network device" is a device that enables data communication between different devices.

[1721] A "server" is a computer system that provides data in response to requests from clients.

[1722] "Operation data" is data that is generated when a user operates a document.

[1723] "Emotion data" refers to data relating to emotions analyzed from the user's facial expressions and voice.

[1724] "Real-time" refers to data generation and processing occurring without delay.

[1725] "Storage" refers to the continuous storage of data.

[1726] "Artificial intelligence" is a technology that analyzes large amounts of data and learns, recognizes, and judges like a human being.

[1727] "Analysis" refers to the detailed investigation and analysis of data.

[1728] "Abnormal behavior" refers to behavior that deviates from normal operating patterns.

[1729] An "alert" is a warning that notifies you of the occurrence of an abnormality or emergency.

[1730] "Administrative actions" are measures or procedures that are implemented when abnormal behavior is detected.

[1731] "Encryption" is a technology that converts data into a format that cannot be deciphered by third parties.

[1732] A "threshold" refers to a specific standard or limit value that, if exceeded, is deemed abnormal.

[1733] The document monitoring and management system of the present invention combines an emotion engine that recognizes user emotions and performs an integrated analysis of document operation data and emotion data, thereby enabling more precise detection of abnormal behavior.

[1734] Initial Setup

[1735] Initial Server Configuration

[1736] The server connects to sensors and network devices and configures communication protocols, specifically TCP / IP and HTTP, and ensures security through firewalls. Next, the server starts up the AI ​​engine, emotion engine, and database, and performs self-diagnosis to confirm proper operation.

[1737] Setting up the device

[1738] The device installs dedicated client software, which automatically performs initial setup after installation. The device also connects to the hardware necessary for the emotion engine to function properly, such as a camera and microphone. The device then performs a connection test to communicate with the server, confirming that data is being sent and received normally.

[1739] Registering Users

[1740] The user accesses the server and registers for an account. They enter information such as their name, email address, and password to create an account. The server then stores the user's authentication information and sets their access permission level. The user also digitally signs a consent form for the acquisition of emotion data, and the server stores this information.

[1741] Document Monitoring and Emotion Recognition

[1742] Start working on the document

[1743] When a user opens a document, the device monitors the operation in real time. The user's operations (e.g., keyboard input, mouse clicks) are generated as operation data. At the same time, the emotion engine analyzes the video and audio captured by the camera and microphone to generate emotion data.

[1744] Receiving and storing data

[1745] The device encrypts the generated operation data and emotion data and transmits them in real time to the server. The server receives this data and stores it in a database, along with metadata such as the type of operation, timestamp, and user ID.

[1746] Data analysis and anomaly detection

[1747] Data analysis

[1748] The server's AI engine analyzes the received and accumulated operation and emotion data, extracting normal operation and emotion patterns and applying algorithms to detect abnormal behavior.

[1749] Scoring abnormal behavior

[1750] The server's AI engine calculates an anomaly score based on the operation data and emotion data. If this score exceeds a set threshold, the server determines that the behavior is abnormal.

[1751] Alerts and take administrative actions

[1752] Generate alerts

[1753] If the server detects any abnormal behavior, it will send a real-time warning message to the administrator, who will then check the alert and take action as necessary.

[1754] Performing administrative actions

[1755] If the server detects any abnormal behavior, it will take the following administrative actions on the device: restrict access and suspend the user's account. It will also automatically encrypt documents and change them to read-only to restrict further operations.

[1756] Continuous learning and improvement

[1757] New data collection and analysis

[1758] The server continuously collects new operation and emotion data and stores it in a database, which updates the operation and emotion pattern recognition model of the AI ​​engine.

[1759] Model feedback and adjustment

[1760] The server receives feedback from administrators and reflects it in the AI ​​engine and emotion engine models, allowing it to quickly respond to new threats and operational and emotional patterns.

[1761] Specific examples

[1762] If a user attempts to open a document and copy a large amount of data outside of normal working hours, the server's AI engine will recognize this action as an anomaly. At the same time, if the emotion engine detects anxiety or impatience in the user's facial expression, the anomaly score will increase. If this score exceeds a threshold, the server will immediately issue an alert and temporarily restrict the user's access. Additionally, changing the document to read-only can prevent information leaks.

[1763] Prompt Sentence Examples

[1764] "Please provide an overview of the following anomalous behavior detection system that combines data manipulation and sentiment analysis."

[1765] The above explanation has shown a specific embodiment of the document monitoring and management system of the present invention. By combining this system with emotion recognition functions, it can effectively reduce the risk of information leakage and unauthorized use.

[1766] The flow of the identification process in the second embodiment will be described with reference to FIG.

[1767] Step 1: Initial Server Setup

[1768] Input: Sensors and network devices

[1769] How it works: The server physically connects to sensors and network devices and configures communication protocols such as TCP / IP and HTTP.

[1770] Data processing: Install the necessary drivers and recognize connected devices.

[1771] Output: The connected device is working properly and the communication protocol is set.

[1772] Step 2: Initial launch of the AI ​​engine, emotion engine, and database

[1773] Input: AI engine, emotion engine, database

[1774] What happens: The server starts these engines and databases.

[1775] Data calculation: Each engine and database performs self-diagnosis to confirm normal operation.

[1776] Output: A working engine and database

[1777] Step 3: Install the client software

[1778] Input: Client software

[1779] How it works: The device downloads and installs the dedicated client software.

[1780] Data calculation: After installation, the initial settings will be performed automatically.

[1781] Output: Installed client software

[1782] Step 4: Connecting the camera and microphone

[1783] Input: Camera, Microphone

[1784] Action: The device connects the camera and microphone and installs the device drivers.

[1785] Data processing: Check that the device is working properly.

[1786] Output: A properly connected camera and microphone

[1787] Step 5: Test the connection

[1788] Input: terminal, server

[1789] Action: The device will perform a connection test with the server.

[1790] Data calculation: Tests data transmission and reception to ensure normal communication.

[1791] Output: Terminal and server that communicate normally

[1792] Step 6: User Account Registration

[1793] Input: User information (name, email address, password)

[1794] How it works: A user accesses the server and enters information into an account registration form.

[1795] Data processing: The server stores the entered information and creates an account.

[1796] Output: Registered user account

[1797] Step 7: Configure credentials and privilege levels

[1798] Input: User account information

[1799] How it works: The server stores the user's authentication information and sets access privileges.

[1800] Data processing: Parsing and storing information to set user permission levels.

[1801] Output: User account with credentials and privilege level

[1802] Step 8: Obtaining consent for emotional data collection

[1803] Input: User consent

[1804] How it works: The user electronically signs a consent form for emotional data collection.

[1805] Data processing: The server stores the consent information.

[1806] Output: User account with saved consent information

[1807] Step 9: Open the document

[1808] Input: The document selected by the user

[1809] How it works: When a user opens a document, the device monitors the activity.

[1810] Data processing: Generate operational data for the document.

[1811] Output: Generated operation data

[1812] Step 10: Generate emotion data

[1813] Input: Video from camera, audio from microphone

[1814] How it works: The emotion engine analyzes this data.

[1815] Data calculation: Generate emotion data from facial expressions and voice.

[1816] Output: Generated emotion data

[1817] Step 11: Encrypt and send data

[1818] Input: Operation data, emotion data

[1819] How it works: The device encrypts these data.

[1820] Data processing: Generate encrypted data.

[1821] Output: Encrypted operational and emotional data

[1822] Step 12: Receiving and storing data

[1823] Input: Encrypted operational and emotional data

[1824] Operation: The server receives data sent from the terminal.

[1825] Data processing: The received data is stored in a database.

[1826] Output: Accumulated operation data and emotion data

[1827] Step 13: Analyze the data

[1828] Input: Operational data and emotional data

[1829] How it works: The server's AI engine analyzes the data and extracts operation and emotion patterns.

[1830] Data arithmetic: Applying algorithms that distinguish between normal and abnormal operations.

[1831] Output: Abnormal behavior detection results

[1832] Step 14: Calculate the anomaly score

[1833] Input: Operational data and emotional data

[1834] How it works: The server's AI engine calculates the anomaly score.

[1835] Data calculation: Calculate the score and compare it with the set threshold.

[1836] Output: Abnormal behavior determination result

[1837] Step 15: Generate an alert

[1838] Input: Abnormal behavior determination result

[1839] How it works: The server sends real-time alert messages to the administrator.

[1840] Data processing: Generate alert messages.

[1841] Output: Alert sent to administrator

[1842] Step 16: Perform administrative actions

[1843] Input: Abnormal behavior determination result

[1844] How it works: The server restricts access to the device and automatically encrypts it.

[1845] Data manipulation: Restrictions such as changing documents to read-only.

[1846] Output: Administrative actions taken

[1847] Step 17: Collect and analyze new data

[1848] Input: New operational and emotional data

[1849] How it works: The server continuously collects new data and stores it in a database.

[1850] Data calculations: Updating the model based on new data.

[1851] Output: Updated action and emotion pattern recognition model

[1852] Step 18: Model feedback and refinement

[1853] Input: Admin feedback

[1854] How it works: The server analyzes the feedback and reflects it in the AI ​​engine and emotion engine models.

[1855] Data computation: Adjust models to adapt to new threats.

[1856] Output: Tuned AI Engine and Emotion Engine models

[1857] (Application example 2)

[1858] Next, a description will be given of Application Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[1859] Conventional document monitoring systems detect abnormal behavior based solely on operation data, which limits their accuracy and can miss sophisticated fraudulent behavior. Furthermore, they do not take into account changes in user emotions, making dynamic and real-time anomaly detection difficult. Therefore, a method for detecting abnormal behavior with higher accuracy and preventing fraudulent use was needed.

[1860] The identification process by the identification processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means. In this invention, the server includes means for receiving and storing document operation data and emotion data in real time, means for analyzing the received operation data and emotion data and detecting anomalous behavior, means for issuing an alert and executing management action when anomalous behavior is detected, and means for analyzing the user's facial expressions and voice and generating emotion data. This makes it possible to detect anomalous behavior with high accuracy from both operation data and emotion data, effectively reducing the risk of information leaks and unauthorized use.

[1861] "Multiple sensors for monitoring document usage" refers to sensor devices that can monitor document operations and access status in real time.

[1862] A "network device" is a device for data communication, and is responsible for sending and receiving data between a server and a terminal via a network.

[1863] "Server means" refers to a computer system for storing, analyzing, and managing data, and is a device that has the function of receiving and storing document operation data and emotion data in real time.

[1864] "Document operation data" refers to data that records the history and content of operations that a user performs on a document.

[1865] "Emotional data" is data obtained by analyzing emotional information such as a user's facial expressions and voice.

[1866] "Artificial intelligence means" refers to systems that use technologies such as computer vision and voice analysis to analyze data and detect abnormal behavior.

[1867] A "controller" is a device or system that issues an alert when anomalous behavior is detected and takes control action such as access control or changing the state of a document.

[1868] "Emotion recognition means" is a device or system that analyzes a user's facial expressions and voice to generate emotion data.

[1869] The document monitoring and management system of the present invention, by combining an emotion recognition means for recognizing the user's emotions, performs an integrated analysis of document operation data and emotion data, making it possible to detect abnormal behavior with high accuracy.

[1870] Initial Setup

[1871] Initial Server Configuration

[1872] The server connects to sensors and network devices, sets up communication protocols, starts up the AI ​​engine, emotion recognition means, and database, and checks their operation.

[1873] Setting up the device

[1874] The device is installed with dedicated client software. Hardware necessary for the emotion recognition system to function properly, such as a camera and microphone, is also connected. A connection test is performed to enable the device to communicate with the server, and normal operation is confirmed.

[1875] Registering Users

[1876] The user registers an account on the server, sets authentication information and permission levels, and obtains consent for the collection of the user's emotional data.

[1877] Document Monitoring and Emotion Recognition

[1878] Start working on the document

[1879] When a user opens a document, the device monitors the operation in real time. Along with the operation data, the emotion recognition means analyzes the user's facial expressions and voice to generate emotion data. This data is encrypted and sent to the server in real time.

[1880] Receiving and storing data

[1881] The server receives the operation data and emotion data sent from the device and stores them in a database, including metadata such as the type of operation, timestamp, and user ID.

[1882] Data analysis and anomaly detection

[1883] Data analysis

[1884] The artificial intelligence means of the server analyzes the received and stored operation data and emotion data, specifically, analyzes both operation patterns and emotion patterns, and distinguishes between normal operations and abnormal operations.

[1885] Scoring abnormal behavior

[1886] The artificial intelligence means calculates an abnormality score based on the operation data and emotion data, and if the score exceeds a set threshold, it is determined to be an abnormal behavior.

[1887] Alerts and take administrative actions

[1888] Generate alerts

[1889] The server will alert administrators in real time if any abnormal behavior is detected, which will be sent as a warning message.

[1890] Performing administrative actions

[1891] If the server detects any abnormal behavior, it will take administrative action such as restricting access to the device, automatically encrypting documents, or suspending document viewing, thereby effectively preventing information leaks and unauthorized use.

[1892] Continuous learning and improvement

[1893] New data collection and analysis

[1894] The server continuously collects new operational and emotional data, allowing the artificial intelligence means to continuously learn. This data is used to update the operational and emotional pattern recognition models.

[1895] Model feedback and adjustment

[1896] The server receives feedback from administrators and incorporates it into its artificial intelligence and emotion recognition models, allowing it to quickly respond to new threats and operational and emotional patterns.

[1897] Specific examples

[1898] If a user opens a document outside of normal working hours and attempts to copy a large amount of data, the server's artificial intelligence system will recognize this operation as an anomaly. At the same time, if the emotion recognition system detects anxiety or impatience in the user's facial expression, the anomaly score will increase. If this score exceeds a threshold, the server will immediately issue an alert and take administrative action, temporarily restricting the user's access. Furthermore, the server can take measures such as changing the document to read-only.

[1899] Example prompts to input to the generative AI model

[1900] "If a user viewing an important document attempts to copy a large amount of data outside of working hours and shows signs of anxiety or impatience while doing so, write a Python program that will immediately alert an administrator and restrict the user's access to the document."

[1901] The flow of the specific processing in the application example 2 will be described with reference to FIG.

[1902] Step 1:

[1903] When a user opens a document, the device monitors the operation in real time. The device uses a camera and microphone to capture the user's facial expressions and voice, and analyzes these data using emotion recognition. The input is the user's document operation and real-time video and audio data, and the output is operation data and emotion data.

[1904] Step 2:

[1905] The emotion recognition means analyzes the captured video (facial expression) and audio data to detect the user's emotions. Data processing uses facial expression recognition algorithms and audio analysis algorithms to identify the user's emotional state. The input is the captured video and audio data, and the output is the user's emotional data.

[1906] Step 3:

[1907] The terminal encrypts the document's operation data and emotion data and transmits them to the server in real time. The input is the operation data and emotion data, and the output is the encrypted data.

[1908] Step 4:

[1909] The server stores the received operation data and emotion data in a database. Specifically, metadata such as the type of operation, timestamp, and user ID are attached to the data. The input is encrypted operation data and emotion data, and the output is the accumulated data stored in the database.

[1910] Step 5:

[1911] The server's artificial intelligence means analyzes the accumulated operation data and emotional data to detect abnormal behavior. It analyzes both operation patterns and emotional patterns to distinguish between normal and abnormal operations. The input is the accumulated operation data and emotional data, and the output is a score for abnormal behavior.

[1912] Step 6:

[1913] The artificial intelligence means calculates an anomaly score based on the operation data and emotion data. If the anomaly score exceeds a set threshold, it is judged as an abnormal behavior. The input is the analyzed operation data and emotion data, and the output is the anomaly score and its judgment result.

[1914] Step 7:

[1915] If the server detects abnormal behavior, it sends an alert to the administrator in real time. Specifically, a warning message is sent to the administrator's email or management console. The input is the anomaly score and its judgment result, and the output is the sent alert.

[1916] Step 8:

[1917] If the server detects abnormal behavior, it will take management actions such as restricting access to the device, automatically encrypting documents, or suspending document viewing. Specifically, it temporarily restricts user access and changes documents to read-only mode. The input is the anomaly score and its judgment result, and the output is the management action taken.

[1918] The specific processing unit 290 transmits the result of the specific processing to the robot 414. In the robot 414, the control unit 46A causes the speaker 240 and the control target 443 to output the result of the specific processing. The microphone 238 acquires voice indicating a user input regarding the result of the specific processing. The control unit 46A transmits voice data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the voice data.

[1919] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (Internet Search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search <url: https: gemini.google.com ?hl="ja">) and other generation AIs. The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating voice, text data indicating text, and image data indicating an image is also input. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt, and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[1920] In the above embodiment, an example was given in which the specific processing is performed by the data processing device 12, but the technology of the present disclosure is not limited to this, and the specific processing may be performed by the robot 414.

[1921] The emotion identification model 59 as an emotion engine may determine the user's emotion according to a specific mapping. Specifically, the emotion identification model 59 may determine the user's emotion according to an emotion map (see FIG. 9), which is a specific mapping. Similarly, the emotion identification model 59 may determine the robot's emotion, and the identification processing unit 290 may perform identification processing using the robot's emotion.

[1922] FIG. 9 illustrates an emotion map 400 on which multiple emotions are mapped. In the emotion map 400, emotions are arranged in concentric circles radiating from the center. Emotions closer to the center of the concentric circles are more primitive. Emotions representing states and behaviors arising from a state of mind are arranged on the outer edges of the concentric circles. The concept of emotion includes both affect and mental states. Emotions generally generated from reactions occurring in the brain are arranged on the left side of the concentric circles. Emotions generally induced by situational judgment are arranged on the right side of the concentric circles. Emotions generally generated from reactions occurring in the brain and induced by situational judgment are arranged on the upper and lower sides of the concentric circles. Furthermore, the emotion of "pleasure" is arranged on the upper side of the concentric circles, and the emotion of "discomfort" is arranged on the lower side. In this way, in the emotion map 400, multiple emotions are mapped based on the structure by which emotions are generated, and emotions that tend to occur simultaneously are mapped close to each other.

[1923] These emotions are distributed in the 3 o'clock direction on emotion map 400, and typically fluctuate between relief and anxiety. In the right half of emotion map 400, situational awareness dominates over internal sensations, resulting in a sense of calm.

[1924] The inside of emotion map 400 represents what is going on in the mind, and the outside of emotion map 400 represents behavior, so the further you go outside emotion map 400, the more visible the emotions become (the more they are expressed in behavior).

[1925] Human emotions are based on various balances, such as posture and blood sugar levels. When these balances deviate from the ideal, a state of discomfort is indicated, and when they approach the ideal, a state of pleasure is indicated. Emotions can also be created for robots, automobiles, and motorcycles, based on various balances, such as posture and remaining battery life. When these balances deviate from the ideal, a state of discomfort is indicated, and when they approach the ideal, a state of pleasure is indicated. An emotion map can be generated, for example, based on Dr. Mitsuyoshi's emotion map (Research on Voice Emotion Recognition and Emotional Brain Physiological Signal Analysis Systems, Tokushima University, Doctoral Dissertation: https: / / ci.nii.ac.jp / naid / 500000375379). The left half of the emotion map lists emotions belonging to the "reaction" domain, where sensation is dominant. The right half of the emotion map lists emotions belonging to the "situation" domain, where situational awareness is dominant.

[1926] The emotion map defines two emotions that promote learning. One is a negative emotion on the situation side, around the middle of "repentance" or "reflection." In other words, this occurs when the robot experiences negative emotions such as "I never want to feel this way again" or "I don't want to be scolded again." The other is a positive emotion on the response side, around "desire." In other words, this occurs when the robot experiences positive feelings such as "I want more" or "I want to know more."

[1927] The emotion identification model 59 inputs user input into a pre-trained neural network, obtains emotion values ​​indicating each emotion shown in the emotion map 400, and determines the user's emotion. This neural network is pre-trained based on multiple pieces of training data that are combinations of user input and emotion values ​​indicating each emotion shown in the emotion map 400. Furthermore, this neural network is trained so that emotions that are located close to each other have similar values, as in the emotion map 900 shown in FIG. 10. FIG. 10 shows an example in which multiple emotions, "relieved," "calm," and "reassuring," have similar emotion values.

[1928] The system according to the present disclosure has been described above mainly with respect to the functions of the data processing device 12, but the system according to the present disclosure is not necessarily implemented on a server. The system according to the present disclosure may be implemented as a general information processing system. The present disclosure may be implemented, for example, as a software program running on a personal computer or an application running on a smartphone, etc. The method according to the present disclosure may be provided to users in the form of SaaS (Software as a Service).

[1929] In the above embodiment, an example was given in which the specific processing is performed by one computer 22, but the technology of the present disclosure is not limited to this, and the specific processing may be distributed and performed by a plurality of computers including the computer 22. For example, the data generation model 58 may be provided in an external device of the data processing device 12, and data may be generated in the external device in accordance with input data.

[1930] In the above embodiment, an example in which the specific processing program 56 is stored in the storage 32 has been described, but the technology of the present disclosure is not limited to this. For example, the specific processing program 56 may be stored in a portable, computer-readable, non-transitory storage medium such as a USB (Universal Serial Bus) memory. The specific processing program 56 stored in the non-transitory storage medium is installed in the computer 22 of the data processing device 12. The processor 28 executes the specific processing in accordance with the specific processing program 56.

[1931] Alternatively, the specific processing program 56 may be stored in a storage device such as a server connected to the data processing device 12 via the network 54, and the specific processing program 56 may be downloaded and installed on the computer 22 in response to a request from the data processing device 12.

[1932] It is not necessary to store all of the specific processing program 56 in a storage device such as a server connected to the data processing device 12 via the network 54, or to store all of the specific processing program 56 in the storage 32; only a portion of the specific processing program 56 may be stored.

[1933] The hardware resource for executing a specific process can be any of the following processors: An example of a processor is a CPU, which is a general-purpose processor that functions as a hardware resource for executing a specific process by executing software, i.e., a program. Another example of a processor is a dedicated electrical circuit, such as an FPGA (Field-Programmable Gate Array), a PLD (Programmable Logic Device), or an ASIC (Application Specific Integrated Circuit), which is a processor with a circuit configuration designed specifically for executing a specific process. Each processor has built-in or connected memory, and each processor uses the memory to execute the specific process.

[1934] The hardware resource that executes the specific processing may be configured with one of these various processors, or may be configured with a combination of two or more processors of the same or different types (for example, a combination of multiple FPGAs, or a combination of a CPU and an FPGA). Also, the hardware resource that executes the specific processing may be a single processor.

[1935] As an example of a system configured with a single processor, first, one processor is configured by combining one or more CPUs and software, and this processor functions as a hardware resource that executes a specific process. Second, there is a system that uses a processor that realizes the functions of an entire system including multiple hardware resources that execute a specific process on a single IC chip, as typified by SoC (System-on-a-chip). In this way, a specific process is realized using one or more of the above-mentioned various processors as hardware resources.

[1936] Furthermore, the hardware structure of these various processors can be, more specifically, an electric circuit that combines circuit elements such as semiconductor devices. The specific processing described above is merely an example. Therefore, it goes without saying that unnecessary steps may be deleted, new steps may be added, or the processing order may be rearranged, without departing from the spirit of the invention.

[1937] The above-described description and illustrations are a detailed explanation of the parts related to the technology of the present disclosure and are merely an example of the technology of the present disclosure. For example, the above description of the configuration, functions, actions, and effects is an explanation of an example of the configuration, functions, actions, and effects of the parts related to the technology of the present disclosure. Therefore, it goes without saying that unnecessary parts may be deleted, new elements may be added, or replacements may be made to the above-described description and illustrations within the scope of the gist of the technology of the present disclosure. Furthermore, to avoid confusion and facilitate understanding of the parts related to the technology of the present disclosure, the above-described description and illustrations omit explanations of common technical knowledge that do not require particular explanation to enable the implementation of the technology of the present disclosure.

[1938] All publications, patent applications, and technical standards mentioned in this specification are herein incorporated by reference to the same extent as if each individual publication, patent application, or technical standard was specifically and individually indicated to be incorporated by reference.

[1939] The following is further disclosed regarding the above embodiment.

[1940] (Claim 1)

[1941] A system including a plurality of sensors and network devices for monitoring document usage,

[1942] a server means for receiving and storing document operation data in real time;

[1943] an artificial intelligence means for analyzing the received operation data and detecting abnormal behavior;

[1944] A system that includes management means to issue alerts and take management action when anomalous behavior is detected.

[1945] (Claim 2)

[1946] 2. The system according to claim 1, wherein the server means encrypts the operation data and receives it in real time.

[1947] (Claim 3)

[1948] 2. The system according to claim 1, wherein the artificial intelligence means analyzes the operation data, calculates a score for abnormal behavior, and determines that the behavior is abnormal if it exceeds a certain threshold.

[1949] "Example 1"

[1950] (Claim 1)

[1951] A system including a plurality of sensors and a network device,

[1952] an initial setting means for registering sensors and network devices and setting communication protocols;

[1953] a terminal setup means for installing client software and enabling real-time communication with the server;

[1954] a user registration means for registering a user account and setting authentication information and authority levels;

[1955] a document monitoring means for monitoring document operations when a user operates the document;

[1956] a data transmission means for encrypting the operation data and transmitting the encrypted data to a server in real time;

[1957] a database means for storing the received operation data;

[1958] artificial intelligence means for analyzing the received and stored operational data;

[1959] an anomaly detection means for analyzing operation patterns and detecting abnormal behavior;

[1960] a management means for issuing alerts and taking management actions when anomalous behavior is detected;

[1961] A learning mechanism that collects new operational data and continuously learns and improves;

[1962] A system including:

[1963] (Claim 2)

[1964] 10. The system of claim 1, wherein the operational data includes metadata and is stored in a database.

[1965] (Claim 3)

[1966] 2. The system according to claim 1, wherein the artificial intelligence means calculates an anomaly score for the operation data, and determines that the operation data is abnormal if the score exceeds a threshold.

[1967] "Application Example 1"

[1968] (Claim 1)

[1969] A system including a plurality of sensors and network devices for monitoring document usage,

[1970] a server means for receiving and storing document operation data and machine operation data based on the operation data in real time;

[1971] an artificial intelligence means for analyzing the received operation data and machine operation data and detecting abnormal behavior;

[1972] a management means for issuing alerts and taking management actions when anomalous behavior is detected;

[1973] a monitoring means for monitoring the operation of the industrial product and detecting abnormal behavior of the robot as abnormal behavior;

[1974] an encryption means for encrypting and transmitting the operation of the industrial product at regular intervals;

[1975] a control means for calculating a score of an abnormal operation of the industrial product and restricting the operation of the robot as a management action;

[1976] A system including:

[1977] (Claim 2)

[1978] 2. The system according to claim 1, wherein the server means encrypts the operation data and receives it in real time.

[1979] (Claim 3)

[1980] 2. The system according to claim 1, wherein the artificial intelligence means analyzes the operation data and the machine operation data to calculate a score for abnormal behavior, and determines that the behavior is abnormal if it exceeds a certain threshold.

[1981] "Example 2: Combining Emotion Engines"

[1982] The following is a rewritten version of the system that adds the characteristic features of the provided system to the claims.

[1983] ---

[1984] (Claim 1)

[1985] A system including a plurality of sensors and network devices for monitoring document usage,

[1986] a server means for receiving and storing document operation data and emotion data in real time;

[1987] an artificial intelligence means for analyzing the received operation data and emotion data and detecting abnormal behavior;

[1988] A system that includes management means to issue alerts and take management action when anomalous behavior is detected.

[1989] (Claim 2)

[1990] 2. The system according to claim 1, wherein the server means encrypts the operation data and emotion data and receives them in real time.

[1991] (Claim 3)

[1992] 2. The system according to claim 1, wherein the artificial intelligence means analyzes the operation data and emotion data to calculate a score for abnormal behavior, and determines that the behavior is abnormal if it exceeds a certain threshold.

[1993] "Application example 2 when combining emotion engines"

[1994] (Claim 1)

[1995] A system including a plurality of sensors and network devices for monitoring document usage,

[1996] a server means for receiving and storing document operation data and emotion data in real time;

[1997] an artificial intelligence means for analyzing the received operation data and emotion data and detecting abnormal behavior;

[1998] a management means for issuing alerts and taking management actions when anomalous behavior is detected;

[1999] emotion recognition means for analyzing a user's facial expression and voice and generating emotion data;

[2000] A system including:

[2001] (Claim 2)

[2002] 10. The system of claim 1, wherein the operational data and emotional data are encrypted and received in real time.

[2003] (Claim 3)

[2004] 2. The system according to claim 1, wherein the artificial intelligence means analyzes the operation data and emotion data to calculate a score for abnormal behavior, and determines that the behavior is abnormal if it exceeds a certain threshold. [Explanation of symbols]

[2005] 10, 210, 310, 410 Data Processing Systems 12 Data Processing Device 14 Smart Devices 214 Smart Glasses 314 Headset-type terminal 414 Robot< / url:> < / url:> < / url:> < / url:>

Claims

1. A system including a plurality of sensors and network devices for monitoring document usage, a server means for receiving and storing document operation data in real time; an artificial intelligence means for analyzing the received operation data and detecting abnormal behavior; A system that includes management means to issue alerts and take management action when anomalous behavior is detected.

2. 2. The system according to claim 1, wherein the server means encrypts the operation data and receives it in real time.

3. 2. The system according to claim 1, wherein the artificial intelligence means analyzes the operation data, calculates a score for abnormal behavior, and determines that the behavior is abnormal when it exceeds a certain threshold.

Images