system

Abstract

Provide a system. A generative AI-based anti-tool system, comprising: a means for installing an agent on a user terminal and running it in the background to monitor application operations and network traffic; means for encrypting and transmitting the monitoring data to a server; a means for analyzing the received data in real time using a generative AI model on a server to detect abnormal behavioral patterns; a means of notifying the user of detected anomalies and providing remedial action; A means to update the generative AI model based on new threat information and distribute automatic updates from the server to the device; A system including:

Description

[Technical Field]

[0001] The technology of the present disclosure relates to a system. [Background technology]

[0002] Patent document 1 discloses a persona chatbot control method performed by at least one processor, the method including the steps of receiving a user utterance, adding the user utterance to a prompt including an instruction sentence related to a description of the chatbot character, encoding the prompt, and inputting the encoded prompt into a language model to generate a chatbot utterance in response to the user utterance. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2022-180282 Summary of the Invention [Problem to be solved by the invention]

[0004] The recent widespread use of smartphones has increased security risks due to the installation of unauthorized applications and abnormal network traffic activity. There are also many cases where users are victims of these unauthorized activities without realizing it, or are unknowingly used as part of an attacker. Conventional antivirus software and security applications are often slow to respond to new threats, making real-time monitoring and response difficult. Given this background, safe and rapid countermeasures are required, but the technology to achieve them is lacking. Therefore, a system is needed that can monitor users' smartphones in real time, quickly notify them of any unauthorized use, and take appropriate action. [Means for solving the problem]

[0005] The present invention solves the above-mentioned problems by providing a generative AI-based anti-tool system. Specifically, the present invention is realized by the following means.

[0006] 1. A method of installing an agent on the user's device that runs in the background and monitors application behavior and network traffic.

[0007] 2. A means of encrypting and transmitting monitoring data to the server.

[0008] 3. A means of analyzing incoming data in real time using a generative AI model on a server to detect anomalous behavioral patterns.

[0009] 4. A means of notifying the user about detected anomalies and providing remedial action.

[0010] 5. A means to update the generative AI model based on new threat information and distribute automatic updates from the server to the device.

[0011] This allows users to enjoy high levels of security while ensuring safety without any special operations. Furthermore, the agent automatically cuts off network connections if the user does not take prompt action, minimizing damage caused by malicious activity. Furthermore, by encrypting the data during the transmission and analysis of monitoring data, communication between the server and the device can be kept safe.

[0012] "Generative AI" is a technology that uses machine learning and deep learning to analyze data and generate new patterns and models.

[0013] An "anti-tool system" is a collection of software and hardware used to detect and counter malicious activity and threats.

[0014] A "user terminal" is a mobile device such as a smartphone or tablet used by an individual user.

[0015] An "agent" is a program that is installed on a terminal and runs in the background to perform specific tasks and monitor the device.

[0016] "Running in the background" means that the process continues to run invisibly, independent of any visible user actions.

[0017] "Application operation" refers to the general operation of software programs running on smartphones and tablets.

[0018] "Network traffic" refers to the flow of data exchanged over a communications network.

[0019] "Monitoring" refers to the act of continuously observing specific data or behavior to detect malicious activity or anomalous behavior.

[0020] "Encryption" refers to the transformation of data with a secret key so that it can only be deciphered by authorized personnel.

[0021] A "server" is a computer system that provides services to client terminals via a network.

[0022] A "generative AI model" is a mathematical model that uses machine learning and deep learning to analyze data and generate new patterns and predictions.

[0023] "Real-time analysis" refers to the process of analyzing data immediately after it is input, obtaining results with little delay.

[0024] "Abnormal behavior" refers to data behavior that deviates from normal operations or traffic and is considered fraudulent or abnormal.

[0025] "Notification" refers to a message intended to inform a user about a particular event or action.

[0026] "Solution" refers to solutions and procedures for dealing with detected problems.

[0027] "Emerging threat intelligence" refers to the latest data and knowledge about new security risks and malicious behavior.

[0028] "Automatic updates" refers to the process by which a system or software automatically downloads and applies new versions or patches.

[0029] "Blocking network connectivity" means temporarily halting a device's access to the Internet or other networks.

[0030] "Keeping communications secure" means ensuring the confidentiality and integrity of communication data and preventing unauthorized access and data leaks. [Brief explanation of the drawings]

[0031] [Figure 1] 1 is a conceptual diagram showing an example of the configuration of a data processing system according to a first embodiment. [Figure 2] 1 is a conceptual diagram showing an example of main functions of a data processing device and a smart device according to a first embodiment. [Figure 3] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a second embodiment. [Figure 4] FIG. 10 is a conceptual diagram showing an example of main functions of a data processing device and smart glasses according to a second embodiment. [Figure 5] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a third embodiment. [Figure 6] FIG. 11 is a conceptual diagram showing an example of main functions of a data processing device and a headset-type terminal according to a third embodiment. [Figure 7]FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a fourth embodiment. [Figure 8] FIG. 10 is a conceptual diagram showing an example of main functions of a data processing device and a robot according to a fourth embodiment. [Figure 9] 1 shows an emotion map onto which multiple emotions are mapped. [Figure 10] 1 shows an emotion map onto which multiple emotions are mapped. [Figure 11] FIG. 3 is a sequence diagram showing a processing flow of the data processing system according to the first embodiment. [Figure 12] FIG. 10 is a sequence diagram showing the flow of processing in the data processing system in Application Example 1. [Figure 13] FIG. 10 is a sequence diagram showing the flow of processing in the data processing system according to the second embodiment when an emotion engine is combined. [Figure 14] FIG. 10 is a sequence diagram showing the flow of processing in the data processing system in Application Example 2 when an emotion engine is combined. DETAILED DESCRIPTION OF THE INVENTION

[0032] An example of an embodiment of a system according to the technology of the present disclosure will be described below with reference to the accompanying drawings.

[0033] First, the terms used in the following description will be explained.

[0034] In the following embodiments, a coded processor (hereinafter simply referred to as a "processor") may be a single arithmetic device or a combination of multiple arithmetic devices. Furthermore, a processor may be a single type of arithmetic device or a combination of multiple types of arithmetic devices. Examples of arithmetic devices include a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), a GPGPU (General-Purpose computing on Graphics Processing Units), and an APU (Accelerated Processing Unit).

[0035] In the following embodiments, a coded RAM (Random Access Memory) is a memory in which information is temporarily stored and is used as a working memory by a processor.

[0036] In the following embodiments, the coded storage is one or more non-volatile storage devices that store various programs, various parameters, etc. Examples of non-volatile storage devices include flash memory (SSD (Solid State Drive)), magnetic disks (e.g., hard disks), and magnetic tapes.

[0037] In the following embodiments, a communication I / F (Interface) with a symbol is an interface including a communication processor, an antenna, etc. The communication I / F controls communication between multiple computers. Examples of communication standards applied to the communication I / F include wireless communication standards including 5G (5th Generation Mobile Communication System), Wi-Fi (registered trademark), Bluetooth (registered trademark), etc.

[0038] In the following embodiments, "A and / or B" is synonymous with "at least one of A and B." In other words, "A and / or B" means that it may be only A, only B, or a combination of A and B. Furthermore, in this specification, the same concept as "A and / or B" is also applied when three or more things are expressed connected by "and / or."

[0039] [First embodiment]

[0040] FIG. 1 shows an example of the configuration of a data processing system 10 according to the first embodiment.

[0041] 1, a data processing system 10 includes a data processing device 12 and a smart device 14. An example of the data processing device 12 is a server.

[0042] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" according to the technology of the present disclosure. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0043] The smart device 14 includes a computer 36, a reception device 38, an output device 40, a camera 42, and a communication I / F 44. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The reception device 38, the output device 40, and the camera 42 are also connected to the bus 52.

[0044] The reception device 38 includes a touch panel 38A, a microphone 38B, and the like, and receives user input. The touch panel 38A detects contact with an indicator (for example, a pen or a finger) to receive user input by the touch of the indicator. The microphone 38B detects the user's voice to receive user input by voice. The control unit 46A transmits data indicating the user input received by the touch panel 38A and the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the data indicating the user input.

[0045] The output device 40 includes a display 40A and a speaker 40B, and presents data to the user 20 by outputting the data in a form of expression that the user 20 can perceive (for example, audio and / or text). The display 40A displays visible information such as text and images in accordance with instructions from the processor 46. The speaker 40B outputs audio in accordance with instructions from the processor 46. The camera 42 is a compact digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor.

[0046] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 control the exchange of various information between the processor 46 and the processor 28 via the network 54.

[0047] FIG. 2 shows an example of the main functions of the data processing device 12 and the smart device 14.

[0048] 2, in the data processing device 12, a specific process is performed by the processor 28. A specific processing program 56 is stored in the storage 32. The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific process is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0049] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0050] In the smart device 14, the processor 46 performs the reception output process. The storage 50 stores a reception output program 60. The reception output program 60 is used in conjunction with the specific processing program 56 by the data processing system 10. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output process is realized by the processor 46 operating as the control unit 46A in accordance with the reception output program 60 executed on the RAM 48.

[0051] Next, a description will be given of the specific processing performed by the specific processing unit 290 of the data processing device 12. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0052] The present invention relates to a generative AI-based anti-tool system that enhances security by installing an agent on a user's device to monitor, detect, notify, and respond to malicious activity in real time. Specific embodiments of the system will be described in detail.

[0053] System Components

[0054] 1. Terminal-side agent

[0055] Device: Install an agent program on your smartphone or tablet. The agent runs in the background of the device and monitors application activity and network traffic.

[0056] 2. Data Encryption and Transmission

[0057] Terminal: The monitoring data is encrypted and sent to the server using strong security protocols such as public key cryptography.

[0058] 3. Server-side generated AI models

[0059] Server: The generative AI model is placed on the server and performs real-time analysis of the received monitoring data. The generative AI model identifies fraudulent behavior patterns and detects anomalies.

[0060] 4. Anomaly detection and notification

[0061] Server: When an abnormality is detected, a summary of the abnormality and a solution are generated and notified to the user terminal via the agent.

[0062] 5. User Actions

[0063] User: Upon receiving the notification, the user should follow the instructions displayed and take measures such as uninstalling the malicious app or changing settings.

[0064] 6. Automatic Countermeasures

[0065] Terminal: If the user does not take prompt action, the agent will automatically take measures such as cutting off the network connection.

[0066] 7. System Updates

[0067] Server: Regularly updates the generative AI model based on new threat information to maintain the latest defense capabilities. Updated models are automatically distributed to devices.

[0068] Explanation of program processing

[0069] The program processing of the system will be explained in natural language below.

[0070] Operation of the terminal agent

[0071] On the device: Once the user installs the agent, it continuously monitors system activity, including application installations and network traffic. Because it runs as a background process independent of user actions, the user is unaware of the monitoring.

[0072] Data transmission and analysis

[0073] On the device: The monitored data is encrypted and sent to a server, including application activity logs and network traffic details.

[0074] Server: Inputs the received data into the generative AI model for real-time analysis, detecting abnormal behavioral patterns and identifying those deemed abnormal.

[0075] Anomaly detection and notification

[0076] Server: If an abnormality is detected, a message is generated to notify the user of the details and how to deal with the problem. For example, if a malicious application is detected, the message instructs the user to uninstall the application.

[0077] Device: The notification will pop up on the device screen, allowing the user to see what to do.

[0078] User actions and automatic measures

[0079] User: Upon receiving the notification, the user follows the instructions to uninstall the malicious app or change security settings.

[0080] Terminal: If the user does not take prompt action, the agent will automatically cut off the network connection, minimizing the impact of malicious activity.

[0081] System Updates

[0082] Server: Collects new threat information, trains and updates the generative AI model. Updates are performed periodically, and new models are automatically distributed to devices.

[0083] Device: When a new model is released, the agent automatically applies it, enabling the latest security measures.

[0084] Specific examples

[0085] Example 1: Installing a malicious app

[0086] 1. Device: Once a malicious app is installed, the application's behavior is recorded as monitoring data.

[0087] 2. Server: Receives the data and uses the generative AI model to detect fraudulent behavior and identify anomalies.

[0088] 3. Device: A notification is sent to the user, who receives a message saying "Malware detected."

[0089] 4. User: Follow the instructions to uninstall the malicious app.

[0090] Example 2: Anomalous Network Activity

[0091] 1. Terminal: When abnormal network activity is detected, the traffic data is recorded.

[0092] 2. Server: The AI ​​model analyzes the traffic data and identifies anomalies.

[0093] 3. Device: A notification is sent to the user, who receives a message saying "Anomalous network activity has been detected."

[0094] 4. User: Check your network settings and make any necessary corrections.

[0095] 5. Terminal: If the user does not respond promptly, the agent will automatically cut off the relevant network connection.

[0096] This allows users to enjoy high security and minimize the effort required to ensure the safety of their devices.The present invention is a system that keeps users' smartphones safe at all times by detecting fraudulent use early and taking prompt measures.

[0097] The processing flow will be explained below.

[0098] Step 1:

[0099] User: Download and install the anti-tool app from the smartphone app store. Once the installation is complete, launch the app to begin the initial setup.

[0100] Step 2:

[0101] Device: When the device is launched for the first time, the user is asked to set permissions (e.g., permission to use the app, permission to notify) so that the agent can start operating in the background.

[0102] Step 3:

[0103] User: Grant the necessary permissions and complete the setup. From then on, the agent will monitor in the background.

[0104] Step 4:

[0105] Device: The agent monitors application behavior and network traffic on the smartphone and periodically collects monitoring data.

[0106] Step 5:

[0107] On the device: The collected monitoring data is encrypted and periodically sent to a server using a secure encryption protocol, ensuring the data remains confidential.

[0108] Step 6:

[0109] Server: The server decodes the received monitoring data and performs real-time analysis using generative AI models to detect malicious behavior patterns and anomalies.

[0110] Step 7:

[0111] Server: When an anomaly is detected, it classifies the type and impact of the anomaly and generates a detailed report.

[0112] Step 8:

[0113] Server: Generates a message to notify the user about the detected abnormality and sends instructions to the device, including how to deal with the problem.

[0114] Step 9:

[0115] On the device: A message is received and displayed as a notification pop-up to the user, providing specific instructions to the user, such as "A malicious app has been detected. Please uninstall it."

[0116] Step 10:

[0117] User: Check the notification and follow the instructions to take necessary action, such as uninstalling the malicious app or changing settings.

[0118] Step 11:

[0119] Device: If the user does not take prompt action, the agent will automatically take measures such as cutting off the network connection to minimize the impact of malicious activity.

[0120] Step 12:

[0121] Server: Regularly updates and trains the generative AI model based on new threat information. By always maintaining the latest model, it is possible to respond quickly to new threats.

[0122] Step 13:

[0123] Server: Distributes updated generative AI models to devices, allowing the device agents to monitor and take countermeasures based on the latest information.

[0124] Step 14:

[0125] Devices: Automatically receive and apply new models, allowing users to enjoy the latest security measures without any special action.

[0126] Through the above processing steps, the present invention provides an advanced security system that monitors smartphones in real time, detects fraudulent use, and responds promptly.

[0127] Example 1

[0128] Next, a description will be given of Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0129] In today's digital environment, it is difficult to effectively monitor and counter the increasing threats of fraudulent behavior and data leaks in real time. To solve this problem, continuous monitoring of user devices, anomaly detection, and rapid response are essential, but this has been difficult to achieve with conventional systems. Automatic response is also necessary if users do not promptly address fraudulent behavior. Furthermore, regular updates to keep system security up to date is also a challenge.

[0130] The specific processing by the specific processing unit 290 of the data processing device 12 in the first embodiment is realized by the following means.

[0131] In this invention, the server includes: a means for installing an agent on a user's terminal and running it in the background to monitor application operation and network traffic; a means for encrypting the monitored data and transmitting it from the terminal to the server; a means for analyzing the received data in real time using a generative AI model on the server to detect abnormal behavioral patterns; a means for notifying the user of the detected abnormality and providing a solution; a means for updating the generative AI model based on new threat information and distributing automatic updates from the server to the terminal; a means for the agent to automatically disconnect the network connection if the user's action is delayed; and a means for the agent to send the terminal's system information and initial settings to the server and begin continuous monitoring. This enables real-time detection of fraudulent behavior and data leaks and prompt countermeasures. Furthermore, automatic response is also possible if the user does not respond promptly, and the latest security measures are always applied to the terminal, improving the security of the entire system.

[0132] "User terminal" refers to a computer device such as a smartphone or tablet used by a user.

[0133] An "agent" is a program that is installed on a user's device, runs in the background, and monitors device activity and network traffic.

[0134] "Running in the background" means that the program continues to run behind the system without affecting the user's operations.

[0135] "Application operation" refers to the execution state and behavior of a software program installed on a user terminal.

[0136] "Network traffic" refers to the flow of data sent and received between user terminals and other network devices.

[0137] "Monitoring data" refers to application operation logs and detailed network traffic information collected by the agent.

[0138] "Encryption" refers to the transformation of data using a specific algorithm to protect it from unauthorized access by third parties.

[0139] "Server" refers to the computer system that receives monitoring data, analyzes it, runs generative AI models, notifies and manages information.

[0140] A "generative AI model" refers to a system that uses artificial intelligence algorithms trained on large amounts of data to analyze data and detect patterns of fraudulent behavior.

[0141] "Abnormal behavior patterns" refer to unauthorized actions or unusual operations that deviate from normal behavior.

[0142] "Notification" means sending a warning to the user about a detected abnormality and how to deal with it, and is displayed on the terminal screen as a pop-up message or the like.

[0143] "Countermeasures" refer to specific steps or actions to correct a detected abnormality.

[0144] "Automatic update" refers to the automatic distribution and application of new versions of generative AI models from the server to user devices.

[0145] "Blocking network connections" refers to a measure to prevent potentially fraudulent behavior by halting network access by a user device.

[0146] "Initial settings" refers to the basic information and configuration of the device that the agent collects immediately after installation.

[0147] "Real-time" refers to a state in which processing and analysis are carried out immediately in real time.

[0148] This invention is a generative AI-based anti-tool system that enhances security by installing an agent on a user's device and monitoring, detecting, notifying, and responding to malicious activity in real time. Specific embodiments of this system will be described in detail.

[0149] Hardware and Software Configuration

[0150] 1. Terminal-side agent

[0151] Device: Install an agent program on your smartphone or tablet that runs in the background and monitors application activity and network traffic.

[0152] Agent app: Dedicated application software that users install.

[0153] 2. Data Encryption and Transmission

[0154] Terminal: The monitoring data is encrypted and sent to the server using a strong security protocol such as AES (Advanced Encryption Standard).

[0155] 3. Server-side generated AI models

[0156] Server: The generative AI model deployed on the server performs real-time analysis of the received monitoring data. The generative AI model identifies fraudulent behavior patterns and detects anomalies.

[0157] 4. Anomaly detection and notification

[0158] Server: When an abnormality is detected, a summary of the abnormality and a solution are generated and notified to the user terminal via the agent.

[0159] 5. User Actions and Automatic Countermeasures

[0160] Terminal: The user receives the notification and follows the instructions displayed to take countermeasures. If the user does not take prompt action, the agent will automatically cut off the network connection.

[0161] 6. System Updates

[0162] Server: Regularly updates the generative AI model based on new threat information to maintain the latest defense capabilities. Updated models are automatically distributed to devices.

[0163] Specific examples of processing

[0164] Example 1: Installing a malicious app

[0165] 1. Device: When a malicious app is installed, the agent records the application's behavior as monitoring data.

[0166] 2. Server: Inputs the received data into the generative AI model to detect fraudulent behavior and generates alerts when anomalies are identified.

[0167] 3. On the device: A notification is sent to the user with the message "Malware detected."

[0168] 4. User: Follow the instructions to uninstall the malicious app.

[0169] 5. Device: If the user does not respond promptly, the agent will automatically cut off communication for that app.

[0170] Example 2: Anomalous Network Activity

[0171] 1. Terminal: When abnormal network activity is detected, the agent records the traffic data.

[0172] 2. Server: The AI ​​model analyzes the traffic data and identifies anomalies.

[0173] 3. Device: A notification is sent to the user with the message "Anomalous network activity detected."

[0174] 4. User: Check your network settings and make any necessary corrections.

[0175] 5. Terminal: If the user does not respond promptly, the agent will automatically cut off the relevant network connection.

[0176] Prompt Sentence Examples

[0177] "Please tell me the program flow to determine whether a newly installed app is a malicious app or not and notify me."

[0178] "Please provide detailed instructions on what specific steps you will take if abnormal network activity is detected."

[0179] This invention allows users to enjoy high security and minimize the effort required to ensure the safety of their devices.The system keeps users' smartphones safe at all times by detecting fraudulent use early and taking prompt measures.

[0180] The flow of the identification process in the first embodiment will be described with reference to FIG.

[0181] Step 1: Install and initialize the agent

[0182] Device: The user installs the agent app on their smartphone or tablet. When the agent launches, it collects and encrypts the device's system information (e.g., OS version, device ID, list of installed applications). This encrypted data is then sent to the server.

[0183] Input: The user installs the agent app and starts its initialization.

[0184] Output: Encrypted device system information is sent to the server.

[0185] Step 2: Continuous monitoring of the device

[0186] On the device: The agent runs in the background, monitoring application behavior and network traffic in real time. If a newly installed app or unusual network activity is detected, details are recorded in a log.

[0187] Input: Application activity and network traffic on the device.

[0188] Output: Recorded as monitoring data and periodically sent to a server.

[0189] Step 3: Encrypt and send data

[0190] On the device: Collected monitoring data is encrypted using AES encryption. This data includes application activity logs and network traffic details. The encrypted data is then sent to a server for secure communication.

[0191] Input: Collected unencrypted surveillance data.

[0192] Output: Encrypted monitoring data is sent to the server.

[0193] Step 4: Data analysis by the server

[0194] Server: Decrypts the received encrypted data and inputs it into the generative AI model. The generative AI model analyzes the received data in real time and detects abnormal behavioral patterns. For example, if a specific app is sending or receiving an abnormally large amount of data, the generative AI model will determine that this is fraudulent behavior.

[0195] Input: Decoded surveillance data.

[0196] Output: Verification result of abnormal behavior pattern.

[0197] Step 5: Anomaly detection and user notification

[0198] Server: Generates detailed reports of detected anomalies and creates notification messages with solutions. The notification content includes a detailed description of the anomaly and recommended actions, and is sent to the device via the agent.

[0199] Device: A notification will appear as a pop-up on the device screen, informing the user that an anomaly has been detected.

[0200] Input: Abnormal behavior pattern determination result.

[0201] Output: The notification message sent to the user.

[0202] Step 6: User Coping Behavior

[0203] Users: Check the notification and follow the instructions to take measures such as uninstalling the malicious app or reviewing network settings. For example, if you receive a notification that a malicious app has been detected, uninstall the app.

[0204] Input: The notification message sent to the user.

[0205] Output: User action (e.g., uninstalling the app).

[0206] Step 7: Implementing automated measures

[0207] Terminal: If the user does not take action promptly, the agent will automatically take action, for example, if abnormal network activity continues, it will cut off the network connection to block the traffic.

[0208] Input: Situations where the user does not take action.

[0209] Output: The automatic action to be taken (e.g., blocking the network connection).

[0210] Step 8: Update the system and AI model

[0211] Server: Collects new threat information, trains and updates the generative AI model, and periodically updates the model, distributing the updated model to the device.

[0212] On the device: The agent automatically applies the new model, ensuring the latest security measures are in place.

[0213] Input: New threat information and a trained generative AI model.

[0214] Output: The latest generative AI model applied to the device.

[0215] This is the flow of program processing for this system, which allows users to enjoy high security and minimize the effort required to ensure the safety of their terminals.

[0216] (Application example 1)

[0217] Next, a description will be given of Application Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0218] Conventional security systems often have difficulty detecting malicious activity in real time, forcing users to manually implement countermeasures. This makes it difficult to minimize the impact of malicious behavior and poses a risk to the security of user devices. Furthermore, if users do not respond quickly, malicious behavior can lead to more serious problems, so a system that can quickly and automatically implement countermeasures is needed.

[0219] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 1 is realized by the following means.

[0220] In this invention, the server includes means for analyzing received data in real time using a generative AI model to detect abnormal behavioral patterns, means for notifying the user of the detected abnormality and providing a solution, and means for automatically uninstalling the malicious application or cutting off the network connection if the user does not take appropriate action. This makes it possible to detect fraudulent behavior in real time and implement countermeasures quickly and automatically.

[0221] An "agent" is software that is installed on a user's terminal and runs in the background to monitor application operations and network traffic.

[0222] A "generative AI model" is an artificial intelligence model that runs on a server and analyzes monitoring data sent from user devices in real time to detect abnormal behavioral patterns.

[0223] "Encryption" is a technology that converts monitoring data so that it cannot be deciphered by third parties, enabling the secure transmission of data.

[0224] An "anomalous behavior pattern" is a pattern indicative of unexpected or unauthorized system behavior or network traffic.

[0225] A "notification" is a message that provides the user with information about a detected abnormality and instructs them on how to deal with it.

[0226] "Network disconnection" is a procedure in which a user terminal is temporarily disconnected from the Internet or other networks when fraudulent activity is detected.

[0227] An "update" is an update procedure that allows the system to improve the generative AI model based on new threat information and provide new defensive capabilities to the device.

[0228] "Malicious applications" are applications that may cause harm to user devices and are often installed from sources other than legitimate stores.

[0229] This invention relates to a generative AI-based anti-tool system that installs an agent on a user's device to monitor, detect, notify, and respond to malicious activity in real time. This system works particularly effectively on smartphones.

[0230] System Components

[0231] 1. Terminal-side agent

[0232] An agent is installed on the user's device (smartphone). The agent runs in the background and continuously monitors application activity and network traffic. Because it runs as a background process independent of user actions, the user is unaware of the monitoring.

[0233] 2. Data Encryption and Transmission

[0234] The agents collect monitoring data and send it to a server in an encrypted form using strong security protocols such as public key cryptography.

[0235] 3. Server-side generated AI models

[0236] The generative AI model is placed on the server and performs real-time analysis of the received monitoring data. The generative AI model identifies fraudulent behavior patterns and detects anomalies.

[0237] 4. Anomaly detection and notification

[0238] When an abnormality is detected on the server, a summary of the problem and a solution are generated and sent to the user's device via the agent. The notification is displayed as a pop-up on the device screen, allowing the user to check the solution.

[0239] 5. Automatic Countermeasures

[0240] If the user does not respond promptly, the agent will automatically take measures such as cutting off the network connection or uninstalling the malicious application.

[0241] 6. System Updates

[0242] The server periodically updates the generative AI model based on new threat information to maintain up-to-date defense capabilities, and the updated model is automatically distributed to devices.

[0243] Example of a system

[0244] Example 1: Detecting the installation of fraudulent apps

[0245] 1. Terminal-side agent

[0246] When a user installs a malicious app, the application's behavior is recorded as monitoring data.

[0247] 2. Data Encryption and Transmission

[0248] The monitoring data is encrypted and sent to a server.

[0249] 3. Server-side generated AI models

[0250] Generative AI models analyze data in real time to detect fraudulent behavior.

[0251] 4. Anomaly detection and notification

[0252] The server detects the abnormality and notifies the user device that a malicious app has been detected. The user is then instructed to uninstall the malicious app.

[0253] 5. Automatic Countermeasures

[0254] If the user does not take immediate action, the agent will automatically uninstall the malicious app.

[0255] Example 2: Detecting anomalous network activity

[0256] 1. Terminal-side agent

[0257] When abnormal network activity is detected, the traffic data is recorded.

[0258] 2. Data Encryption and Transmission

[0259] The traffic data is encrypted and sent to the server.

[0260] 3. Server-side generated AI models

[0261] AI models analyze traffic data and identify anomalous activity.

[0262] 4. Anomaly detection and notification

[0263] When an anomaly is detected, a notification is sent to the user device stating that "anomalous network activity has been detected." The user is then instructed to check their network settings and make any necessary corrections.

[0264] 5. Automatic Countermeasures

[0265] If the user does not respond promptly, the agent will automatically cut off the relevant network connection.

[0266] Prompt Sentence Examples

[0267] "A malicious application has been detected. Please uninstall it immediately."

[0268] "Abnormal network traffic has been detected. Please check your network settings."

[0269] This allows users to enjoy high security and minimize the effort required to ensure the safety of their devices.The present invention provides a means to keep users' smartphones safe at all times by detecting fraudulent behavior early and taking prompt measures.

[0270] The flow of the specific processing in the application example 1 will be described with reference to FIG.

[0271] Step 1:

[0272] Installing and initializing the terminal agent

[0273] Input: Application installation request

[0274] Operation: The user installs the agent on the device and performs the initial setup. The agent then starts running in the background, ready to monitor application activity and network traffic regardless of user interaction.

[0275] Output: The status of the agent running in the background

[0276] Step 2:

[0277] Starting the virus detection process

[0278] Input: Execution by terminal agent

[0279] How it works: The agent continuously monitors applications running on the device and network traffic, collecting data to detect malicious activity.

[0280] Output: Application operation log, network traffic data

[0281] Step 3:

[0282] Encrypting data and sending it to the server

[0283] Input: Application operation logs, network traffic data

[0284] How it works: Collected data is encrypted using public key cryptography and securely sent to a server.

[0285] Output: Encrypted monitoring data

[0286] Step 4:

[0287] Analysis using server-side generated AI models

[0288] Input: Encrypted surveillance data

[0289] How it works: A server-based generative AI model receives surveillance data, decodes it, and analyzes it in real time to detect anomalous behavioral patterns.

[0290] Output: Abnormal behavior pattern detection results

[0291] Step 5:

[0292] Anomaly detection and user notification

[0293] Input: Abnormal behavior pattern detection results

[0294] Operation: The server generates a notification message containing a detailed explanation of the detected anomaly and how to resolve it, and sends it to the user's device via the agent.

[0295] Output: A message to inform the user

[0296] Step 6:

[0297] User Action

[0298] Input: Notification message

[0299] How it works: The user receives a notification message and follows the instructions to uninstall the malicious app and fix their network settings.

[0300] Output: User action

[0301] Step 7:

[0302] Implementing automatic countermeasures

[0303] Input: Detection when no countermeasures are taken by the user

[0304] How it works: If the user does not take action quickly enough, the agent will automatically block network connections and uninstall the malicious application.

[0305] Output: Blocking network connections, uninstalling malicious applications

[0306] Step 8:

[0307] System Updates

[0308] Input: New threat information

[0309] How it works: The server collects new threat information, trains and updates the generative AI model, and periodically pushes the updated model to the device and applies it automatically.

[0310] Output: Delivery and application of updated generative AI models

[0311] Furthermore, an emotion engine that estimates the user's emotion may be combined. That is, the identification processing unit 290 may estimate the user's emotion using the emotion identification model 59 and perform identification processing using the user's emotion.

[0312] This invention combines a generative AI-based anti-tool system with an emotion engine that recognizes user emotions, and is a system for strengthening the security of smartphones and tablets. Specifically, an agent installed on the user's device monitors application behavior and network traffic, and uses the emotion engine to take appropriate action based on the user's emotional state.

[0313] System Components

[0314] 1. Terminal-side agent

[0315] Terminal: An agent program is installed on the user's terminal and runs in the background. The agent monitors application activity and network traffic.

[0316] 2. Data Encryption and Transmission

[0317] Terminal: The agent encrypts the collected monitoring data and periodically sends it to the server.

[0318] 3. Server-side generated AI models

[0319] Server: Analyzes incoming data in real time using generative AI models to detect fraudulent behavioral patterns and anomalies.

[0320] 4. Anomaly detection and notification

[0321] Server: Based on the detected abnormality, a message including a solution is generated and sent to the device.

[0322] 5. Emotion Engine

[0323] Device: The emotion engine analyzes the user's voice, facial expressions, input patterns, etc. to recognize the user's emotional state.

[0324] 6. Emotion-Based Notification Adjustment

[0325] On the device: Based on the analysis results of the emotion engine, the content and frequency of notifications are adjusted according to the user's emotional state. For example, if the user is in a state of high stress, the content of notifications will be simplified and the countermeasures will be changed to something that is intuitively understandable.

[0326] 7. User and Automatic Countermeasures

[0327] User: Follow the notification and take the appropriate action.

[0328] Device: If the user does not respond promptly, measures such as automatically cutting off the network connection will be taken.

[0329] 8. System Updates

[0330] Server: Regularly updates the generative AI model based on new threat information and delivers automatic updates to devices.

[0331] Explanation of program processing

[0332] The program processing of the system will be explained in natural language below.

[0333] Operation of the terminal agent

[0334] On the device: After the user installs the agent, it monitors application activity and network traffic, collecting monitoring data that is then encrypted and sent to a server.

[0335] Data transmission and analysis

[0336] Server: Inputs the received data into the generative AI model and performs real-time analysis. If an abnormal behavioral pattern is detected, a detailed report is generated and sent to the device along with countermeasures.

[0337] Emotion Engine Operation

[0338] Device: The emotion engine analyzes data such as the user's voice and facial expressions in real time to recognize the user's emotional state.

[0339] Emotion-based notification adjustment

[0340] Device: Adjust the content and frequency of notifications based on the user's emotional state. For example, if the user is stressed, notifications will be displayed in a simple and understandable way.

[0341] User actions and automatic measures

[0342] User: Follow the notification and uninstall the malicious app or change your network settings.

[0343] Device: If the user does not respond quickly, the agent will automatically cut off the network connection, minimizing the impact of malicious activity.

[0344] System Updates

[0345] Server: Trains generative AI models based on new threat information and distributes the latest versions to devices.

[0346] Device: Automatically applies updates to keep your security up to date.

[0347] Specific examples

[0348] Example 1: Installing a malicious app

[0349] 1. Device: Once a malicious app is installed, the agent monitors its behavior and collects data.

[0350] 2. Server: Generative AI models detect fraudulent behavior and identify anomalies.

[0351] 3. On the device: The emotion engine analyzes the user's emotional state and, for example, if they are feeling stressed, it will display a simplified notification.

[0352] 4. User: Follow the instructions and uninstall the malicious app.

[0353] Example 2: Anomalous Network Activity

[0354] 1. Terminal: When abnormal network activity is detected, traffic data is collected.

[0355] 2. Server: The generative AI model analyzes the data and identifies anomalies.

[0356] 3. On the device: The emotion engine analyzes the user's emotional state and sends detailed notifications if the user is relaxed.

[0357] 4. User: Follow the notification and change your network settings.

[0358] 5. Device: If the user does not take prompt action, the device will automatically shut down the network connection.

[0359] In this way, by combining a generative AI-based anti-tool system with an emotion engine, the present invention realizes flexible notifications and responses that take into account the user's emotional state, allowing users to enjoy a stress-free operating experience while maintaining high security.

[0360] The processing flow will be explained below.

[0361] Step 1:

[0362] User: Download and install the anti-tool app from the smartphone app store. Once the installation is complete, launch the app to begin the initial setup.

[0363] Step 2:

[0364] Device: When the device is launched for the first time, the user is asked to set permissions (e.g., permission to use the app, permission to notify) so that the agent can start operating in the background.

[0365] Step 3:

[0366] User: Grant the necessary permissions and complete the setup. From then on, the agent will monitor in the background.

[0367] Step 4:

[0368] Device: The agent monitors application behavior and network traffic on the smartphone and periodically collects monitoring data.

[0369] Step 5:

[0370] On the device: The collected monitoring data is encrypted and periodically sent to a server using a secure encryption protocol, ensuring the data remains confidential.

[0371] Step 6:

[0372] Server: The server decodes the received monitoring data and performs real-time analysis using generative AI models to detect malicious behavior patterns and anomalies.

[0373] Step 7:

[0374] Server: When an anomaly is detected, it classifies the type and impact of the anomaly and generates a detailed report.

[0375] Step 8:

[0376] Server: Generates a message to notify the user about the detected abnormality and sends instructions to the device, including how to deal with the problem.

[0377] Step 9:

[0378] On the device: A message is received and displayed as a notification pop-up to the user, providing specific instructions to the user, such as "A malicious app has been detected. Please uninstall it."

[0379] Step 10:

[0380] Device: The emotion engine analyzes the user's voice, facial expressions, and input patterns in parallel to recognize the user's emotional state.

[0381] Step 11:

[0382] Device: Adjust the content and frequency of notifications based on the user's emotional state. For example, if the user is in a stressful state, the notification content will be simplified and the solution will be more intuitive.

[0383] Step 12:

[0384] User: Check the notification and follow the instructions to take necessary action, such as uninstalling the malicious app or changing settings.

[0385] Step 13:

[0386] Device: If the user does not take prompt action, the agent will automatically take measures such as cutting off network connections to minimize the impact of malicious activity.

[0387] Step 14:

[0388] Server: Regularly updates and trains the generative AI model based on new threat information. By always maintaining the latest model, it is possible to respond quickly to new threats.

[0389] Step 15:

[0390] Server: Distributes updated generative AI models to devices, allowing the device agents to monitor and take countermeasures based on the latest information.

[0391] Step 16:

[0392] Devices: Automatically receive and apply new models, allowing users to enjoy the latest security measures without any special action.

[0393] By combining the above processing steps with an emotion engine, the present invention realizes flexible notification and response that takes into account the user's emotional state, allowing users to enjoy high security and a stress-free operating experience.

[0394] Example 2

[0395] Next, a description will be given of Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0396] While modern smartphones and tablets offer convenience and many applications and network services, they are also facing increasing threats such as malicious applications, phishing, and malware. This creates a need for high levels of device security, but conventional systems have struggled to respond flexibly and take into account the user's emotional state. The present invention aims to address these issues.

[0397] The identification process by the identification processing unit 290 of the data processing device 12 in the second embodiment is realized by the following means. In this invention, the server includes means for installing an agent on a user terminal and running it in the background to monitor application operations and network traffic, means for encrypting the monitored data and transmitting it to the server, means for analyzing received data in real time using a generative AI model on the server and detecting abnormal behavioral patterns, means for notifying the user of the detected abnormality and providing a solution, and means for analyzing the user's voice, facial expressions, and input patterns using an emotion engine and adjusting the content and frequency of notifications based on the user's emotional state. This enables flexible and advanced security measures that take the user's emotional state into consideration.

[0398] An "agent" is software that is installed on a user's terminal, runs in the background, and monitors application operations and network traffic.

[0399] "Monitoring Data" refers to application operation information and network traffic information collected by the Agent.

[0400] A "generative AI model" is an artificial intelligence-based analytical model that analyzes incoming data in real time and detects abnormal behavioral patterns.

[0401] A "notification" is a message that notifies the user of an abnormality detected by the server and provides a solution to the problem.

[0402] An "emotion engine" is software that analyzes a user's voice, facial expressions, and input patterns to recognize the user's emotional state.

[0403] "Encryption" refers to the process of converting surveillance data into a format that cannot be deciphered by third parties.

[0404] "Blocking network connectivity" refers to temporarily disabling a device's network access to prevent fraudulent trading activity or attacks.

[0405] "Automatic updates" refers to the process of delivering the latest security measures based on new threat information from a server to a device and automatically applying the updates.

[0406] This invention is an anti-tool system that uses a generative AI model and realizes more flexible and advanced security measures by taking into account the user's emotional state. This system is installed on the user's device, such as a smartphone or tablet, and constantly runs in the background to monitor security.

[0407] A specific embodiment of the present invention will now be described.

[0408] Required Hardware and Software

[0409] Hardware: Mobile devices such as smartphones and tablets

[0410] software:

[0411] Agent program: Installed on the user's terminal, it monitors application behavior and network traffic.

[0412] Generative AI model: Uses a deep learning model based on ResNet to detect anomalous behavioral patterns.

[0413] Emotion engine: Utilizes OpenFace and IBM Watson (registered trademark) emotion analysis engines to analyze the user's emotional state.

[0414] Backend servers: Hosted on AWS (registered trademark) EC2 or Google (registered trademark) Cloud Platform.

[0415] System Overview

[0416] An agent program is installed on the device and runs in the background to monitor application behavior and network traffic. The monitored data is AES-256 encrypted and sent to a server. On the server, the data is analyzed by a generative AI model, and if an abnormality is detected, a detailed report is generated and the user is notified along with how to deal with it. An emotion engine then analyzes the user's emotional state and determines the appropriate notification method based on that state.

[0417] Specific example explanation

[0418] Example 1: Installing a malicious app

[0419] 1. Device: Once a malicious app is installed, the agent monitors its behavior and collects data.

[0420] 2. Server: The generative AI model analyzes the incoming data and detects fraudulent behavior.

[0421] 3. On the device: The emotion engine analyzes the user's emotional state and displays simplified notifications if the user is feeling stressed.

[0422] 4. User: Follow the instructions and uninstall the malicious app.

[0423] Example 2: Anomalous Network Activity

[0424] 1. Terminal: Anomalous network activity is detected and traffic data is collected.

[0425] 2. Server: The generative AI model analyzes the data and identifies anomalies.

[0426] 3. On the device: The emotion engine analyzes the user's emotional state and sends detailed notifications if the user is relaxed.

[0427] 4. User: Follow the notification and change your network settings.

[0428] 5. Device: If the user does not take prompt action, the device will automatically shut down the network connection.

[0429] Prompt Sentence Examples

[0430] 1. Generate an explanation of a system that combines generative AI-based anti-tools with an emotional engine to enhance the security of smartphones and tablets.

[0431] 2. Describe how an agent installed on a user device can monitor application behavior and network traffic, encrypt collected data, and send it to a server for real-time analysis using a generative AI model.

[0432] Through these specific examples, the present invention can realize flexible security measures that take into account the emotional state of the user, thereby maintaining a high level of security for the terminal.

[0433] The flow of the identification process in the second embodiment will be described with reference to FIG.

[0434] Specific explanation of program processing

[0435] Step 1: Install and start the agent

[0436] On the device, the user installs the agent program and it starts running in the background. Once installed, the agent runs as a system process and, with the user's permission, begins monitoring application activity and network traffic.

[0437] Input: Agent installation file

[0438] Output: The agent starts running in the background.

[0439] Step 2: Monitor application behavior and network traffic

[0440] On the device, the agent monitors the behavior of installed applications and network traffic in real time. For example, when a new application is installed, it collects the application's communication details, CPU usage, memory usage, etc.

[0441] Input: Application behavior data and network traffic data

[0442] Output: Monitoring data collection (log file)

[0443] Step 3: Encrypt monitoring data

[0444] Terminal: Collected monitoring data is encrypted with AES-256. Specifically, the encryption process is performed on each batch of collected data once it reaches a certain size.

[0445] Input: Monitoring data

[0446] Output: Encrypted data

[0447] Step 4: Sending monitoring data to the server

[0448] Terminal: Periodically send encrypted data to the server. For example, every 10 minutes, upload the encrypted data to the server using the HTTPS protocol.

[0449] Input: Encrypted data

[0450] Output: Data sent to the server

[0451] Step 5: Receiving and Decrypting Data

[0452] Server: Receives the data sent from the device and decrypts it using AES-256. Specifically, the server passes the received data to a dedicated decryption module, which returns it to its original data format.

[0453] Input: Encrypted data

[0454] Output: Decrypted data

[0455] Step 6: Parse the received data

[0456] Server: The decrypted data is fed into the generative AI model for real-time analysis. This analysis includes detecting anomalous behavioral patterns. For example, if the model detects specific fraudulent activity in the data, it generates an anomaly report.

[0457] Input: Decrypted surveillance data

[0458] Output: Anomalous behavior report

[0459] Step 7: Anomaly detection and notification generation

[0460] Server: When the generative AI model detects an anomaly, it generates a detailed report and countermeasures and notifies the device. Specifically, it creates a notification containing a warning message and countermeasures based on the abnormal behavior report.

[0461] Input: Anomalous Behavior Report

[0462] Output: Information message

[0463] Step 8: Emotional state analysis by the emotion engine

[0464] Device: The emotion engine analyzes the user's voice, facial expressions, and input patterns in real time to assess the user's emotional state. Specifically, the emotion engine analyzes the user's actions, such as speaking to the screen, typing, and looking at the facial recognition camera.

[0465] Input: User voice, facial expressions, and input patterns

[0466] Output: Emotional state data

[0467] Step 9: Adjust notifications based on emotion

[0468] Device: Based on the analysis results of the emotion engine, the content and frequency of notifications are set appropriately according to the user's emotional state. For example, if the emotion engine determines that the user is feeling stressed, the content of notifications will be simplified and the frequency of notifications will be reduced.

[0469] Input: Emotional state data, notification message

[0470] Output: The adjusted notification message

[0471] Step 10: User actions and automated measures

[0472] Users: Follow the notification message and take appropriate measures such as uninstalling the malicious app or changing network settings. For example, follow the instructions to delete the app if it says "A malicious app has been detected on your device. Please uninstall it."

[0473] Input: Notification message

[0474] Output: Response action

[0475] Terminal: If the user does not respond promptly, the agent will automatically cut off the network connection, for example, by taking an action such as "The network connection has been temporarily cut off."

[0476] Input: User response delay

[0477] Output: Automatic countermeasure execution

[0478] Step 11: Update your system

[0479] Server: Trains the generative AI model based on new threat information and delivers the latest security information to devices. For example, it updates the model once a week and delivers security patches.

[0480] Input: New threat information

[0481] Output: Updated generative AI model, security patches

[0482] Device: Automatically apply received updates to keep your security up to date.

[0483] Input: security patch

[0484] Output: Updated security state

[0485] The above is a detailed description of the specific processing flow in the system of the present invention. The intention is that a series of processes for highly protecting user terminals will be executed rationally and effectively.

[0486] (Application example 2)

[0487] Next, a description will be given of Application Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the smart device 14 will be referred to as a "terminal."

[0488] While conventional security systems have the ability to monitor user device operation and network traffic and detect abnormalities, they do not provide notifications and responses that take into account the user's psychological state. As a result, even when users are in a state of high stress, they receive complex notifications and are unable to take appropriate action. This can result in ineffective measures being taken in situations where a quick response is required.

[0489] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 2 is realized by the following means.

[0490] In this invention, the server is a generative AI-based anti-tool system that includes: means for installing an agent on a user terminal and running it in the background to monitor application operation and network traffic; means for encrypting the monitored data and transmitting it to the server; means for analyzing the received data in real time using a generative AI model on the server to detect abnormal behavioral patterns; means for notifying the user of the detected abnormality and providing countermeasures; means for adjusting the content and frequency of notifications using an emotion engine that analyzes the user's emotions; and means for updating the generative AI model based on new threat information and distributing automatic updates from the server to the terminal. This enables flexible notifications and responses that take the user's psychological state into consideration, and promotes appropriate responses in high-stress situations.

[0491] A "generative AI model" is an artificial intelligence model that performs real-time analysis using data collected from user devices to detect fraudulent behavioral patterns and anomalies.

[0492] An "anti-tool system" is a system that monitors applications and network traffic on user terminals to detect unauthorized behavior and abnormalities.

[0493] An "agent" is a program that is installed on a user's terminal and runs in the background to monitor application operations and network traffic.

[0494] "Encryption" is a technology that prevents surveillance data from being deciphered by third parties by converting the data using a specific algorithm.

[0495] The "emotion engine" is a system that analyzes data such as the user's voice, facial expressions, and input patterns to recognize the user's emotional state in real time.

[0496] "Means" are methods or techniques for achieving a specific purpose.

[0497] The "server" is a central control device that analyzes data, detects anomalies, updates generative AI models, and sends notifications.

[0498] "Background" means that the system operates automatically behind the scenes, invisible to the user.

[0499] "Network traffic" refers to the transmission and reception of data between a user terminal and the Internet or other network.

[0500] A "notification" is a message or instruction that is displayed to the user when an abnormality is detected.

[0501] "Automatic updates" refers to a function that regularly updates the generative AI model based on new threat information and delivers the latest version to the user's device.

[0502] MODE FOR CARRYING OUT THE INVENTION

[0503] This invention combines a generative AI-based anti-tool system with an emotion engine that recognizes user emotions, and is a system for strengthening the security of smartphones and tablets. Specifically, an agent installed on the user's device monitors application behavior and network traffic, and uses the emotion engine to take appropriate action based on the user's emotional state.

[0504] System Components

[0505] 1. Terminal-side agent

[0506] Terminal: An agent program is installed on the user's terminal and runs in the background. The agent monitors application activity and network traffic, encrypts the monitored data, and temporarily stores it in SQLite.

[0507] 2. Data Encryption and Transmission

[0508] Terminal: The monitoring data collected by the agent is encrypted using the AES algorithm and periodically sent to the server via HTTP communication.

[0509] 3. Server-side generated AI models

[0510] Server: The server uses TENSORFLOW® to build a generative AI model and analyze incoming data in real time, detecting fraudulent behavior patterns and anomalies, and generating detailed reports using a Flask application.

[0511] 4. Anomaly detection and notification

[0512] Server: Based on the detected abnormality, a message including a solution is generated and sent to the device.

[0513] 5. Emotion Engine

[0514] On the device: The emotion engine uses OpenCV to analyze the user's voice and facial expressions, and Librosa to analyze the voice data, thereby recognizing the user's emotional state in real time.

[0515] 6. Emotion-Based Notification Adjustment

[0516] On the device: Based on the analysis results of the emotion engine, the content and frequency of notifications are adjusted according to the user's emotional state. For example, if the user is in a state of high stress, the content of notifications will be simplified and the countermeasures will be changed to something that is intuitively understandable.

[0517] 7. User and Automatic Countermeasures

[0518] User and device: The user takes the appropriate action based on the notification. If the user does not respond promptly, the agent will automatically take measures such as cutting off the network connection.

[0519] 8. System Updates

[0520] Server and device: The server trains the generative AI model based on new threat information and distributes the latest version to the device, which then automatically applies updates to maintain the latest security measures.

[0521] Specific examples

[0522] Example 1: Installing a malicious app

[0523] 1. Device: Once a malicious app is installed, the agent monitors its behavior and collects data.

[0524] 2. Server: Generative AI models detect fraudulent behavior and identify anomalies.

[0525] 3. On the device: The emotion engine analyzes the user's emotional state and displays simplified notifications if the user is in a high-stress state.

[0526] 4. User: Follow the instructions and uninstall the malicious app.

[0527] Example 2: Anomalous Network Activity

[0528] 1. Terminal: When abnormal network activity is detected, traffic data is collected.

[0529] 2. Server: The generative AI model analyzes the data and identifies anomalies.

[0530] 3. On the device: The emotion engine analyzes the user's emotional state and sends detailed notifications if the user is relaxed.

[0531] 4. User: Follow the notification and change your network settings.

[0532] 5. Device: If the user does not take prompt action, the device will automatically shut down the network connection.

[0533] Prompt Sentence Examples

[0534] "Detect malicious behavior in user network traffic and generate notifications based on the results. Simplify notifications if users are in a high-stress state."

[0535] As described above, by combining a generative AI-based anti-tool system with an emotion engine, this invention realizes flexible notification and response that takes into account the user's emotional state, allowing users to enjoy a stress-free operating experience while maintaining high security.

[0536] The flow of the specific processing in the application example 2 will be described with reference to FIG.

[0537] Step 1:

[0538] Terminal: An agent is installed on the user's terminal and runs in the background.

[0539] Input: An agent program is installed on the user terminal.

[0540] Action: The agent starts running in the background immediately after installation, monitoring the behavior of applications and network traffic on the device.

[0541] Output: Obtain application behavior data and network traffic data.

[0542] Step 2:

[0543] Terminal: Encrypts the monitoring data and sends it to the server.

[0544] Input: Application behavior data and network traffic data obtained in step 1.

[0545] Processing: The agent encrypts the monitoring data using the AES algorithm and periodically sends it to the server using HTTP communication.

[0546] Output: Encrypted monitoring data is sent to the server.

[0547] Step 3:

[0548] Server: Analyzes incoming data in real time using a generative AI model to detect abnormal behavioral patterns.

[0549] Input: Encrypted surveillance data sent from the device.

[0550] Processing: Decrypting encrypted data and feeding it into generative AI models using TensorFlow for real-time analysis to detect fraudulent behavioral patterns and anomalies.

[0551] Output: If an anomaly is detected, a detailed report is generated.

[0552] Step 4:

[0553] Server: Notifies the user of any detected anomalies and provides solutions.

[0554] Input: The anomaly details report generated in step 3.

[0555] Action: Use a Flask application to generate a notification for the user based on a detailed report of the anomaly. Send a message to the device with instructions on how to resolve the issue.

[0556] Output: A notification message containing a remedy is sent to the user's terminal.

[0557] Step 5:

[0558] Terminal: Analyzes the user's emotional state using an emotion engine.

[0559] Input: Data on the user's voice, facial expressions, and input patterns.

[0560] Processing: By using OpenCV to analyze facial expressions from camera input and Librosa to analyze audio data, the user's emotional state is recognized in real time.

[0561] Output: The user's emotional state (e.g., high stress, relaxed) is obtained as the analysis result.

[0562] Step 6:

[0563] Device: Adjust the content and frequency of notifications based on the analysis results of the emotion engine.

[0564] Input: A notification message containing the user's emotional state obtained in step 5 and the coping strategies provided in step 4.

[0565] Processing: Based on the analysis results of the emotion engine, the notification content is formatted according to the user's emotional state. For example, if the user is in a high-stress state, the notification will be simplified.

[0566] Output: A customized notification is displayed depending on the user's emotional state.

[0567] Step 7:

[0568] Users and devices: Based on notifications, the system takes the appropriate measures and automatically cuts off network connections if necessary.

[0569] Input: The notification message customized in step 6.

[0570] Action: The user takes corrective action based on the notification. If the user does not take action promptly, the agent automatically cuts off the network connection.

[0571] Output: Network connectivity is cut off, minimizing the impact of malicious activity.

[0572] Step 8:

[0573] Server and device: The generative AI model is updated based on new threat information and automatically distributed to the device.

[0574] Input: New threat information and existing generative AI models.

[0575] Processing: Trains generative AI models based on new threat information and delivers the latest version to devices, which automatically apply the received updates.

[0576] Output: Updated generative AI models and the latest security measures are applied to the device.

[0577] The specific processing unit 290 transmits the result of the specific processing to the smart device 14. In the smart device 14, the control unit 46A causes the output device 40 to output the result of the specific processing. The microphone 38B acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0578] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (registered trademark) (Internet search engine).<URL: https: / / openai.com / blog / chatgpt> ), Gemini (registered trademark) (Internet search <url: https: gemini.google.com ?hl="ja">) and other generation AIs. The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating voice, text data indicating text, and image data indicating an image is also input. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt, and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0579] In the above embodiment, an example in which the specific process is performed by the data processing device 12 has been given, but the technology of the present disclosure is not limited to this, and the specific process may be performed by the smart device 14.

[0580] [Second embodiment]

[0581] FIG. 3 shows an example of the configuration of a data processing system 210 according to the second embodiment.

[0582] 3, the data processing system 210 includes the data processing device 12 and smart glasses 214. An example of the data processing device 12 is a server.

[0583] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" according to the technology of the present disclosure. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0584] The smart glasses 214 include a computer 36, a microphone 238, a speaker 240, a camera 42, and a communication I / F 44. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, and the camera 42 are also connected to the bus 52.

[0585] The microphone 238 receives instructions and the like from the user 20 by receiving voice uttered by the user 20. The microphone 238 captures the voice uttered by the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio in accordance with instructions from the processor 46.

[0586] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the surroundings of user 20 (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[0587] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[0588] Fig. 4 shows an example of the main functions of the data processing device 12 and the smart glasses 214. As shown in Fig. 4, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0589] The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0590] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0591] In the smart glasses 214, the reception output process is performed by the processor 46. A reception output program 60 is stored in the storage 50. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output process is realized by the processor 46 operating as the control unit 46A in accordance with the reception output program 60 executed on the RAM 48.

[0592] Next, a description will be given of the identification process performed by the identification processing unit 290 of the data processing device 12. In the following description, the data processing device 12 will be referred to as the "server" and the smart glasses 214 will be referred to as the "terminal."

[0593] The present invention relates to a generative AI-based anti-tool system that enhances security by installing an agent on a user's device to monitor, detect, notify, and respond to malicious activity in real time. Specific embodiments of the system will be described in detail.

[0594] System Components

[0595] 1. Terminal-side agent

[0596] Device: Install an agent program on your smartphone or tablet. The agent runs in the background of the device and monitors application activity and network traffic.

[0597] 2. Data Encryption and Transmission

[0598] Terminal: The monitoring data is encrypted and sent to the server using strong security protocols such as public key cryptography.

[0599] 3. Server-side generated AI models

[0600] Server: The generative AI model is placed on the server and performs real-time analysis of the received monitoring data. The generative AI model identifies fraudulent behavior patterns and detects anomalies.

[0601] 4. Anomaly detection and notification

[0602] Server: When an abnormality is detected, a summary of the abnormality and a solution are generated and notified to the user terminal via the agent.

[0603] 5. User Actions

[0604] User: Upon receiving the notification, the user should follow the instructions displayed and take measures such as uninstalling the malicious app or changing settings.

[0605] 6. Automatic Countermeasures

[0606] Terminal: If the user does not take prompt action, the agent will automatically take measures such as cutting off the network connection.

[0607] 7. System Updates

[0608] Server: Regularly updates the generative AI model based on new threat information to maintain the latest defense capabilities. Updated models are automatically distributed to devices.

[0609] Explanation of program processing

[0610] The program processing of the system will be explained in natural language below.

[0611] Operation of the terminal agent

[0612] On the device: Once the user installs the agent, it continuously monitors system activity, including application installations and network traffic. Because it runs as a background process independent of user actions, the user is unaware of the monitoring.

[0613] Data transmission and analysis

[0614] On the device: The monitored data is encrypted and sent to a server, including application activity logs and network traffic details.

[0615] Server: Inputs the received data into the generative AI model for real-time analysis, detecting abnormal behavioral patterns and identifying those deemed abnormal.

[0616] Anomaly detection and notification

[0617] Server: If an abnormality is detected, a message is generated to notify the user of the details and how to deal with the problem. For example, if a malicious application is detected, the message instructs the user to uninstall the application.

[0618] Device: The notification will pop up on the device screen, allowing the user to see what to do.

[0619] User actions and automatic measures

[0620] User: Upon receiving the notification, the user follows the instructions to uninstall the malicious app or change security settings.

[0621] Terminal: If the user does not take prompt action, the agent will automatically cut off the network connection, minimizing the impact of malicious activity.

[0622] System Updates

[0623] Server: Collects new threat information, trains and updates the generative AI model. Updates are performed periodically, and new models are automatically distributed to devices.

[0624] Device: When a new model is released, the agent automatically applies it, enabling the latest security measures.

[0625] Specific examples

[0626] Example 1: Installing a malicious app

[0627] 1. Device: Once a malicious app is installed, the application's behavior is recorded as monitoring data.

[0628] 2. Server: Receives the data and uses the generative AI model to detect fraudulent behavior and identify anomalies.

[0629] 3. Device: A notification is sent to the user, who receives a message saying "Malware detected."

[0630] 4. User: Follow the instructions to uninstall the malicious app.

[0631] Example 2: Anomalous Network Activity

[0632] 1. Terminal: When abnormal network activity is detected, the traffic data is recorded.

[0633] 2. Server: The AI ​​model analyzes the traffic data and identifies anomalies.

[0634] 3. Device: A notification is sent to the user, who receives a message saying "Anomalous network activity has been detected."

[0635] 4. User: Check your network settings and make any necessary corrections.

[0636] 5. Terminal: If the user does not respond promptly, the agent will automatically cut off the relevant network connection.

[0637] This allows users to enjoy high security and minimize the effort required to ensure the safety of their devices.The present invention is a system that keeps users' smartphones safe at all times by detecting fraudulent use early and taking prompt measures.

[0638] The processing flow will be explained below.

[0639] Step 1:

[0640] User: Download and install the anti-tool app from the smartphone app store. Once the installation is complete, launch the app to begin the initial setup.

[0641] Step 2:

[0642] Device: When the device is launched for the first time, the user is asked to set permissions (e.g., permission to use the app, permission to notify) so that the agent can start operating in the background.

[0643] Step 3:

[0644] User: Grant the necessary permissions and complete the setup. From then on, the agent will monitor in the background.

[0645] Step 4:

[0646] Device: The agent monitors application behavior and network traffic on the smartphone and periodically collects monitoring data.

[0647] Step 5:

[0648] On the device: The collected monitoring data is encrypted and periodically sent to a server using a secure encryption protocol, ensuring the data remains confidential.

[0649] Step 6:

[0650] Server: The server decodes the received monitoring data and performs real-time analysis using generative AI models to detect malicious behavior patterns and anomalies.

[0651] Step 7:

[0652] Server: When an anomaly is detected, it classifies the type and impact of the anomaly and generates a detailed report.

[0653] Step 8:

[0654] Server: Generates a message to notify the user about the detected abnormality and sends instructions to the device, including how to deal with the problem.

[0655] Step 9:

[0656] On the device: A message is received and displayed as a notification pop-up to the user, providing specific instructions to the user, such as "A malicious app has been detected. Please uninstall it."

[0657] Step 10:

[0658] User: Check the notification and follow the instructions to take necessary action, such as uninstalling the malicious app or changing settings.

[0659] Step 11:

[0660] Device: If the user does not take prompt action, the agent will automatically take measures such as cutting off the network connection to minimize the impact of malicious activity.

[0661] Step 12:

[0662] Server: Regularly updates and trains the generative AI model based on new threat information. By always maintaining the latest model, it is possible to respond quickly to new threats.

[0663] Step 13:

[0664] Server: Distributes updated generative AI models to devices, allowing the device agents to monitor and take countermeasures based on the latest information.

[0665] Step 14:

[0666] Devices: Automatically receive and apply new models, allowing users to enjoy the latest security measures without any special action.

[0667] Through the above processing steps, the present invention provides an advanced security system that monitors smartphones in real time, detects fraudulent use, and responds promptly.

[0668] Example 1

[0669] Next, a description will be given of Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the smart glasses 214 will be referred to as a "terminal."

[0670] In today's digital environment, it is difficult to effectively monitor and counter the increasing threats of fraudulent behavior and data leaks in real time. To solve this problem, continuous monitoring of user devices, anomaly detection, and rapid response are essential, but this has been difficult to achieve with conventional systems. Automatic response is also necessary if users do not promptly address fraudulent behavior. Furthermore, regular updates to keep system security up to date is also a challenge.

[0671] The specific processing by the specific processing unit 290 of the data processing device 12 in the first embodiment is realized by the following means.

[0672] In this invention, the server includes: a means for installing an agent on a user's terminal and running it in the background to monitor application operation and network traffic; a means for encrypting the monitored data and transmitting it from the terminal to the server; a means for analyzing the received data in real time using a generative AI model on the server to detect abnormal behavioral patterns; a means for notifying the user of the detected abnormality and providing a solution; a means for updating the generative AI model based on new threat information and distributing automatic updates from the server to the terminal; a means for the agent to automatically disconnect the network connection if the user's action is delayed; and a means for the agent to send the terminal's system information and initial settings to the server and begin continuous monitoring. This enables real-time detection of fraudulent behavior and data leaks and prompt countermeasures. Furthermore, automatic response is also possible if the user does not respond promptly, and the latest security measures are always applied to the terminal, improving the security of the entire system.

[0673] "User terminal" refers to a computer device such as a smartphone or tablet used by a user.

[0674] An "agent" is a program that is installed on a user's device, runs in the background, and monitors device activity and network traffic.

[0675] "Running in the background" means that the program continues to run behind the system without affecting the user's operations.

[0676] "Application operation" refers to the execution state and behavior of a software program installed on a user terminal.

[0677] "Network traffic" refers to the flow of data sent and received between user terminals and other network devices.

[0678] "Monitoring data" refers to application operation logs and detailed network traffic information collected by the agent.

[0679] "Encryption" refers to the transformation of data using a specific algorithm to protect it from unauthorized access by third parties.

[0680] "Server" refers to the computer system that receives monitoring data, analyzes it, runs generative AI models, notifies and manages information.

[0681] A "generative AI model" refers to a system that uses artificial intelligence algorithms trained on large amounts of data to analyze data and detect patterns of fraudulent behavior.

[0682] "Abnormal behavior patterns" refer to unauthorized actions or unusual operations that deviate from normal behavior.

[0683] "Notification" means sending a warning to the user about a detected abnormality and how to deal with it, and is displayed on the terminal screen as a pop-up message or the like.

[0684] "Countermeasures" refer to specific steps or actions to correct a detected abnormality.

[0685] "Automatic update" refers to the automatic distribution and application of new versions of generative AI models from the server to user devices.

[0686] "Blocking network connections" refers to a measure to prevent potentially fraudulent behavior by halting network access by a user device.

[0687] "Initial settings" refers to the basic information and configuration of the device that the agent collects immediately after installation.

[0688] "Real-time" refers to a state in which processing and analysis are carried out immediately in real time.

[0689] This invention is a generative AI-based anti-tool system that enhances security by installing an agent on a user's device and monitoring, detecting, notifying, and responding to malicious activity in real time. Specific embodiments of this system will be described in detail.

[0690] Hardware and Software Configuration

[0691] 1. Terminal-side agent

[0692] Device: Install an agent program on your smartphone or tablet that runs in the background and monitors application activity and network traffic.

[0693] Agent app: Dedicated application software that users install.

[0694] 2. Data Encryption and Transmission

[0695] Terminal: The monitoring data is encrypted and sent to the server using a strong security protocol such as AES (Advanced Encryption Standard).

[0696] 3. Server-side generated AI models

[0697] Server: The generative AI model deployed on the server performs real-time analysis of the received monitoring data. The generative AI model identifies fraudulent behavior patterns and detects anomalies.

[0698] 4. Anomaly detection and notification

[0699] Server: When an abnormality is detected, a summary of the abnormality and a solution are generated and notified to the user terminal via the agent.

[0700] 5. User Actions and Automatic Countermeasures

[0701] Terminal: The user receives the notification and follows the instructions displayed to take countermeasures. If the user does not take prompt action, the agent will automatically cut off the network connection.

[0702] 6. System Updates

[0703] Server: Regularly updates the generative AI model based on new threat information to maintain the latest defense capabilities. Updated models are automatically distributed to devices.

[0704] Specific examples of processing

[0705] Example 1: Installing a malicious app

[0706] 1. Device: When a malicious app is installed, the agent records the application's behavior as monitoring data.

[0707] 2. Server: Inputs the received data into the generative AI model to detect fraudulent behavior and generates alerts when anomalies are identified.

[0708] 3. On the device: A notification is sent to the user with the message "Malware detected."

[0709] 4. User: Follow the instructions to uninstall the malicious app.

[0710] 5. Device: If the user does not respond promptly, the agent will automatically cut off communication for that app.

[0711] Example 2: Anomalous Network Activity

[0712] 1. Terminal: When abnormal network activity is detected, the agent records the traffic data.

[0713] 2. Server: The AI ​​model analyzes the traffic data and identifies anomalies.

[0714] 3. Device: A notification is sent to the user with the message "Anomalous network activity detected."

[0715] 4. User: Check your network settings and make any necessary corrections.

[0716] 5. Terminal: If the user does not respond promptly, the agent will automatically cut off the relevant network connection.

[0717] Prompt Sentence Examples

[0718] "Please tell me the program flow to determine whether a newly installed app is a malicious app or not and notify me."

[0719] "Please provide detailed instructions on what specific steps you will take if abnormal network activity is detected."

[0720] This invention allows users to enjoy high security and minimize the effort required to ensure the safety of their devices.The system keeps users' smartphones safe at all times by detecting fraudulent use early and taking prompt measures.

[0721] The flow of the identification process in the first embodiment will be described with reference to FIG.

[0722] Step 1: Install and initialize the agent

[0723] Device: The user installs the agent app on their smartphone or tablet. When the agent launches, it collects and encrypts the device's system information (e.g., OS version, device ID, list of installed applications). This encrypted data is then sent to the server.

[0724] Input: The user installs the agent app and starts its initialization.

[0725] Output: Encrypted device system information is sent to the server.

[0726] Step 2: Continuous monitoring of the device

[0727] On the device: The agent runs in the background, monitoring application behavior and network traffic in real time. If a newly installed app or unusual network activity is detected, details are recorded in a log.

[0728] Input: Application activity and network traffic on the device.

[0729] Output: Recorded as monitoring data and periodically sent to a server.

[0730] Step 3: Encrypt and send data

[0731] On the device: Collected monitoring data is encrypted using AES encryption. This data includes application activity logs and network traffic details. The encrypted data is then sent to a server for secure communication.

[0732] Input: Collected unencrypted surveillance data.

[0733] Output: Encrypted monitoring data is sent to the server.

[0734] Step 4: Data analysis by the server

[0735] Server: Decrypts the received encrypted data and inputs it into the generative AI model. The generative AI model analyzes the received data in real time and detects abnormal behavioral patterns. For example, if a specific app is sending or receiving an abnormally large amount of data, the generative AI model will determine that this is fraudulent behavior.

[0736] Input: Decoded surveillance data.

[0737] Output: Verification result of abnormal behavior pattern.

[0738] Step 5: Anomaly detection and user notification

[0739] Server: Generates detailed reports of detected anomalies and creates notification messages with solutions. The notification content includes a detailed description of the anomaly and recommended actions, and is sent to the device via the agent.

[0740] Device: A notification will appear as a pop-up on the device screen, informing the user that an anomaly has been detected.

[0741] Input: Abnormal behavior pattern determination result.

[0742] Output: The notification message sent to the user.

[0743] Step 6: User Coping Behavior

[0744] Users: Check the notification and follow the instructions to take measures such as uninstalling the malicious app or reviewing network settings. For example, if you receive a notification that a malicious app has been detected, uninstall the app.

[0745] Input: The notification message sent to the user.

[0746] Output: User action (e.g., uninstalling the app).

[0747] Step 7: Implementing automated measures

[0748] Terminal: If the user does not take action promptly, the agent will automatically take action, for example, if abnormal network activity continues, it will cut off the network connection to block the traffic.

[0749] Input: Situations where the user does not take action.

[0750] Output: The automatic action to be taken (e.g., blocking the network connection).

[0751] Step 8: Update the system and AI model

[0752] Server: Collects new threat information, trains and updates the generative AI model, and periodically updates the model, distributing the updated model to the device.

[0753] On the device: The agent automatically applies the new model, ensuring the latest security measures are in place.

[0754] Input: New threat information and a trained generative AI model.

[0755] Output: The latest generative AI model applied to the device.

[0756] This is the flow of program processing for this system, which allows users to enjoy high security and minimize the effort required to ensure the safety of their terminals.

[0757] (Application example 1)

[0758] Next, a description will be given of Application Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the smart glasses 214 will be referred to as a "terminal."

[0759] Conventional security systems often have difficulty detecting malicious activity in real time, forcing users to manually implement countermeasures. This makes it difficult to minimize the impact of malicious behavior and poses a risk to the security of user devices. Furthermore, if users do not respond quickly, malicious behavior can lead to more serious problems, so a system that can quickly and automatically implement countermeasures is needed.

[0760] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 1 is realized by the following means.

[0761] In this invention, the server includes means for analyzing received data in real time using a generative AI model to detect abnormal behavioral patterns, means for notifying the user of the detected abnormality and providing a solution, and means for automatically uninstalling the malicious application or cutting off the network connection if the user does not take appropriate action. This makes it possible to detect fraudulent behavior in real time and implement countermeasures quickly and automatically.

[0762] An "agent" is software that is installed on a user's terminal and runs in the background to monitor application operations and network traffic.

[0763] A "generative AI model" is an artificial intelligence model that runs on a server and analyzes monitoring data sent from user devices in real time to detect abnormal behavioral patterns.

[0764] "Encryption" is a technology that converts monitoring data so that it cannot be deciphered by third parties, enabling the secure transmission of data.

[0765] An "anomalous behavior pattern" is a pattern indicative of unexpected or unauthorized system behavior or network traffic.

[0766] A "notification" is a message that provides the user with information about a detected abnormality and instructs them on how to deal with it.

[0767] "Network disconnection" is a procedure in which a user terminal is temporarily disconnected from the Internet or other networks when fraudulent activity is detected.

[0768] An "update" is an update procedure that allows the system to improve the generative AI model based on new threat information and provide new defensive capabilities to the device.

[0769] "Malicious applications" are applications that may cause harm to user devices and are often installed from sources other than legitimate stores.

[0770] This invention relates to a generative AI-based anti-tool system that installs an agent on a user's device to monitor, detect, notify, and respond to malicious activity in real time. This system works particularly effectively on smartphones.

[0771] System Components

[0772] 1. Terminal-side agent

[0773] An agent is installed on the user's device (smartphone). The agent runs in the background and continuously monitors application activity and network traffic. Because it runs as a background process independent of user actions, the user is unaware of the monitoring.

[0774] 2. Data Encryption and Transmission

[0775] The agents collect monitoring data and send it to a server in an encrypted form using strong security protocols such as public key cryptography.

[0776] 3. Server-side generated AI models

[0777] The generative AI model is placed on the server and performs real-time analysis of the received monitoring data. The generative AI model identifies fraudulent behavior patterns and detects anomalies.

[0778] 4. Anomaly detection and notification

[0779] When an abnormality is detected on the server, a summary of the problem and a solution are generated and sent to the user's device via the agent. The notification is displayed as a pop-up on the device screen, allowing the user to check the solution.

[0780] 5. Automatic Countermeasures

[0781] If the user does not respond promptly, the agent will automatically take measures such as cutting off the network connection or uninstalling the malicious application.

[0782] 6. System Updates

[0783] The server periodically updates the generative AI model based on new threat information to maintain up-to-date defense capabilities, and the updated model is automatically distributed to devices.

[0784] Example of a system

[0785] Example 1: Detecting the installation of fraudulent apps

[0786] 1. Terminal-side agent

[0787] When a user installs a malicious app, the application's behavior is recorded as monitoring data.

[0788] 2. Data Encryption and Transmission

[0789] The monitoring data is encrypted and sent to a server.

[0790] 3. Server-side generated AI models

[0791] Generative AI models analyze data in real time to detect fraudulent behavior.

[0792] 4. Anomaly detection and notification

[0793] The server detects the abnormality and notifies the user device that a malicious app has been detected. The user is then instructed to uninstall the malicious app.

[0794] 5. Automatic Countermeasures

[0795] If the user does not take immediate action, the agent will automatically uninstall the malicious app.

[0796] Example 2: Detecting anomalous network activity

[0797] 1. Terminal-side agent

[0798] When abnormal network activity is detected, the traffic data is recorded.

[0799] 2. Data Encryption and Transmission

[0800] The traffic data is encrypted and sent to the server.

[0801] 3. Server-side generated AI models

[0802] AI models analyze traffic data and identify anomalous activity.

[0803] 4. Anomaly detection and notification

[0804] When an anomaly is detected, a notification is sent to the user device stating that "anomalous network activity has been detected." The user is then instructed to check their network settings and make any necessary corrections.

[0805] 5. Automatic Countermeasures

[0806] If the user does not respond promptly, the agent will automatically cut off the relevant network connection.

[0807] Prompt Sentence Examples

[0808] "A malicious application has been detected. Please uninstall it immediately."

[0809] "Abnormal network traffic has been detected. Please check your network settings."

[0810] This allows users to enjoy high security and minimize the effort required to ensure the safety of their devices.The present invention provides a means to keep users' smartphones safe at all times by detecting fraudulent behavior early and taking prompt measures.

[0811] The flow of the specific processing in the application example 1 will be described with reference to FIG.

[0812] Step 1:

[0813] Installing and initializing the terminal agent

[0814] Input: Application installation request

[0815] Operation: The user installs the agent on the device and performs the initial setup. The agent then starts running in the background, ready to monitor application activity and network traffic regardless of user interaction.

[0816] Output: The status of the agent running in the background

[0817] Step 2:

[0818] Starting the virus detection process

[0819] Input: Execution by terminal agent

[0820] How it works: The agent continuously monitors applications running on the device and network traffic, collecting data to detect malicious activity.

[0821] Output: Application operation log, network traffic data

[0822] Step 3:

[0823] Encrypting data and sending it to the server

[0824] Input: Application operation logs, network traffic data

[0825] How it works: Collected data is encrypted using public key cryptography and securely sent to a server.

[0826] Output: Encrypted monitoring data

[0827] Step 4:

[0828] Analysis using server-side generated AI models

[0829] Input: Encrypted surveillance data

[0830] How it works: A server-based generative AI model receives surveillance data, decodes it, and analyzes it in real time to detect anomalous behavioral patterns.

[0831] Output: Abnormal behavior pattern detection results

[0832] Step 5:

[0833] Anomaly detection and user notification

[0834] Input: Abnormal behavior pattern detection results

[0835] Operation: The server generates a notification message containing a detailed explanation of the detected anomaly and how to resolve it, and sends it to the user's device via the agent.

[0836] Output: A message to inform the user

[0837] Step 6:

[0838] User Action

[0839] Input: Notification message

[0840] How it works: The user receives a notification message and follows the instructions to uninstall the malicious app and fix their network settings.

[0841] Output: User action

[0842] Step 7:

[0843] Implementing automatic countermeasures

[0844] Input: Detection when no countermeasures are taken by the user

[0845] How it works: If the user does not take action quickly enough, the agent will automatically block network connections and uninstall the malicious application.

[0846] Output: Blocking network connections, uninstalling malicious applications

[0847] Step 8:

[0848] System Updates

[0849] Input: New threat information

[0850] How it works: The server collects new threat information, trains and updates the generative AI model, and periodically pushes the updated model to the device and applies it automatically.

[0851] Output: Delivery and application of updated generative AI models

[0852] Furthermore, an emotion engine that estimates the user's emotion may be further combined. That is, the identification processing unit 290 may estimate the user's emotion using the emotion identification model 59, and perform identification processing using the user's emotion.

[0853] This invention combines a generative AI-based anti-tool system with an emotion engine that recognizes user emotions, and is a system for strengthening the security of smartphones and tablets. Specifically, an agent installed on the user's device monitors application behavior and network traffic, and uses the emotion engine to take appropriate action based on the user's emotional state.

[0854] System Components

[0855] 1. Terminal-side agent

[0856] Terminal: An agent program is installed on the user's terminal and runs in the background. The agent monitors application activity and network traffic.

[0857] 2. Data Encryption and Transmission

[0858] Terminal: The agent encrypts the collected monitoring data and periodically sends it to the server.

[0859] 3. Server-side generated AI models

[0860] Server: Analyzes incoming data in real time using generative AI models to detect fraudulent behavioral patterns and anomalies.

[0861] 4. Anomaly detection and notification

[0862] Server: Based on the detected abnormality, a message including a solution is generated and sent to the device.

[0863] 5. Emotion Engine

[0864] Device: The emotion engine analyzes the user's voice, facial expressions, input patterns, etc. to recognize the user's emotional state.

[0865] 6. Emotion-Based Notification Adjustment

[0866] On the device: Based on the analysis results of the emotion engine, the content and frequency of notifications are adjusted according to the user's emotional state. For example, if the user is in a state of high stress, the content of notifications will be simplified and the countermeasures will be changed to something that is intuitively understandable.

[0867] 7. User and Automatic Countermeasures

[0868] User: Follow the notification and take the appropriate action.

[0869] Device: If the user does not respond promptly, measures such as automatically cutting off the network connection will be taken.

[0870] 8. System Updates

[0871] Server: Regularly updates the generative AI model based on new threat information and delivers automatic updates to devices.

[0872] Explanation of program processing

[0873] The program processing of the system will be explained in natural language below.

[0874] Operation of the terminal agent

[0875] On the device: After the user installs the agent, it monitors application activity and network traffic, collecting monitoring data that is then encrypted and sent to a server.

[0876] Data transmission and analysis

[0877] Server: Inputs the received data into the generative AI model and performs real-time analysis. If an abnormal behavioral pattern is detected, a detailed report is generated and sent to the device along with countermeasures.

[0878] Emotion Engine Operation

[0879] Device: The emotion engine analyzes data such as the user's voice and facial expressions in real time to recognize the user's emotional state.

[0880] Emotion-based notification adjustment

[0881] Device: Adjust the content and frequency of notifications based on the user's emotional state. For example, if the user is stressed, notifications will be displayed in a simple and understandable way.

[0882] User actions and automatic measures

[0883] User: Follow the notification and uninstall the malicious app or change your network settings.

[0884] Device: If the user does not respond quickly, the agent will automatically cut off the network connection, minimizing the impact of malicious activity.

[0885] System Updates

[0886] Server: Trains generative AI models based on new threat information and distributes the latest versions to devices.

[0887] Device: Automatically applies updates to keep your security up to date.

[0888] Specific examples

[0889] Example 1: Installing a malicious app

[0890] 1. Device: Once a malicious app is installed, the agent monitors its behavior and collects data.

[0891] 2. Server: Generative AI models detect fraudulent behavior and identify anomalies.

[0892] 3. On the device: The emotion engine analyzes the user's emotional state and, for example, if they are feeling stressed, it will display a simplified notification.

[0893] 4. User: Follow the instructions and uninstall the malicious app.

[0894] Example 2: Anomalous Network Activity

[0895] 1. Terminal: When abnormal network activity is detected, traffic data is collected.

[0896] 2. Server: The generative AI model analyzes the data and identifies anomalies.

[0897] 3. On the device: The emotion engine analyzes the user's emotional state and sends detailed notifications if the user is relaxed.

[0898] 4. User: Follow the notification and change your network settings.

[0899] 5. Device: If the user does not take prompt action, the device will automatically shut down the network connection.

[0900] In this way, by combining a generative AI-based anti-tool system with an emotion engine, the present invention realizes flexible notifications and responses that take into account the user's emotional state, allowing users to enjoy a stress-free operating experience while maintaining high security.

[0901] The processing flow will be explained below.

[0902] Step 1:

[0903] User: Download and install the anti-tool app from the smartphone app store. Once the installation is complete, launch the app to begin the initial setup.

[0904] Step 2:

[0905] Device: When the device is launched for the first time, the user is asked to set permissions (e.g., permission to use the app, permission to notify) so that the agent can start operating in the background.

[0906] Step 3:

[0907] User: Grant the necessary permissions and complete the setup. From then on, the agent will monitor in the background.

[0908] Step 4:

[0909] Device: The agent monitors application behavior and network traffic on the smartphone and periodically collects monitoring data.

[0910] Step 5:

[0911] On the device: The collected monitoring data is encrypted and periodically sent to a server using a secure encryption protocol, ensuring the data remains confidential.

[0912] Step 6:

[0913] Server: The server decodes the received monitoring data and performs real-time analysis using generative AI models to detect malicious behavior patterns and anomalies.

[0914] Step 7:

[0915] Server: When an anomaly is detected, it classifies the type and impact of the anomaly and generates a detailed report.

[0916] Step 8:

[0917] Server: Generates a message to notify the user about the detected abnormality and sends instructions to the device, including how to deal with the problem.

[0918] Step 9:

[0919] On the device: A message is received and displayed as a notification pop-up to the user, providing specific instructions to the user, such as "A malicious app has been detected. Please uninstall it."

[0920] Step 10:

[0921] Device: The emotion engine analyzes the user's voice, facial expressions, and input patterns in parallel to recognize the user's emotional state.

[0922] Step 11:

[0923] Device: Adjust the content and frequency of notifications based on the user's emotional state. For example, if the user is in a stressful state, the notification content will be simplified and the solution will be more intuitive.

[0924] Step 12:

[0925] User: Check the notification and follow the instructions to take necessary action, such as uninstalling the malicious app or changing settings.

[0926] Step 13:

[0927] Device: If the user does not take prompt action, the agent will automatically take measures such as cutting off network connections to minimize the impact of malicious activity.

[0928] Step 14:

[0929] Server: Regularly updates and trains the generative AI model based on new threat information. By always maintaining the latest model, it is possible to respond quickly to new threats.

[0930] Step 15:

[0931] Server: Distributes updated generative AI models to devices, allowing the device agents to monitor and take countermeasures based on the latest information.

[0932] Step 16:

[0933] Devices: Automatically receive and apply new models, allowing users to enjoy the latest security measures without any special action.

[0934] By combining the above processing steps with an emotion engine, the present invention realizes flexible notification and response that takes into account the user's emotional state, allowing users to enjoy high security and a stress-free operating experience.

[0935] Example 2

[0936] Next, a description will be given of Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the smart glasses 214 will be referred to as a "terminal."

[0937] While modern smartphones and tablets offer convenience and many applications and network services, they are also facing increasing threats such as malicious applications, phishing, and malware. This creates a need for high levels of device security, but conventional systems have struggled to respond flexibly and take into account the user's emotional state. The present invention aims to address these issues.

[0938] The identification process by the identification processing unit 290 of the data processing device 12 in the second embodiment is realized by the following means. In this invention, the server includes means for installing an agent on a user terminal and running it in the background to monitor application operations and network traffic, means for encrypting the monitored data and transmitting it to the server, means for analyzing received data in real time using a generative AI model on the server and detecting abnormal behavioral patterns, means for notifying the user of the detected abnormality and providing a solution, and means for analyzing the user's voice, facial expressions, and input patterns using an emotion engine and adjusting the content and frequency of notifications based on the user's emotional state. This enables flexible and advanced security measures that take the user's emotional state into consideration.

[0939] An "agent" is software that is installed on a user's terminal, runs in the background, and monitors application operations and network traffic.

[0940] "Monitoring Data" refers to application operation information and network traffic information collected by the Agent.

[0941] A "generative AI model" is an artificial intelligence-based analytical model that analyzes incoming data in real time and detects abnormal behavioral patterns.

[0942] A "notification" is a message that notifies the user of an abnormality detected by the server and provides a solution to the problem.

[0943] An "emotion engine" is software that analyzes a user's voice, facial expressions, and input patterns to recognize the user's emotional state.

[0944] "Encryption" refers to the process of converting surveillance data into a format that cannot be deciphered by third parties.

[0945] "Blocking network connectivity" refers to temporarily disabling a device's network access to prevent fraudulent trading activity or attacks.

[0946] "Automatic updates" refers to the process of delivering the latest security measures based on new threat information from a server to a device and automatically applying the updates.

[0947] This invention is an anti-tool system that uses a generative AI model and realizes more flexible and advanced security measures by taking into account the user's emotional state. This system is installed on the user's device, such as a smartphone or tablet, and constantly runs in the background to monitor security.

[0948] A specific embodiment of the present invention will now be described.

[0949] Required Hardware and Software

[0950] Hardware: Mobile devices such as smartphones and tablets

[0951] software:

[0952] Agent program: Installed on the user's terminal, it monitors application behavior and network traffic.

[0953] Generative AI model: Uses a deep learning model based on ResNet to detect anomalous behavioral patterns.

[0954] Emotion engine: Utilizes OpenFace and IBM Watson emotion analysis engines to analyze the user's emotional state.

[0955] Backend servers: Hosted on AWS EC2 or Google Cloud Platform.

[0956] System Overview

[0957] An agent program is installed on the device and runs in the background to monitor application behavior and network traffic. The monitored data is AES-256 encrypted and sent to a server. On the server, the data is analyzed by a generative AI model, and if an abnormality is detected, a detailed report is generated and the user is notified along with how to deal with it. An emotion engine then analyzes the user's emotional state and determines the appropriate notification method based on that state.

[0958] Specific example explanation

[0959] Example 1: Installing a malicious app

[0960] 1. Device: Once a malicious app is installed, the agent monitors its behavior and collects data.

[0961] 2. Server: The generative AI model analyzes the incoming data and detects fraudulent behavior.

[0962] 3. On the device: The emotion engine analyzes the user's emotional state and displays simplified notifications if the user is feeling stressed.

[0963] 4. User: Follow the instructions and uninstall the malicious app.

[0964] Example 2: Anomalous Network Activity

[0965] 1. Terminal: Anomalous network activity is detected and traffic data is collected.

[0966] 2. Server: The generative AI model analyzes the data and identifies anomalies.

[0967] 3. On the device: The emotion engine analyzes the user's emotional state and sends detailed notifications if the user is relaxed.

[0968] 4. User: Follow the notification and change your network settings.

[0969] 5. Device: If the user does not take prompt action, the device will automatically shut down the network connection.

[0970] Prompt Sentence Examples

[0971] 1. Generate an explanation of a system that combines generative AI-based anti-tools with an emotional engine to enhance the security of smartphones and tablets.

[0972] 2. Describe how an agent installed on a user device can monitor application behavior and network traffic, encrypt collected data, and send it to a server for real-time analysis using a generative AI model.

[0973] Through these specific examples, the present invention can realize flexible security measures that take into account the emotional state of the user, thereby maintaining a high level of security for the terminal.

[0974] The flow of the identification process in the second embodiment will be described with reference to FIG.

[0975] Specific explanation of program processing

[0976] Step 1: Install and start the agent

[0977] On the device, the user installs the agent program and it starts running in the background. Once installed, the agent runs as a system process and, with the user's permission, begins monitoring application activity and network traffic.

[0978] Input: Agent installation file

[0979] Output: The agent starts running in the background.

[0980] Step 2: Monitor application behavior and network traffic

[0981] On the device, the agent monitors the behavior of installed applications and network traffic in real time. For example, when a new application is installed, it collects the application's communication details, CPU usage, memory usage, etc.

[0982] Input: Application behavior data and network traffic data

[0983] Output: Monitoring data collection (log file)

[0984] Step 3: Encrypt monitoring data

[0985] Terminal: Collected monitoring data is encrypted with AES-256. Specifically, the encryption process is performed on each batch of collected data once it reaches a certain size.

[0986] Input: Monitoring data

[0987] Output: Encrypted data

[0988] Step 4: Sending monitoring data to the server

[0989] Terminal: Periodically send encrypted data to the server. For example, every 10 minutes, upload the encrypted data to the server using the HTTPS protocol.

[0990] Input: Encrypted data

[0991] Output: Data sent to the server

[0992] Step 5: Receiving and Decrypting Data

[0993] Server: Receives the data sent from the device and decrypts it using AES-256. Specifically, the server passes the received data to a dedicated decryption module, which returns it to its original data format.

[0994] Input: Encrypted data

[0995] Output: Decrypted data

[0996] Step 6: Parse the received data

[0997] Server: The decrypted data is fed into the generative AI model for real-time analysis. This analysis includes detecting anomalous behavioral patterns. For example, if the model detects specific fraudulent activity in the data, it generates an anomaly report.

[0998] Input: Decrypted surveillance data

[0999] Output: Anomalous behavior report

[1000] Step 7: Anomaly detection and notification generation

[1001] Server: When the generative AI model detects an anomaly, it generates a detailed report and countermeasures and notifies the device. Specifically, it creates a notification containing a warning message and countermeasures based on the abnormal behavior report.

[1002] Input: Anomalous Behavior Report

[1003] Output: Information message

[1004] Step 8: Emotional state analysis by the emotion engine

[1005] Device: The emotion engine analyzes the user's voice, facial expressions, and input patterns in real time to assess the user's emotional state. Specifically, the emotion engine analyzes the user's actions, such as speaking to the screen, typing, and looking at the facial recognition camera.

[1006] Input: User voice, facial expressions, and input patterns

[1007] Output: Emotional state data

[1008] Step 9: Adjust notifications based on emotion

[1009] Device: Based on the analysis results of the emotion engine, the content and frequency of notifications are set appropriately according to the user's emotional state. For example, if the emotion engine determines that the user is feeling stressed, the content of notifications will be simplified and the frequency of notifications will be reduced.

[1010] Input: Emotional state data, notification message

[1011] Output: The adjusted notification message

[1012] Step 10: User actions and automated measures

[1013] Users: Follow the notification message and take appropriate measures such as uninstalling the malicious app or changing network settings. For example, follow the instructions to delete the app if it says "A malicious app has been detected on your device. Please uninstall it."

[1014] Input: Notification message

[1015] Output: Response action

[1016] Terminal: If the user does not respond promptly, the agent will automatically cut off the network connection, for example, by taking an action such as "The network connection has been temporarily cut off."

[1017] Input: User response delay

[1018] Output: Automatic countermeasure execution

[1019] Step 11: Update your system

[1020] Server: Trains the generative AI model based on new threat information and delivers the latest security information to devices. For example, it updates the model once a week and delivers security patches.

[1021] Input: New threat information

[1022] Output: Updated generative AI model, security patches

[1023] Device: Automatically apply received updates to keep your security up to date.

[1024] Input: security patch

[1025] Output: Updated security state

[1026] The above is a detailed description of the specific processing flow in the system of the present invention. The intention is that a series of processes for highly protecting user terminals will be executed rationally and effectively.

[1027] (Application example 2)

[1028] Next, a description will be given of Application Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the smart glasses 214 will be referred to as a "terminal."

[1029] While conventional security systems have the ability to monitor user device operation and network traffic and detect abnormalities, they do not provide notifications and responses that take into account the user's psychological state. As a result, even when users are in a state of high stress, they receive complex notifications and are unable to take appropriate action. This can result in ineffective measures being taken in situations where a quick response is required.

[1030] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 2 is realized by the following means.

[1031] In this invention, the server is a generative AI-based anti-tool system that includes: means for installing an agent on a user terminal and running it in the background to monitor application operation and network traffic; means for encrypting the monitored data and transmitting it to the server; means for analyzing the received data in real time using a generative AI model on the server to detect abnormal behavioral patterns; means for notifying the user of the detected abnormality and providing countermeasures; means for adjusting the content and frequency of notifications using an emotion engine that analyzes the user's emotions; and means for updating the generative AI model based on new threat information and distributing automatic updates from the server to the terminal. This enables flexible notifications and responses that take the user's psychological state into consideration, and promotes appropriate responses in high-stress situations.

[1032] A "generative AI model" is an artificial intelligence model that performs real-time analysis using data collected from user devices to detect fraudulent behavioral patterns and anomalies.

[1033] An "anti-tool system" is a system that monitors applications and network traffic on user terminals to detect unauthorized behavior and abnormalities.

[1034] An "agent" is a program that is installed on a user's terminal and runs in the background to monitor application operations and network traffic.

[1035] "Encryption" is a technology that prevents surveillance data from being deciphered by third parties by converting the data using a specific algorithm.

[1036] The "emotion engine" is a system that analyzes data such as the user's voice, facial expressions, and input patterns to recognize the user's emotional state in real time.

[1037] "Means" are methods or techniques for achieving a specific purpose.

[1038] The "server" is a central control device that analyzes data, detects anomalies, updates generative AI models, and sends notifications.

[1039] "Background" means that the system operates automatically behind the scenes, invisible to the user.

[1040] "Network traffic" refers to the transmission and reception of data between a user terminal and the Internet or other network.

[1041] A "notification" is a message or instruction that is displayed to the user when an abnormality is detected.

[1042] "Automatic updates" refers to a function that regularly updates the generative AI model based on new threat information and delivers the latest version to the user's device.

[1043] MODE FOR CARRYING OUT THE INVENTION

[1044] This invention combines a generative AI-based anti-tool system with an emotion engine that recognizes user emotions, and is a system for strengthening the security of smartphones and tablets. Specifically, an agent installed on the user's device monitors application behavior and network traffic, and uses the emotion engine to take appropriate action based on the user's emotional state.

[1045] System Components

[1046] 1. Terminal-side agent

[1047] Terminal: An agent program is installed on the user's terminal and runs in the background. The agent monitors application activity and network traffic, encrypts the monitored data, and temporarily stores it in SQLite.

[1048] 2. Data Encryption and Transmission

[1049] Terminal: The monitoring data collected by the agent is encrypted using the AES algorithm and periodically sent to the server via HTTP communication.

[1050] 3. Server-side generated AI models

[1051] Server: The server uses TensorFlow to build a generative AI model to analyze incoming data in real time, detect fraudulent behavior patterns and anomalies, and generate detailed reports using a Flask application.

[1052] 4. Anomaly detection and notification

[1053] Server: Based on the detected abnormality, a message including a solution is generated and sent to the device.

[1054] 5. Emotion Engine

[1055] On the device: The emotion engine uses OpenCV to analyze the user's voice and facial expressions, and Librosa to analyze the voice data, thereby recognizing the user's emotional state in real time.

[1056] 6. Emotion-Based Notification Adjustment

[1057] On the device: Based on the analysis results of the emotion engine, the content and frequency of notifications are adjusted according to the user's emotional state. For example, if the user is in a state of high stress, the content of notifications will be simplified and the countermeasures will be changed to something that is intuitively understandable.

[1058] 7. User and Automatic Countermeasures

[1059] User and device: The user takes the appropriate action based on the notification. If the user does not respond promptly, the agent will automatically take measures such as cutting off the network connection.

[1060] 8. System Updates

[1061] Server and device: The server trains the generative AI model based on new threat information and distributes the latest version to the device, which then automatically applies updates to maintain the latest security measures.

[1062] Specific examples

[1063] Example 1: Installing a malicious app

[1064] 1. Device: Once a malicious app is installed, the agent monitors its behavior and collects data.

[1065] 2. Server: Generative AI models detect fraudulent behavior and identify anomalies.

[1066] 3. On the device: The emotion engine analyzes the user's emotional state and displays simplified notifications if the user is in a high-stress state.

[1067] 4. User: Follow the instructions and uninstall the malicious app.

[1068] Example 2: Anomalous Network Activity

[1069] 1. Terminal: When abnormal network activity is detected, traffic data is collected.

[1070] 2. Server: The generative AI model analyzes the data and identifies anomalies.

[1071] 3. On the device: The emotion engine analyzes the user's emotional state and sends detailed notifications if the user is relaxed.

[1072] 4. User: Follow the notification and change your network settings.

[1073] 5. Device: If the user does not take prompt action, the device will automatically shut down the network connection.

[1074] Prompt Sentence Examples

[1075] "Detect malicious behavior in user network traffic and generate notifications based on the results. Simplify notifications if users are in a high-stress state."

[1076] As described above, by combining a generative AI-based anti-tool system with an emotion engine, this invention realizes flexible notification and response that takes into account the user's emotional state, allowing users to enjoy a stress-free operating experience while maintaining high security.

[1077] The flow of the specific processing in the application example 2 will be described with reference to FIG.

[1078] Step 1:

[1079] Terminal: An agent is installed on the user's terminal and runs in the background.

[1080] Input: An agent program is installed on the user terminal.

[1081] Action: The agent starts running in the background immediately after installation, monitoring the behavior of applications and network traffic on the device.

[1082] Output: Obtain application behavior data and network traffic data.

[1083] Step 2:

[1084] Terminal: Encrypts the monitoring data and sends it to the server.

[1085] Input: Application behavior data and network traffic data obtained in step 1.

[1086] Processing: The agent encrypts the monitoring data using the AES algorithm and periodically sends it to the server using HTTP communication.

[1087] Output: Encrypted monitoring data is sent to the server.

[1088] Step 3:

[1089] Server: Analyzes incoming data in real time using a generative AI model to detect abnormal behavioral patterns.

[1090] Input: Encrypted surveillance data sent from the device.

[1091] Processing: Decrypting encrypted data and feeding it into generative AI models using TensorFlow for real-time analysis to detect fraudulent behavioral patterns and anomalies.

[1092] Output: If an anomaly is detected, a detailed report is generated.

[1093] Step 4:

[1094] Server: Notifies the user of any detected anomalies and provides solutions.

[1095] Input: The anomaly details report generated in step 3.

[1096] Action: Use a Flask application to generate a notification for the user based on a detailed report of the anomaly. Send a message to the device with instructions on how to resolve the issue.

[1097] Output: A notification message containing a remedy is sent to the user's terminal.

[1098] Step 5:

[1099] Terminal: Analyzes the user's emotional state using an emotion engine.

[1100] Input: Data on the user's voice, facial expressions, and input patterns.

[1101] Processing: By using OpenCV to analyze facial expressions from camera input and Librosa to analyze audio data, the user's emotional state is recognized in real time.

[1102] Output: The user's emotional state (e.g., high stress, relaxed) is obtained as the analysis result.

[1103] Step 6:

[1104] Device: Adjust the content and frequency of notifications based on the analysis results of the emotion engine.

[1105] Input: A notification message containing the user's emotional state obtained in step 5 and the coping strategies provided in step 4.

[1106] Processing: Based on the analysis results of the emotion engine, the notification content is formatted according to the user's emotional state. For example, if the user is in a high-stress state, the notification will be simplified.

[1107] Output: A customized notification is displayed depending on the user's emotional state.

[1108] Step 7:

[1109] Users and devices: Based on notifications, the system takes the appropriate measures and automatically cuts off network connections if necessary.

[1110] Input: The notification message customized in step 6.

[1111] Action: The user takes corrective action based on the notification. If the user does not take action promptly, the agent automatically cuts off the network connection.

[1112] Output: Network connectivity is cut off, minimizing the impact of malicious activity.

[1113] Step 8:

[1114] Server and device: The generative AI model is updated based on new threat information and automatically distributed to the device.

[1115] Input: New threat information and existing generative AI models.

[1116] Processing: Trains generative AI models based on new threat information and delivers the latest version to devices, which automatically apply the received updates.

[1117] Output: Updated generative AI models and the latest security measures are applied to the device.

[1118] The specific processing unit 290 transmits the result of the specific processing to the smart glasses 214. In the smart glasses 214, the control unit 46A causes the speaker 240 to output the result of the specific processing. The microphone 238 acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[1119] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (Internet Search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search <url: https: gemini.google.com ?hl="ja">) and other generation AIs. The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating voice, text data indicating text, and image data indicating an image is also input. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt, and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[1120] In the above embodiment, an example in which the specific processing is performed by the data processing device 12 has been given, but the technology of the present disclosure is not limited to this, and the specific processing may be performed by the smart glasses 214.

[1121] [Third embodiment]

[1122] FIG. 5 shows an example of the configuration of a data processing system 310 according to the third embodiment.

[1123] 5, the data processing system 310 includes the data processing device 12 and a headset terminal 314. An example of the data processing device 12 is a server.

[1124] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" according to the technology of the present disclosure. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[1125] The headset type terminal 314 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication I / F 44, and a display 343. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, the camera 42, and the display 343 are also connected to the bus 52.

[1126] The microphone 238 receives instructions and the like from the user 20 by receiving voice uttered by the user 20. The microphone 238 captures the voice uttered by the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio in accordance with instructions from the processor 46.

[1127] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the surroundings of user 20 (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[1128] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[1129] Fig. 6 shows an example of the main functions of the data processing device 12 and the headset type terminal 314. As shown in Fig. 6, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[1130] The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[1131] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[1132] In the headset type terminal 314, a reception output process is performed by the processor 46. A reception output program 60 is stored in the storage 50. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output process is realized by the processor 46 operating as the control unit 46A in accordance with the reception output program 60 executed on the RAM 48.

[1133] Next, a description will be given of the identification process performed by the identification processing unit 290 of the data processing device 12. In the following description, the data processing device 12 will be referred to as the "server" and the headset type terminal 314 will be referred to as the "terminal."

[1134] The present invention relates to a generative AI-based anti-tool system that enhances security by installing an agent on a user's device to monitor, detect, notify, and respond to malicious activity in real time. Specific embodiments of the system will be described in detail.

[1135] System Components

[1136] 1. Terminal-side agent

[1137] Device: Install an agent program on your smartphone or tablet. The agent runs in the background of the device and monitors application activity and network traffic.

[1138] 2. Data Encryption and Transmission

[1139] Terminal: The monitoring data is encrypted and sent to the server using strong security protocols such as public key cryptography.

[1140] 3. Server-side generated AI models

[1141] Server: The generative AI model is placed on the server and performs real-time analysis of the received monitoring data. The generative AI model identifies fraudulent behavior patterns and detects anomalies.

[1142] 4. Anomaly detection and notification

[1143] Server: When an abnormality is detected, a summary of the abnormality and a solution are generated and notified to the user terminal via the agent.

[1144] 5. User Actions

[1145] User: Upon receiving the notification, the user should follow the instructions displayed and take measures such as uninstalling the malicious app or changing settings.

[1146] 6. Automatic Countermeasures

[1147] Terminal: If the user does not take prompt action, the agent will automatically take measures such as cutting off the network connection.

[1148] 7. System Updates

[1149] Server: Regularly updates the generative AI model based on new threat information to maintain the latest defense capabilities. Updated models are automatically distributed to devices.

[1150] Explanation of program processing

[1151] The program processing of the system will be explained in natural language below.

[1152] Operation of the terminal agent

[1153] On the device: Once the user installs the agent, it continuously monitors system activity, including application installations and network traffic. Because it runs as a background process independent of user actions, the user is unaware of the monitoring.

[1154] Data transmission and analysis

[1155] On the device: The monitored data is encrypted and sent to a server, including application activity logs and network traffic details.

[1156] Server: Inputs the received data into the generative AI model for real-time analysis, detecting abnormal behavioral patterns and identifying those deemed abnormal.

[1157] Anomaly detection and notification

[1158] Server: If an abnormality is detected, a message is generated to notify the user of the details and how to deal with the problem. For example, if a malicious application is detected, the message instructs the user to uninstall the application.

[1159] Device: The notification will pop up on the device screen, allowing the user to see what to do.

[1160] User actions and automatic measures

[1161] User: Upon receiving the notification, the user follows the instructions to uninstall the malicious app or change security settings.

[1162] Terminal: If the user does not take prompt action, the agent will automatically cut off the network connection, minimizing the impact of malicious activity.

[1163] System Updates

[1164] Server: Collects new threat information, trains and updates the generative AI model. Updates are performed periodically, and new models are automatically distributed to devices.

[1165] Device: When a new model is released, the agent automatically applies it, enabling the latest security measures.

[1166] Specific examples

[1167] Example 1: Installing a malicious app

[1168] 1. Device: Once a malicious app is installed, the application's behavior is recorded as monitoring data.

[1169] 2. Server: Receives the data and uses the generative AI model to detect fraudulent behavior and identify anomalies.

[1170] 3. Device: A notification is sent to the user, who receives a message saying "Malware detected."

[1171] 4. User: Follow the instructions to uninstall the malicious app.

[1172] Example 2: Anomalous Network Activity

[1173] 1. Terminal: When abnormal network activity is detected, the traffic data is recorded.

[1174] 2. Server: The AI ​​model analyzes the traffic data and identifies anomalies.

[1175] 3. Device: A notification is sent to the user, who receives a message saying "Anomalous network activity has been detected."

[1176] 4. User: Check your network settings and make any necessary corrections.

[1177] 5. Terminal: If the user does not respond promptly, the agent will automatically cut off the relevant network connection.

[1178] This allows users to enjoy high security and minimize the effort required to ensure the safety of their devices.The present invention is a system that keeps users' smartphones safe at all times by detecting fraudulent use early and taking prompt measures.

[1179] The processing flow will be explained below.

[1180] Step 1:

[1181] User: Download and install the anti-tool app from the smartphone app store. Once the installation is complete, launch the app to begin the initial setup.

[1182] Step 2:

[1183] Device: When the device is launched for the first time, the user is asked to set permissions (e.g., permission to use the app, permission to notify) so that the agent can start operating in the background.

[1184] Step 3:

[1185] User: Grant the necessary permissions and complete the setup. From then on, the agent will monitor in the background.

[1186] Step 4:

[1187] Device: The agent monitors application behavior and network traffic on the smartphone and periodically collects monitoring data.

[1188] Step 5:

[1189] On the device: The collected monitoring data is encrypted and periodically sent to a server using a secure encryption protocol, ensuring the data remains confidential.

[1190] Step 6:

[1191] Server: The server decodes the received monitoring data and performs real-time analysis using generative AI models to detect malicious behavior patterns and anomalies.

[1192] Step 7:

[1193] Server: When an anomaly is detected, it classifies the type and impact of the anomaly and generates a detailed report.

[1194] Step 8:

[1195] Server: Generates a message to notify the user about the detected abnormality and sends instructions to the device, including how to deal with the problem.

[1196] Step 9:

[1197] On the device: A message is received and displayed as a notification pop-up to the user, providing specific instructions to the user, such as "A malicious app has been detected. Please uninstall it."

[1198] Step 10:

[1199] User: Check the notification and follow the instructions to take necessary action, such as uninstalling the malicious app or changing settings.

[1200] Step 11:

[1201] Device: If the user does not take prompt action, the agent will automatically take measures such as cutting off the network connection to minimize the impact of malicious activity.

[1202] Step 12:

[1203] Server: Regularly updates and trains the generative AI model based on new threat information. By always maintaining the latest model, it is possible to respond quickly to new threats.

[1204] Step 13:

[1205] Server: Distributes updated generative AI models to devices, allowing the device agents to monitor and take countermeasures based on the latest information.

[1206] Step 14:

[1207] Devices: Automatically receive and apply new models, allowing users to enjoy the latest security measures without any special action.

[1208] Through the above processing steps, the present invention provides an advanced security system that monitors smartphones in real time, detects fraudulent use, and responds promptly.

[1209] Example 1

[1210] Next, a description will be given of Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the headset type terminal 314 will be referred to as a "terminal."

[1211] In today's digital environment, it is difficult to effectively monitor and counter the increasing threats of fraudulent behavior and data leaks in real time. To solve this problem, continuous monitoring of user devices, anomaly detection, and rapid response are essential, but this has been difficult to achieve with conventional systems. Automatic response is also necessary if users do not promptly address fraudulent behavior. Furthermore, regular updates to keep system security up to date is also a challenge.

[1212] The specific processing by the specific processing unit 290 of the data processing device 12 in the first embodiment is realized by the following means.

[1213] In this invention, the server includes: a means for installing an agent on a user's terminal and running it in the background to monitor application operation and network traffic; a means for encrypting the monitored data and transmitting it from the terminal to the server; a means for analyzing the received data in real time using a generative AI model on the server to detect abnormal behavioral patterns; a means for notifying the user of the detected abnormality and providing a solution; a means for updating the generative AI model based on new threat information and distributing automatic updates from the server to the terminal; a means for the agent to automatically disconnect the network connection if the user's action is delayed; and a means for the agent to send the terminal's system information and initial settings to the server and begin continuous monitoring. This enables real-time detection of fraudulent behavior and data leaks and prompt countermeasures. Furthermore, automatic response is also possible if the user does not respond promptly, and the latest security measures are always applied to the terminal, improving the security of the entire system.

[1214] "User terminal" refers to a computer device such as a smartphone or tablet used by a user.

[1215] An "agent" is a program that is installed on a user's device, runs in the background, and monitors device activity and network traffic.

[1216] "Running in the background" means that the program continues to run behind the system without affecting the user's operations.

[1217] "Application operation" refers to the execution state and behavior of a software program installed on a user terminal.

[1218] "Network traffic" refers to the flow of data sent and received between user terminals and other network devices.

[1219] "Monitoring data" refers to application operation logs and detailed network traffic information collected by the agent.

[1220] "Encryption" refers to the transformation of data using a specific algorithm to protect it from unauthorized access by third parties.

[1221] "Server" refers to the computer system that receives monitoring data, analyzes it, runs generative AI models, notifies and manages information.

[1222] A "generative AI model" refers to a system that uses artificial intelligence algorithms trained on large amounts of data to analyze data and detect patterns of fraudulent behavior.

[1223] "Abnormal behavior patterns" refer to unauthorized actions or unusual operations that deviate from normal behavior.

[1224] "Notification" means sending a warning to the user about a detected abnormality and how to deal with it, and is displayed on the terminal screen as a pop-up message or the like.

[1225] "Countermeasures" refer to specific steps or actions to correct a detected abnormality.

[1226] "Automatic update" refers to the automatic distribution and application of new versions of generative AI models from the server to user devices.

[1227] "Blocking network connections" refers to a measure to prevent potentially fraudulent behavior by halting network access by a user device.

[1228] "Initial settings" refers to the basic information and configuration of the device that the agent collects immediately after installation.

[1229] "Real-time" refers to a state in which processing and analysis are carried out immediately in real time.

[1230] This invention is a generative AI-based anti-tool system that enhances security by installing an agent on a user's device and monitoring, detecting, notifying, and responding to malicious activity in real time. Specific embodiments of this system will be described in detail.

[1231] Hardware and Software Configuration

[1232] 1. Terminal-side agent

[1233] Device: Install an agent program on your smartphone or tablet that runs in the background and monitors application activity and network traffic.

[1234] Agent app: Dedicated application software that users install.

[1235] 2. Data Encryption and Transmission

[1236] Terminal: The monitoring data is encrypted and sent to the server using a strong security protocol such as AES (Advanced Encryption Standard).

[1237] 3. Server-side generated AI models

[1238] Server: The generative AI model deployed on the server performs real-time analysis of the received monitoring data. The generative AI model identifies fraudulent behavior patterns and detects anomalies.

[1239] 4. Anomaly detection and notification

[1240] Server: When an abnormality is detected, a summary of the abnormality and a solution are generated and notified to the user terminal via the agent.

[1241] 5. User Actions and Automatic Countermeasures

[1242] Terminal: The user receives the notification and follows the instructions displayed to take countermeasures. If the user does not take prompt action, the agent will automatically cut off the network connection.

[1243] 6. System Updates

[1244] Server: Regularly updates the generative AI model based on new threat information to maintain the latest defense capabilities. Updated models are automatically distributed to devices.

[1245] Specific examples of processing

[1246] Example 1: Installing a malicious app

[1247] 1. Device: When a malicious app is installed, the agent records the application's behavior as monitoring data.

[1248] 2. Server: Inputs the received data into the generative AI model to detect fraudulent behavior and generates alerts when anomalies are identified.

[1249] 3. On the device: A notification is sent to the user with the message "Malware detected."

[1250] 4. User: Follow the instructions to uninstall the malicious app.

[1251] 5. Device: If the user does not respond promptly, the agent will automatically cut off communication for that app.

[1252] Example 2: Anomalous Network Activity

[1253] 1. Terminal: When abnormal network activity is detected, the agent records the traffic data.

[1254] 2. Server: The AI ​​model analyzes the traffic data and identifies anomalies.

[1255] 3. Device: A notification is sent to the user with the message "Anomalous network activity detected."

[1256] 4. User: Check your network settings and make any necessary corrections.

[1257] 5. Terminal: If the user does not respond promptly, the agent will automatically cut off the relevant network connection.

[1258] Prompt Sentence Examples

[1259] "Please tell me the program flow to determine whether a newly installed app is a malicious app or not and notify me."

[1260] "Please provide detailed instructions on what specific steps you will take if abnormal network activity is detected."

[1261] This invention allows users to enjoy high security and minimize the effort required to ensure the safety of their devices.The system keeps users' smartphones safe at all times by detecting fraudulent use early and taking prompt measures.

[1262] The flow of the identification process in the first embodiment will be described with reference to FIG.

[1263] Step 1: Install and initialize the agent

[1264] Device: The user installs the agent app on their smartphone or tablet. When the agent launches, it collects and encrypts the device's system information (e.g., OS version, device ID, list of installed applications). This encrypted data is then sent to the server.

[1265] Input: The user installs the agent app and starts its initialization.

[1266] Output: Encrypted device system information is sent to the server.

[1267] Step 2: Continuous monitoring of the device

[1268] On the device: The agent runs in the background, monitoring application behavior and network traffic in real time. If a newly installed app or unusual network activity is detected, details are recorded in a log.

[1269] Input: Application activity and network traffic on the device.

[1270] Output: Recorded as monitoring data and periodically sent to a server.

[1271] Step 3: Encrypt and send data

[1272] On the device: Collected monitoring data is encrypted using AES encryption. This data includes application activity logs and network traffic details. The encrypted data is then sent to a server for secure communication.

[1273] Input: Collected unencrypted surveillance data.

[1274] Output: Encrypted monitoring data is sent to the server.

[1275] Step 4: Data analysis by the server

[1276] Server: Decrypts the received encrypted data and inputs it into the generative AI model. The generative AI model analyzes the received data in real time and detects abnormal behavioral patterns. For example, if a specific app is sending or receiving an abnormally large amount of data, the generative AI model will determine that this is fraudulent behavior.

[1277] Input: Decoded surveillance data.

[1278] Output: Verification result of abnormal behavior pattern.

[1279] Step 5: Anomaly detection and user notification

[1280] Server: Generates detailed reports of detected anomalies and creates notification messages with solutions. The notification content includes a detailed description of the anomaly and recommended actions, and is sent to the device via the agent.

[1281] Device: A notification will appear as a pop-up on the device screen, informing the user that an anomaly has been detected.

[1282] Input: Abnormal behavior pattern determination result.

[1283] Output: The notification message sent to the user.

[1284] Step 6: User Coping Behavior

[1285] Users: Check the notification and follow the instructions to take measures such as uninstalling the malicious app or reviewing network settings. For example, if you receive a notification that a malicious app has been detected, uninstall the app.

[1286] Input: The notification message sent to the user.

[1287] Output: User action (e.g., uninstalling the app).

[1288] Step 7: Implementing automated measures

[1289] Terminal: If the user does not take action promptly, the agent will automatically take action, for example, if abnormal network activity continues, it will cut off the network connection to block the traffic.

[1290] Input: Situations where the user does not take action.

[1291] Output: The automatic action to be taken (e.g., blocking the network connection).

[1292] Step 8: Update the system and AI model

[1293] Server: Collects new threat information, trains and updates the generative AI model, and periodically updates the model, distributing the updated model to the device.

[1294] On the device: The agent automatically applies the new model, ensuring the latest security measures are in place.

[1295] Input: New threat information and a trained generative AI model.

[1296] Output: The latest generative AI model applied to the device.

[1297] This is the flow of program processing for this system, which allows users to enjoy high security and minimize the effort required to ensure the safety of their terminals.

[1298] (Application example 1)

[1299] Next, a description will be given of Application Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the headset type terminal 314 will be referred to as a "terminal."

[1300] Conventional security systems often have difficulty detecting malicious activity in real time, forcing users to manually implement countermeasures. This makes it difficult to minimize the impact of malicious behavior and poses a risk to the security of user devices. Furthermore, if users do not respond quickly, malicious behavior can lead to more serious problems, so a system that can quickly and automatically implement countermeasures is needed.

[1301] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 1 is realized by the following means.

[1302] In this invention, the server includes means for analyzing received data in real time using a generative AI model to detect abnormal behavioral patterns, means for notifying the user of the detected abnormality and providing a solution, and means for automatically uninstalling the malicious application or cutting off the network connection if the user does not take appropriate action. This makes it possible to detect fraudulent behavior in real time and implement countermeasures quickly and automatically.

[1303] An "agent" is software that is installed on a user's terminal and runs in the background to monitor application operations and network traffic.

[1304] A "generative AI model" is an artificial intelligence model that runs on a server and analyzes monitoring data sent from user devices in real time to detect abnormal behavioral patterns.

[1305] "Encryption" is a technology that converts monitoring data so that it cannot be deciphered by third parties, enabling the secure transmission of data.

[1306] An "anomalous behavior pattern" is a pattern indicative of unexpected or unauthorized system behavior or network traffic.

[1307] A "notification" is a message that provides the user with information about a detected abnormality and instructs them on how to deal with it.

[1308] "Network disconnection" is a procedure in which a user terminal is temporarily disconnected from the Internet or other networks when fraudulent activity is detected.

[1309] An "update" is an update procedure that allows the system to improve the generative AI model based on new threat information and provide new defensive capabilities to the device.

[1310] "Malicious applications" are applications that may cause harm to user devices and are often installed from sources other than legitimate stores.

[1311] This invention relates to a generative AI-based anti-tool system that installs an agent on a user's device to monitor, detect, notify, and respond to malicious activity in real time. This system works particularly effectively on smartphones.

[1312] System Components

[1313] 1. Terminal-side agent

[1314] An agent is installed on the user's device (smartphone). The agent runs in the background and continuously monitors application activity and network traffic. Because it runs as a background process independent of user actions, the user is unaware of the monitoring.

[1315] 2. Data Encryption and Transmission

[1316] The agents collect monitoring data and send it to a server in an encrypted form using strong security protocols such as public key cryptography.

[1317] 3. Server-side generated AI models

[1318] The generative AI model is placed on the server and performs real-time analysis of the received monitoring data. The generative AI model identifies fraudulent behavior patterns and detects anomalies.

[1319] 4. Anomaly detection and notification

[1320] When an abnormality is detected on the server, a summary of the problem and a solution are generated and sent to the user's device via the agent. The notification is displayed as a pop-up on the device screen, allowing the user to check the solution.

[1321] 5. Automatic Countermeasures

[1322] If the user does not respond promptly, the agent will automatically take measures such as cutting off the network connection or uninstalling the malicious application.

[1323] 6. System Updates

[1324] The server periodically updates the generative AI model based on new threat information to maintain up-to-date defense capabilities, and the updated model is automatically distributed to devices.

[1325] Example of a system

[1326] Example 1: Detecting the installation of fraudulent apps

[1327] 1. Terminal-side agent

[1328] When a user installs a malicious app, the application's behavior is recorded as monitoring data.

[1329] 2. Data Encryption and Transmission

[1330] The monitoring data is encrypted and sent to a server.

[1331] 3. Server-side generated AI models

[1332] Generative AI models analyze data in real time to detect fraudulent behavior.

[1333] 4. Anomaly detection and notification

[1334] The server detects the abnormality and notifies the user device that a malicious app has been detected. The user is then instructed to uninstall the malicious app.

[1335] 5. Automatic Countermeasures

[1336] If the user does not take immediate action, the agent will automatically uninstall the malicious app.

[1337] Example 2: Detecting anomalous network activity

[1338] 1. Terminal-side agent

[1339] When abnormal network activity is detected, the traffic data is recorded.

[1340] 2. Data Encryption and Transmission

[1341] The traffic data is encrypted and sent to the server.

[1342] 3. Server-side generated AI models

[1343] AI models analyze traffic data and identify anomalous activity.

[1344] 4. Anomaly detection and notification

[1345] When an anomaly is detected, a notification is sent to the user device stating that "anomalous network activity has been detected." The user is then instructed to check their network settings and make any necessary corrections.

[1346] 5. Automatic Countermeasures

[1347] If the user does not respond promptly, the agent will automatically cut off the relevant network connection.

[1348] Prompt Sentence Examples

[1349] "A malicious application has been detected. Please uninstall it immediately."

[1350] "Abnormal network traffic has been detected. Please check your network settings."

[1351] This allows users to enjoy high security and minimize the effort required to ensure the safety of their devices.The present invention provides a means to keep users' smartphones safe at all times by detecting fraudulent behavior early and taking prompt measures.

[1352] The flow of the specific processing in the application example 1 will be described with reference to FIG.

[1353] Step 1:

[1354] Installing and initializing the terminal agent

[1355] Input: Application installation request

[1356] Operation: The user installs the agent on the device and performs the initial setup. The agent then starts running in the background, ready to monitor application activity and network traffic regardless of user interaction.

[1357] Output: The status of the agent running in the background

[1358] Step 2:

[1359] Starting the virus detection process

[1360] Input: Execution by terminal agent

[1361] How it works: The agent continuously monitors applications running on the device and network traffic, collecting data to detect malicious activity.

[1362] Output: Application operation log, network traffic data

[1363] Step 3:

[1364] Encrypting data and sending it to the server

[1365] Input: Application operation logs, network traffic data

[1366] How it works: Collected data is encrypted using public key cryptography and securely sent to a server.

[1367] Output: Encrypted monitoring data

[1368] Step 4:

[1369] Analysis using server-side generated AI models

[1370] Input: Encrypted surveillance data

[1371] How it works: A server-based generative AI model receives surveillance data, decodes it, and analyzes it in real time to detect anomalous behavioral patterns.

[1372] Output: Abnormal behavior pattern detection results

[1373] Step 5:

[1374] Anomaly detection and user notification

[1375] Input: Abnormal behavior pattern detection results

[1376] Operation: The server generates a notification message containing a detailed explanation of the detected anomaly and how to resolve it, and sends it to the user's device via the agent.

[1377] Output: A message to inform the user

[1378] Step 6:

[1379] User Action

[1380] Input: Notification message

[1381] How it works: The user receives a notification message and follows the instructions to uninstall the malicious app and fix their network settings.

[1382] Output: User action

[1383] Step 7:

[1384] Implementing automatic countermeasures

[1385] Input: Detection when no countermeasures are taken by the user

[1386] How it works: If the user does not take action quickly enough, the agent will automatically block network connections and uninstall the malicious application.

[1387] Output: Blocking network connections, uninstalling malicious applications

[1388] Step 8:

[1389] System Updates

[1390] Input: New threat information

[1391] How it works: The server collects new threat information, trains and updates the generative AI model, and periodically pushes the updated model to the device and applies it automatically.

[1392] Output: Delivery and application of updated generative AI models

[1393] Furthermore, an emotion engine that estimates the user's emotion may be further combined. That is, the identification processing unit 290 may estimate the user's emotion using the emotion identification model 59, and perform identification processing using the user's emotion.

[1394] This invention combines a generative AI-based anti-tool system with an emotion engine that recognizes user emotions, and is a system for strengthening the security of smartphones and tablets. Specifically, an agent installed on the user's device monitors application behavior and network traffic, and uses the emotion engine to take appropriate action based on the user's emotional state.

[1395] System Components

[1396] 1. Terminal-side agent

[1397] Terminal: An agent program is installed on the user's terminal and runs in the background. The agent monitors application activity and network traffic.

[1398] 2. Data Encryption and Transmission

[1399] Terminal: The agent encrypts the collected monitoring data and periodically sends it to the server.

[1400] 3. Server-side generated AI models

[1401] Server: Analyzes incoming data in real time using generative AI models to detect fraudulent behavioral patterns and anomalies.

[1402] 4. Anomaly detection and notification

[1403] Server: Based on the detected abnormality, a message including a solution is generated and sent to the device.

[1404] 5. Emotion Engine

[1405] Device: The emotion engine analyzes the user's voice, facial expressions, input patterns, etc. to recognize the user's emotional state.

[1406] 6. Emotion-Based Notification Adjustment

[1407] On the device: Based on the analysis results of the emotion engine, the content and frequency of notifications are adjusted according to the user's emotional state. For example, if the user is in a state of high stress, the content of notifications will be simplified and the countermeasures will be changed to something that is intuitively understandable.

[1408] 7. User and Automatic Countermeasures

[1409] User: Follow the notification and take the appropriate action.

[1410] Device: If the user does not respond promptly, measures such as automatically cutting off the network connection will be taken.

[1411] 8. System Updates

[1412] Server: Regularly updates the generative AI model based on new threat information and delivers automatic updates to devices.

[1413] Explanation of program processing

[1414] The program processing of the system will be explained in natural language below.

[1415] Operation of the terminal agent

[1416] On the device: After the user installs the agent, it monitors application activity and network traffic, collecting monitoring data that is then encrypted and sent to a server.

[1417] Data transmission and analysis

[1418] Server: Inputs the received data into the generative AI model and performs real-time analysis. If an abnormal behavioral pattern is detected, a detailed report is generated and sent to the device along with countermeasures.

[1419] Emotion Engine Operation

[1420] Device: The emotion engine analyzes data such as the user's voice and facial expressions in real time to recognize the user's emotional state.

[1421] Emotion-based notification adjustment

[1422] Device: Adjust the content and frequency of notifications based on the user's emotional state. For example, if the user is stressed, notifications will be displayed in a simple and understandable way.

[1423] User actions and automatic measures

[1424] User: Follow the notification and uninstall the malicious app or change your network settings.

[1425] Device: If the user does not respond quickly, the agent will automatically cut off the network connection, minimizing the impact of malicious activity.

[1426] System Updates

[1427] Server: Trains generative AI models based on new threat information and distributes the latest versions to devices.

[1428] Device: Automatically applies updates to keep your security up to date.

[1429] Specific examples

[1430] Example 1: Installing a malicious app

[1431] 1. Device: Once a malicious app is installed, the agent monitors its behavior and collects data.

[1432] 2. Server: Generative AI models detect fraudulent behavior and identify anomalies.

[1433] 3. On the device: The emotion engine analyzes the user's emotional state and, for example, if they are feeling stressed, it will display a simplified notification.

[1434] 4. User: Follow the instructions and uninstall the malicious app.

[1435] Example 2: Anomalous Network Activity

[1436] 1. Terminal: When abnormal network activity is detected, traffic data is collected.

[1437] 2. Server: The generative AI model analyzes the data and identifies anomalies.

[1438] 3. On the device: The emotion engine analyzes the user's emotional state and sends detailed notifications if the user is relaxed.

[1439] 4. User: Follow the notification and change your network settings.

[1440] 5. Device: If the user does not take prompt action, the device will automatically shut down the network connection.

[1441] In this way, by combining a generative AI-based anti-tool system with an emotion engine, the present invention realizes flexible notifications and responses that take into account the user's emotional state, allowing users to enjoy a stress-free operating experience while maintaining high security.

[1442] The processing flow will be explained below.

[1443] Step 1:

[1444] User: Download and install the anti-tool app from the smartphone app store. Once the installation is complete, launch the app to begin the initial setup.

[1445] Step 2:

[1446] Device: When the device is launched for the first time, the user is asked to set permissions (e.g., permission to use the app, permission to notify) so that the agent can start operating in the background.

[1447] Step 3:

[1448] User: Grant the necessary permissions and complete the setup. From then on, the agent will monitor in the background.

[1449] Step 4:

[1450] Device: The agent monitors application behavior and network traffic on the smartphone and periodically collects monitoring data.

[1451] Step 5:

[1452] On the device: The collected monitoring data is encrypted and periodically sent to a server using a secure encryption protocol, ensuring the data remains confidential.

[1453] Step 6:

[1454] Server: The server decodes the received monitoring data and performs real-time analysis using generative AI models to detect malicious behavior patterns and anomalies.

[1455] Step 7:

[1456] Server: When an anomaly is detected, it classifies the type and impact of the anomaly and generates a detailed report.

[1457] Step 8:

[1458] Server: Generates a message to notify the user about the detected abnormality and sends instructions to the device, including how to deal with the problem.

[1459] Step 9:

[1460] On the device: A message is received and displayed as a notification pop-up to the user, providing specific instructions to the user, such as "A malicious app has been detected. Please uninstall it."

[1461] Step 10:

[1462] Device: The emotion engine analyzes the user's voice, facial expressions, and input patterns in parallel to recognize the user's emotional state.

[1463] Step 11:

[1464] Device: Adjust the content and frequency of notifications based on the user's emotional state. For example, if the user is in a stressful state, the notification content will be simplified and the solution will be more intuitive.

[1465] Step 12:

[1466] User: Check the notification and follow the instructions to take necessary action, such as uninstalling the malicious app or changing settings.

[1467] Step 13:

[1468] Device: If the user does not take prompt action, the agent will automatically take measures such as cutting off network connections to minimize the impact of malicious activity.

[1469] Step 14:

[1470] Server: Regularly updates and trains the generative AI model based on new threat information. By always maintaining the latest model, it is possible to respond quickly to new threats.

[1471] Step 15:

[1472] Server: Distributes updated generative AI models to devices, allowing the device agents to monitor and take countermeasures based on the latest information.

[1473] Step 16:

[1474] Devices: Automatically receive and apply new models, allowing users to enjoy the latest security measures without any special action.

[1475] By combining the above processing steps with an emotion engine, the present invention realizes flexible notification and response that takes into account the user's emotional state, allowing users to enjoy high security and a stress-free operating experience.

[1476] Example 2

[1477] Next, a description will be given of Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the headset type terminal 314 will be referred to as a "terminal."

[1478] While modern smartphones and tablets offer convenience and many applications and network services, they are also facing increasing threats such as malicious applications, phishing, and malware. This creates a need for high levels of device security, but conventional systems have struggled to respond flexibly and take into account the user's emotional state. The present invention aims to address these issues.

[1479] The identification process by the identification processing unit 290 of the data processing device 12 in the second embodiment is realized by the following means. In this invention, the server includes means for installing an agent on a user terminal and running it in the background to monitor application operations and network traffic, means for encrypting the monitored data and transmitting it to the server, means for analyzing received data in real time using a generative AI model on the server and detecting abnormal behavioral patterns, means for notifying the user of the detected abnormality and providing a solution, and means for analyzing the user's voice, facial expressions, and input patterns using an emotion engine and adjusting the content and frequency of notifications based on the user's emotional state. This enables flexible and advanced security measures that take the user's emotional state into consideration.

[1480] An "agent" is software that is installed on a user's terminal, runs in the background, and monitors application operations and network traffic.

[1481] "Monitoring Data" refers to application operation information and network traffic information collected by the Agent.

[1482] A "generative AI model" is an artificial intelligence-based analytical model that analyzes incoming data in real time and detects abnormal behavioral patterns.

[1483] A "notification" is a message that notifies the user of an abnormality detected by the server and provides a solution to the problem.

[1484] An "emotion engine" is software that analyzes a user's voice, facial expressions, and input patterns to recognize the user's emotional state.

[1485] "Encryption" refers to the process of converting surveillance data into a format that cannot be deciphered by third parties.

[1486] "Blocking network connectivity" refers to temporarily disabling a device's network access to prevent fraudulent trading activity or attacks.

[1487] "Automatic updates" refers to the process of delivering the latest security measures based on new threat information from a server to a device and automatically applying the updates.

[1488] This invention is an anti-tool system that uses a generative AI model and realizes more flexible and advanced security measures by taking into account the user's emotional state. This system is installed on the user's device, such as a smartphone or tablet, and constantly runs in the background to monitor security.

[1489] A specific embodiment of the present invention will now be described.

[1490] Required Hardware and Software

[1491] Hardware: Mobile devices such as smartphones and tablets

[1492] software:

[1493] Agent program: Installed on the user's terminal, it monitors application behavior and network traffic.

[1494] Generative AI model: Uses a deep learning model based on ResNet to detect anomalous behavioral patterns.

[1495] Emotion engine: Utilizes OpenFace and IBM Watson emotion analysis engines to analyze the user's emotional state.

[1496] Backend servers: Hosted on AWS EC2 or Google Cloud Platform.

[1497] System Overview

[1498] An agent program is installed on the device and runs in the background to monitor application behavior and network traffic. The monitored data is AES-256 encrypted and sent to a server. On the server, the data is analyzed by a generative AI model, and if an abnormality is detected, a detailed report is generated and the user is notified along with how to deal with it. An emotion engine then analyzes the user's emotional state and determines the appropriate notification method based on that state.

[1499] Specific example explanation

[1500] Example 1: Installing a malicious app

[1501] 1. Device: Once a malicious app is installed, the agent monitors its behavior and collects data.

[1502] 2. Server: The generative AI model analyzes the incoming data and detects fraudulent behavior.

[1503] 3. On the device: The emotion engine analyzes the user's emotional state and displays simplified notifications if the user is feeling stressed.

[1504] 4. User: Follow the instructions and uninstall the malicious app.

[1505] Example 2: Anomalous Network Activity

[1506] 1. Terminal: Anomalous network activity is detected and traffic data is collected.

[1507] 2. Server: The generative AI model analyzes the data and identifies anomalies.

[1508] 3. On the device: The emotion engine analyzes the user's emotional state and sends detailed notifications if the user is relaxed.

[1509] 4. User: Follow the notification and change your network settings.

[1510] 5. Device: If the user does not take prompt action, the device will automatically shut down the network connection.

[1511] Prompt Sentence Examples

[1512] 1. Generate an explanation of a system that combines generative AI-based anti-tools with an emotional engine to enhance the security of smartphones and tablets.

[1513] 2. Describe how an agent installed on a user device can monitor application behavior and network traffic, encrypt collected data, and send it to a server for real-time analysis using a generative AI model.

[1514] Through these specific examples, the present invention can realize flexible security measures that take into account the emotional state of the user, thereby maintaining a high level of security for the terminal.

[1515] The flow of the identification process in the second embodiment will be described with reference to FIG.

[1516] Specific explanation of program processing

[1517] Step 1: Install and start the agent

[1518] On the device, the user installs the agent program and it starts running in the background. Once installed, the agent runs as a system process and, with the user's permission, begins monitoring application activity and network traffic.

[1519] Input: Agent installation file

[1520] Output: The agent starts running in the background.

[1521] Step 2: Monitor application behavior and network traffic

[1522] On the device, the agent monitors the behavior of installed applications and network traffic in real time. For example, when a new application is installed, it collects the application's communication details, CPU usage, memory usage, etc.

[1523] Input: Application behavior data and network traffic data

[1524] Output: Monitoring data collection (log file)

[1525] Step 3: Encrypt monitoring data

[1526] Terminal: Collected monitoring data is encrypted with AES-256. Specifically, the encryption process is performed on each batch of collected data once it reaches a certain size.

[1527] Input: Monitoring data

[1528] Output: Encrypted data

[1529] Step 4: Sending monitoring data to the server

[1530] Terminal: Periodically send encrypted data to the server. For example, every 10 minutes, upload the encrypted data to the server using the HTTPS protocol.

[1531] Input: Encrypted data

[1532] Output: Data sent to the server

[1533] Step 5: Receiving and Decrypting Data

[1534] Server: Receives the data sent from the device and decrypts it using AES-256. Specifically, the server passes the received data to a dedicated decryption module, which returns it to its original data format.

[1535] Input: Encrypted data

[1536] Output: Decrypted data

[1537] Step 6: Parse the received data

[1538] Server: The decrypted data is fed into the generative AI model for real-time analysis. This analysis includes detecting anomalous behavioral patterns. For example, if the model detects specific fraudulent activity in the data, it generates an anomaly report.

[1539] Input: Decrypted surveillance data

[1540] Output: Anomalous behavior report

[1541] Step 7: Anomaly detection and notification generation

[1542] Server: When the generative AI model detects an anomaly, it generates a detailed report and countermeasures and notifies the device. Specifically, it creates a notification containing a warning message and countermeasures based on the abnormal behavior report.

[1543] Input: Anomalous Behavior Report

[1544] Output: Information message

[1545] Step 8: Emotional state analysis by the emotion engine

[1546] Device: The emotion engine analyzes the user's voice, facial expressions, and input patterns in real time to assess the user's emotional state. Specifically, the emotion engine analyzes the user's actions, such as speaking to the screen, typing, and looking at the facial recognition camera.

[1547] Input: User voice, facial expressions, and input patterns

[1548] Output: Emotional state data

[1549] Step 9: Adjust notifications based on emotion

[1550] Device: Based on the analysis results of the emotion engine, the content and frequency of notifications are set appropriately according to the user's emotional state. For example, if the emotion engine determines that the user is feeling stressed, the content of notifications will be simplified and the frequency of notifications will be reduced.

[1551] Input: Emotional state data, notification message

[1552] Output: The adjusted notification message

[1553] Step 10: User actions and automated measures

[1554] Users: Follow the notification message and take appropriate measures such as uninstalling the malicious app or changing network settings. For example, follow the instructions to delete the app if it says "A malicious app has been detected on your device. Please uninstall it."

[1555] Input: Notification message

[1556] Output: Response action

[1557] Terminal: If the user does not respond promptly, the agent will automatically cut off the network connection, for example, by taking an action such as "The network connection has been temporarily cut off."

[1558] Input: User response delay

[1559] Output: Automatic countermeasure execution

[1560] Step 11: Update your system

[1561] Server: Trains the generative AI model based on new threat information and delivers the latest security information to devices. For example, it updates the model once a week and delivers security patches.

[1562] Input: New threat information

[1563] Output: Updated generative AI model, security patches

[1564] Device: Automatically apply received updates to keep your security up to date.

[1565] Input: security patch

[1566] Output: Updated security state

[1567] The above is a detailed description of the specific processing flow in the system of the present invention. The intention is that a series of processes for highly protecting user terminals will be executed rationally and effectively.

[1568] (Application example 2)

[1569] Next, a description will be given of Application Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the headset type terminal 314 will be referred to as a "terminal."

[1570] While conventional security systems have the ability to monitor user device operation and network traffic and detect abnormalities, they do not provide notifications and responses that take into account the user's psychological state. As a result, even when users are in a state of high stress, they receive complex notifications and are unable to take appropriate action. This can result in ineffective measures being taken in situations where a quick response is required.

[1571] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 2 is realized by the following means.

[1572] In this invention, the server is a generative AI-based anti-tool system that includes: means for installing an agent on a user terminal and running it in the background to monitor application operation and network traffic; means for encrypting the monitored data and transmitting it to the server; means for analyzing the received data in real time using a generative AI model on the server to detect abnormal behavioral patterns; means for notifying the user of the detected abnormality and providing countermeasures; means for adjusting the content and frequency of notifications using an emotion engine that analyzes the user's emotions; and means for updating the generative AI model based on new threat information and distributing automatic updates from the server to the terminal. This enables flexible notifications and responses that take the user's psychological state into consideration, and promotes appropriate responses in high-stress situations.

[1573] A "generative AI model" is an artificial intelligence model that performs real-time analysis using data collected from user devices to detect fraudulent behavioral patterns and anomalies.

[1574] An "anti-tool system" is a system that monitors applications and network traffic on user terminals to detect unauthorized behavior and abnormalities.

[1575] An "agent" is a program that is installed on a user's terminal and runs in the background to monitor application operations and network traffic.

[1576] "Encryption" is a technology that prevents surveillance data from being deciphered by third parties by converting the data using a specific algorithm.

[1577] The "emotion engine" is a system that analyzes data such as the user's voice, facial expressions, and input patterns to recognize the user's emotional state in real time.

[1578] "Means" are methods or techniques for achieving a specific purpose.

[1579] The "server" is a central control device that analyzes data, detects anomalies, updates generative AI models, and sends notifications.

[1580] "Background" means that the system operates automatically behind the scenes, invisible to the user.

[1581] "Network traffic" refers to the transmission and reception of data between a user terminal and the Internet or other network.

[1582] A "notification" is a message or instruction that is displayed to the user when an abnormality is detected.

[1583] "Automatic updates" refers to a function that regularly updates the generative AI model based on new threat information and delivers the latest version to the user's device.

[1584] MODE FOR CARRYING OUT THE INVENTION

[1585] This invention combines a generative AI-based anti-tool system with an emotion engine that recognizes user emotions, and is a system for strengthening the security of smartphones and tablets. Specifically, an agent installed on the user's device monitors application behavior and network traffic, and uses the emotion engine to take appropriate action based on the user's emotional state.

[1586] System Components

[1587] 1. Terminal-side agent

[1588] Terminal: An agent program is installed on the user's terminal and runs in the background. The agent monitors application activity and network traffic, encrypts the monitored data, and temporarily stores it in SQLite.

[1589] 2. Data Encryption and Transmission

[1590] Terminal: The monitoring data collected by the agent is encrypted using the AES algorithm and periodically sent to the server via HTTP communication.

[1591] 3. Server-side generated AI models

[1592] Server: The server uses TensorFlow to build a generative AI model to analyze incoming data in real time, detect fraudulent behavior patterns and anomalies, and generate detailed reports using a Flask application.

[1593] 4. Anomaly detection and notification

[1594] Server: Based on the detected abnormality, a message including a solution is generated and sent to the device.

[1595] 5. Emotion Engine

[1596] On the device: The emotion engine uses OpenCV to analyze the user's voice and facial expressions, and Librosa to analyze the voice data, thereby recognizing the user's emotional state in real time.

[1597] 6. Emotion-Based Notification Adjustment

[1598] On the device: Based on the analysis results of the emotion engine, the content and frequency of notifications are adjusted according to the user's emotional state. For example, if the user is in a state of high stress, the content of notifications will be simplified and the countermeasures will be changed to something that is intuitively understandable.

[1599] 7. User and Automatic Countermeasures

[1600] User and device: The user takes the appropriate action based on the notification. If the user does not respond promptly, the agent will automatically take measures such as cutting off the network connection.

[1601] 8. System Updates

[1602] Server and device: The server trains the generative AI model based on new threat information and distributes the latest version to the device, which then automatically applies updates to maintain the latest security measures.

[1603] Specific examples

[1604] Example 1: Installing a malicious app

[1605] 1. Device: Once a malicious app is installed, the agent monitors its behavior and collects data.

[1606] 2. Server: Generative AI models detect fraudulent behavior and identify anomalies.

[1607] 3. On the device: The emotion engine analyzes the user's emotional state and displays simplified notifications if the user is in a high-stress state.

[1608] 4. User: Follow the instructions and uninstall the malicious app.

[1609] Example 2: Anomalous Network Activity

[1610] 1. Terminal: When abnormal network activity is detected, traffic data is collected.

[1611] 2. Server: The generative AI model analyzes the data and identifies anomalies.

[1612] 3. On the device: The emotion engine analyzes the user's emotional state and sends detailed notifications if the user is relaxed.

[1613] 4. User: Follow the notification and change your network settings.

[1614] 5. Device: If the user does not take prompt action, the device will automatically shut down the network connection.

[1615] Prompt Sentence Examples

[1616] "Detect malicious behavior in user network traffic and generate notifications based on the results. Simplify notifications if users are in a high-stress state."

[1617] As described above, by combining a generative AI-based anti-tool system with an emotion engine, this invention realizes flexible notification and response that takes into account the user's emotional state, allowing users to enjoy a stress-free operating experience while maintaining high security.

[1618] The flow of the specific processing in the application example 2 will be described with reference to FIG.

[1619] Step 1:

[1620] Terminal: An agent is installed on the user's terminal and runs in the background.

[1621] Input: An agent program is installed on the user terminal.

[1622] Action: The agent starts running in the background immediately after installation, monitoring the behavior of applications and network traffic on the device.

[1623] Output: Obtain application behavior data and network traffic data.

[1624] Step 2:

[1625] Terminal: Encrypts the monitoring data and sends it to the server.

[1626] Input: Application behavior data and network traffic data obtained in step 1.

[1627] Processing: The agent encrypts the monitoring data using the AES algorithm and periodically sends it to the server using HTTP communication.

[1628] Output: Encrypted monitoring data is sent to the server.

[1629] Step 3:

[1630] Server: Analyzes incoming data in real time using a generative AI model to detect abnormal behavioral patterns.

[1631] Input: Encrypted surveillance data sent from the device.

[1632] Processing: Decrypting encrypted data and feeding it into generative AI models using TensorFlow for real-time analysis to detect fraudulent behavioral patterns and anomalies.

[1633] Output: If an anomaly is detected, a detailed report is generated.

[1634] Step 4:

[1635] Server: Notifies the user of any detected anomalies and provides solutions.

[1636] Input: The anomaly details report generated in step 3.

[1637] Action: Use a Flask application to generate a notification for the user based on a detailed report of the anomaly. Send a message to the device with instructions on how to resolve the issue.

[1638] Output: A notification message containing a remedy is sent to the user's terminal.

[1639] Step 5:

[1640] Terminal: Analyzes the user's emotional state using an emotion engine.

[1641] Input: Data on the user's voice, facial expressions, and input patterns.

[1642] Processing: By using OpenCV to analyze facial expressions from camera input and Librosa to analyze audio data, the user's emotional state is recognized in real time.

[1643] Output: The user's emotional state (e.g., high stress, relaxed) is obtained as the analysis result.

[1644] Step 6:

[1645] Device: Adjust the content and frequency of notifications based on the analysis results of the emotion engine.

[1646] Input: A notification message containing the user's emotional state obtained in step 5 and the coping strategies provided in step 4.

[1647] Processing: Based on the analysis results of the emotion engine, the notification content is formatted according to the user's emotional state. For example, if the user is in a high-stress state, the notification will be simplified.

[1648] Output: A customized notification is displayed depending on the user's emotional state.

[1649] Step 7:

[1650] Users and devices: Based on notifications, the system takes the appropriate measures and automatically cuts off network connections if necessary.

[1651] Input: The notification message customized in step 6.

[1652] Action: The user takes corrective action based on the notification. If the user does not take action promptly, the agent automatically cuts off the network connection.

[1653] Output: Network connectivity is cut off, minimizing the impact of malicious activity.

[1654] Step 8:

[1655] Server and device: The generative AI model is updated based on new threat information and automatically distributed to the device.

[1656] Input: New threat information and existing generative AI models.

[1657] Processing: Trains generative AI models based on new threat information and delivers the latest version to devices, which automatically apply the received updates.

[1658] Output: Updated generative AI models and the latest security measures are applied to the device.

[1659] The specific processing unit 290 transmits the result of the specific processing to the headset type terminal 314. In the headset type terminal 314, the control unit 46A causes the speaker 240 and the display 343 to output the result of the specific processing. The microphone 238 acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[1660] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (Internet Search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search <url: https: gemini.google.com ?hl="ja">) and other generation AIs. The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating voice, text data indicating text, and image data indicating an image is also input. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt, and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[1661] In the above embodiment, an example was given in which the specific processing is performed by the data processing device 12, but the technology of the present disclosure is not limited to this, and the specific processing may be performed by the headset type terminal 314.

[1662] [Fourth embodiment]

[1663] FIG. 7 shows an example of the configuration of a data processing system 410 according to the fourth embodiment.

[1664] 7, a data processing system 410 includes a data processing device 12 and a robot 414. An example of the data processing device 12 is a server.

[1665] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 is an example of a "computer" according to the technology of the present disclosure. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[1666] The robot 414 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication I / F 44, and a control target 443. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, the camera 42, and the control target 443 are also connected to the bus 52.

[1667] The microphone 238 receives instructions and the like from the user 20 by receiving voice uttered by the user 20. The microphone 238 captures the voice uttered by the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio in accordance with instructions from the processor 46.

[1668] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the surroundings of user 20 (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[1669] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[1670] The control object 443 includes a display device, LEDs in the eyes, and motors for driving the arms, hands, and feet. The posture and gestures of the robot 414 are controlled by controlling the motors of the arms, hands, and feet. Some of the emotions of the robot 414 can be expressed by controlling these motors. In addition, the facial expressions of the robot 414 can also be expressed by controlling the light emission state of the LEDs in the eyes of the robot 414.

[1671] Fig. 8 shows an example of the main functions of the data processing device 12 and the robot 414. As shown in Fig. 8, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[1672] The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[1673] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[1674] In the robot 414, the processor 46 performs the reception output process. A reception output program 60 is stored in the storage 50. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output process is realized by the processor 46 operating as the control unit 46A in accordance with the reception output program 60 executed on the RAM 48.

[1675] Next, a description will be given of the specific processing performed by the specific processing unit 290 of the data processing device 12. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[1676] The present invention relates to a generative AI-based anti-tool system that enhances security by installing an agent on a user's device to monitor, detect, notify, and respond to malicious activity in real time. Specific embodiments of the system will be described in detail.

[1677] System Components

[1678] 1. Terminal-side agent

[1679] Device: Install an agent program on your smartphone or tablet. The agent runs in the background of the device and monitors application activity and network traffic.

[1680] 2. Data Encryption and Transmission

[1681] Terminal: The monitoring data is encrypted and sent to the server using strong security protocols such as public key cryptography.

[1682] 3. Server-side generated AI models

[1683] Server: The generative AI model is placed on the server and performs real-time analysis of the received monitoring data. The generative AI model identifies fraudulent behavior patterns and detects anomalies.

[1684] 4. Anomaly detection and notification

[1685] Server: When an abnormality is detected, a summary of the abnormality and a solution are generated and notified to the user terminal via the agent.

[1686] 5. User Actions

[1687] User: Upon receiving the notification, the user should follow the instructions displayed and take measures such as uninstalling the malicious app or changing settings.

[1688] 6. Automatic Countermeasures

[1689] Terminal: If the user does not take prompt action, the agent will automatically take measures such as cutting off the network connection.

[1690] 7. System Updates

[1691] Server: Regularly updates the generative AI model based on new threat information to maintain the latest defense capabilities. Updated models are automatically distributed to devices.

[1692] Explanation of program processing

[1693] The program processing of the system will be explained in natural language below.

[1694] Operation of the terminal agent

[1695] On the device: Once the user installs the agent, it continuously monitors system activity, including application installations and network traffic. Because it runs as a background process independent of user actions, the user is unaware of the monitoring.

[1696] Data transmission and analysis

[1697] On the device: The monitored data is encrypted and sent to a server, including application activity logs and network traffic details.

[1698] Server: Inputs the received data into the generative AI model for real-time analysis, detecting abnormal behavioral patterns and identifying those deemed abnormal.

[1699] Anomaly detection and notification

[1700] Server: If an abnormality is detected, a message is generated to notify the user of the details and how to deal with the problem. For example, if a malicious application is detected, the message instructs the user to uninstall the application.

[1701] Device: The notification will pop up on the device screen, allowing the user to see what to do.

[1702] User actions and automatic measures

[1703] User: Upon receiving the notification, the user follows the instructions to uninstall the malicious app or change security settings.

[1704] Terminal: If the user does not take prompt action, the agent will automatically cut off the network connection, minimizing the impact of malicious activity.

[1705] System Updates

[1706] Server: Collects new threat information, trains and updates the generative AI model. Updates are performed periodically, and new models are automatically distributed to devices.

[1707] Device: When a new model is released, the agent automatically applies it, enabling the latest security measures.

[1708] Specific examples

[1709] Example 1: Installing a malicious app

[1710] 1. Device: Once a malicious app is installed, the application's behavior is recorded as monitoring data.

[1711] 2. Server: Receives the data and uses the generative AI model to detect fraudulent behavior and identify anomalies.

[1712] 3. Device: A notification is sent to the user, who receives a message saying "Malware detected."

[1713] 4. User: Follow the instructions to uninstall the malicious app.

[1714] Example 2: Anomalous Network Activity

[1715] 1. Terminal: When abnormal network activity is detected, the traffic data is recorded.

[1716] 2. Server: The AI ​​model analyzes the traffic data and identifies anomalies.

[1717] 3. Device: A notification is sent to the user, who receives a message saying "Anomalous network activity has been detected."

[1718] 4. User: Check your network settings and make any necessary corrections.

[1719] 5. Terminal: If the user does not respond promptly, the agent will automatically cut off the relevant network connection.

[1720] This allows users to enjoy high security and minimize the effort required to ensure the safety of their devices.The present invention is a system that keeps users' smartphones safe at all times by detecting fraudulent use early and taking prompt measures.

[1721] The processing flow will be explained below.

[1722] Step 1:

[1723] User: Download and install the anti-tool app from the smartphone app store. Once the installation is complete, launch the app to begin the initial setup.

[1724] Step 2:

[1725] Device: When the device is launched for the first time, the user is asked to set permissions (e.g., permission to use the app, permission to notify) so that the agent can start operating in the background.

[1726] Step 3:

[1727] User: Grant the necessary permissions and complete the setup. From then on, the agent will monitor in the background.

[1728] Step 4:

[1729] Device: The agent monitors application behavior and network traffic on the smartphone and periodically collects monitoring data.

[1730] Step 5:

[1731] On the device: The collected monitoring data is encrypted and periodically sent to a server using a secure encryption protocol, ensuring the data remains confidential.

[1732] Step 6:

[1733] Server: The server decodes the received monitoring data and performs real-time analysis using generative AI models to detect malicious behavior patterns and anomalies.

[1734] Step 7:

[1735] Server: When an anomaly is detected, it classifies the type and impact of the anomaly and generates a detailed report.

[1736] Step 8:

[1737] Server: Generates a message to notify the user about the detected abnormality and sends instructions to the device, including how to deal with the problem.

[1738] Step 9:

[1739] On the device: A message is received and displayed as a notification pop-up to the user, providing specific instructions to the user, such as "A malicious app has been detected. Please uninstall it."

[1740] Step 10:

[1741] User: Check the notification and follow the instructions to take necessary action, such as uninstalling the malicious app or changing settings.

[1742] Step 11:

[1743] Device: If the user does not take prompt action, the agent will automatically take measures such as cutting off the network connection to minimize the impact of malicious activity.

[1744] Step 12:

[1745] Server: Regularly updates and trains the generative AI model based on new threat information. By always maintaining the latest model, it is possible to respond quickly to new threats.

[1746] Step 13:

[1747] Server: Distributes updated generative AI models to devices, allowing the device agents to monitor and take countermeasures based on the latest information.

[1748] Step 14:

[1749] Devices: Automatically receive and apply new models, allowing users to enjoy the latest security measures without any special action.

[1750] Through the above processing steps, the present invention provides an advanced security system that monitors smartphones in real time, detects fraudulent use, and responds promptly.

[1751] Example 1

[1752] Next, a description will be given of Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[1753] In today's digital environment, it is difficult to effectively monitor and counter the increasing threats of fraudulent behavior and data leaks in real time. To solve this problem, continuous monitoring of user devices, anomaly detection, and rapid response are essential, but this has been difficult to achieve with conventional systems. Automatic response is also necessary if users do not promptly address fraudulent behavior. Furthermore, regular updates to keep system security up to date is also a challenge.

[1754] The specific processing by the specific processing unit 290 of the data processing device 12 in the first embodiment is realized by the following means.

[1755] In this invention, the server includes: a means for installing an agent on a user's terminal and running it in the background to monitor application operation and network traffic; a means for encrypting the monitored data and transmitting it from the terminal to the server; a means for analyzing the received data in real time using a generative AI model on the server to detect abnormal behavioral patterns; a means for notifying the user of the detected abnormality and providing a solution; a means for updating the generative AI model based on new threat information and distributing automatic updates from the server to the terminal; a means for the agent to automatically disconnect the network connection if the user's action is delayed; and a means for the agent to send the terminal's system information and initial settings to the server and begin continuous monitoring. This enables real-time detection of fraudulent behavior and data leaks and prompt countermeasures. Furthermore, automatic response is also possible if the user does not respond promptly, and the latest security measures are always applied to the terminal, improving the security of the entire system.

[1756] "User terminal" refers to a computer device such as a smartphone or tablet used by a user.

[1757] An "agent" is a program that is installed on a user's device, runs in the background, and monitors device activity and network traffic.

[1758] "Running in the background" means that the program continues to run behind the system without affecting the user's operations.

[1759] "Application operation" refers to the execution state and behavior of a software program installed on a user terminal.

[1760] "Network traffic" refers to the flow of data sent and received between user terminals and other network devices.

[1761] "Monitoring data" refers to application operation logs and detailed network traffic information collected by the agent.

[1762] "Encryption" refers to the transformation of data using a specific algorithm to protect it from unauthorized access by third parties.

[1763] "Server" refers to the computer system that receives monitoring data, analyzes it, runs generative AI models, notifies and manages information.

[1764] A "generative AI model" refers to a system that uses artificial intelligence algorithms trained on large amounts of data to analyze data and detect patterns of fraudulent behavior.

[1765] "Abnormal behavior patterns" refer to unauthorized actions or unusual operations that deviate from normal behavior.

[1766] "Notification" means sending a warning to the user about a detected abnormality and how to deal with it, and is displayed on the terminal screen as a pop-up message or the like.

[1767] "Countermeasures" refer to specific steps or actions to correct a detected abnormality.

[1768] "Automatic update" refers to the automatic distribution and application of new versions of generative AI models from the server to user devices.

[1769] "Blocking network connections" refers to a measure to prevent potentially fraudulent behavior by halting network access by a user device.

[1770] "Initial settings" refers to the basic information and configuration of the device that the agent collects immediately after installation.

[1771] "Real-time" refers to a state in which processing and analysis are carried out immediately in real time.

[1772] This invention is a generative AI-based anti-tool system that enhances security by installing an agent on a user's device and monitoring, detecting, notifying, and responding to malicious activity in real time. Specific embodiments of this system will be described in detail.

[1773] Hardware and Software Configuration

[1774] 1. Terminal-side agent

[1775] Device: Install an agent program on your smartphone or tablet that runs in the background and monitors application activity and network traffic.

[1776] Agent app: Dedicated application software that users install.

[1777] 2. Data Encryption and Transmission

[1778] Terminal: The monitoring data is encrypted and sent to the server using a strong security protocol such as AES (Advanced Encryption Standard).

[1779] 3. Server-side generated AI models

[1780] Server: The generative AI model deployed on the server performs real-time analysis of the received monitoring data. The generative AI model identifies fraudulent behavior patterns and detects anomalies.

[1781] 4. Anomaly detection and notification

[1782] Server: When an abnormality is detected, a summary of the abnormality and a solution are generated and notified to the user terminal via the agent.

[1783] 5. User Actions and Automatic Countermeasures

[1784] Terminal: The user receives the notification and follows the instructions displayed to take countermeasures. If the user does not take prompt action, the agent will automatically cut off the network connection.

[1785] 6. System Updates

[1786] Server: Regularly updates the generative AI model based on new threat information to maintain the latest defense capabilities. Updated models are automatically distributed to devices.

[1787] Specific examples of processing

[1788] Example 1: Installing a malicious app

[1789] 1. Device: When a malicious app is installed, the agent records the application's behavior as monitoring data.

[1790] 2. Server: Inputs the received data into the generative AI model to detect fraudulent behavior and generates alerts when anomalies are identified.

[1791] 3. On the device: A notification is sent to the user with the message "Malware detected."

[1792] 4. User: Follow the instructions to uninstall the malicious app.

[1793] 5. Device: If the user does not respond promptly, the agent will automatically cut off communication for that app.

[1794] Example 2: Anomalous Network Activity

[1795] 1. Terminal: When abnormal network activity is detected, the agent records the traffic data.

[1796] 2. Server: The AI ​​model analyzes the traffic data and identifies anomalies.

[1797] 3. Device: A notification is sent to the user with the message "Anomalous network activity detected."

[1798] 4. User: Check your network settings and make any necessary corrections.

[1799] 5. Terminal: If the user does not respond promptly, the agent will automatically cut off the relevant network connection.

[1800] Prompt Sentence Examples

[1801] "Please tell me the program flow to determine whether a newly installed app is a malicious app or not and notify me."

[1802] "Please provide detailed instructions on what specific steps you will take if abnormal network activity is detected."

[1803] This invention allows users to enjoy high security and minimize the effort required to ensure the safety of their devices.The system keeps users' smartphones safe at all times by detecting fraudulent use early and taking prompt measures.

[1804] The flow of the identification process in the first embodiment will be described with reference to FIG.

[1805] Step 1: Install and initialize the agent

[1806] Device: The user installs the agent app on their smartphone or tablet. When the agent launches, it collects and encrypts the device's system information (e.g., OS version, device ID, list of installed applications). This encrypted data is then sent to the server.

[1807] Input: The user installs the agent app and starts its initialization.

[1808] Output: Encrypted device system information is sent to the server.

[1809] Step 2: Continuous monitoring of the device

[1810] On the device: The agent runs in the background, monitoring application behavior and network traffic in real time. If a newly installed app or unusual network activity is detected, details are recorded in a log.

[1811] Input: Application activity and network traffic on the device.

[1812] Output: Recorded as monitoring data and periodically sent to a server.

[1813] Step 3: Encrypt and send data

[1814] On the device: Collected monitoring data is encrypted using AES encryption. This data includes application activity logs and network traffic details. The encrypted data is then sent to a server for secure communication.

[1815] Input: Collected unencrypted surveillance data.

[1816] Output: Encrypted monitoring data is sent to the server.

[1817] Step 4: Data analysis by the server

[1818] Server: Decrypts the received encrypted data and inputs it into the generative AI model. The generative AI model analyzes the received data in real time and detects abnormal behavioral patterns. For example, if a specific app is sending or receiving an abnormally large amount of data, the generative AI model will determine that this is fraudulent behavior.

[1819] Input: Decoded surveillance data.

[1820] Output: Verification result of abnormal behavior pattern.

[1821] Step 5: Anomaly detection and user notification

[1822] Server: Generates detailed reports of detected anomalies and creates notification messages with solutions. The notification content includes a detailed description of the anomaly and recommended actions, and is sent to the device via the agent.

[1823] Device: A notification will appear as a pop-up on the device screen, informing the user that an anomaly has been detected.

[1824] Input: Abnormal behavior pattern determination result.

[1825] Output: The notification message sent to the user.

[1826] Step 6: User Coping Behavior

[1827] Users: Check the notification and follow the instructions to take measures such as uninstalling the malicious app or reviewing network settings. For example, if you receive a notification that a malicious app has been detected, uninstall the app.

[1828] Input: The notification message sent to the user.

[1829] Output: User action (e.g., uninstalling the app).

[1830] Step 7: Implementing automated measures

[1831] Terminal: If the user does not take action promptly, the agent will automatically take action, for example, if abnormal network activity continues, it will cut off the network connection to block the traffic.

[1832] Input: Situations where the user does not take action.

[1833] Output: The automatic action to be taken (e.g., blocking the network connection).

[1834] Step 8: Update the system and AI model

[1835] Server: Collects new threat information, trains and updates the generative AI model, and periodically updates the model, distributing the updated model to the device.

[1836] On the device: The agent automatically applies the new model, ensuring the latest security measures are in place.

[1837] Input: New threat information and a trained generative AI model.

[1838] Output: The latest generative AI model applied to the device.

[1839] This is the flow of program processing for this system, which allows users to enjoy high security and minimize the effort required to ensure the safety of their terminals.

[1840] (Application example 1)

[1841] Next, a description will be given of Application Example 1. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[1842] Conventional security systems often have difficulty detecting malicious activity in real time, forcing users to manually implement countermeasures. This makes it difficult to minimize the impact of malicious behavior and poses a risk to the security of user devices. Furthermore, if users do not respond quickly, malicious behavior can lead to more serious problems, so a system that can quickly and automatically implement countermeasures is needed.

[1843] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 1 is realized by the following means.

[1844] In this invention, the server includes means for analyzing received data in real time using a generative AI model to detect abnormal behavioral patterns, means for notifying the user of the detected abnormality and providing a solution, and means for automatically uninstalling the malicious application or cutting off the network connection if the user does not take appropriate action. This makes it possible to detect fraudulent behavior in real time and implement countermeasures quickly and automatically.

[1845] An "agent" is software that is installed on a user's terminal and runs in the background to monitor application operations and network traffic.

[1846] A "generative AI model" is an artificial intelligence model that runs on a server and analyzes monitoring data sent from user devices in real time to detect abnormal behavioral patterns.

[1847] "Encryption" is a technology that converts monitoring data so that it cannot be deciphered by third parties, enabling the secure transmission of data.

[1848] An "anomalous behavior pattern" is a pattern indicative of unexpected or unauthorized system behavior or network traffic.

[1849] A "notification" is a message that provides the user with information about a detected abnormality and instructs them on how to deal with it.

[1850] "Network disconnection" is a procedure in which a user terminal is temporarily disconnected from the Internet or other networks when fraudulent activity is detected.

[1851] An "update" is an update procedure that allows the system to improve the generative AI model based on new threat information and provide new defensive capabilities to the device.

[1852] "Malicious applications" are applications that may cause harm to user devices and are often installed from sources other than legitimate stores.

[1853] This invention relates to a generative AI-based anti-tool system that installs an agent on a user's device to monitor, detect, notify, and respond to malicious activity in real time. This system works particularly effectively on smartphones.

[1854] System Components

[1855] 1. Terminal-side agent

[1856] An agent is installed on the user's device (smartphone). The agent runs in the background and continuously monitors application activity and network traffic. Because it runs as a background process independent of user actions, the user is unaware of the monitoring.

[1857] 2. Data Encryption and Transmission

[1858] The agents collect monitoring data and send it to a server in an encrypted form using strong security protocols such as public key cryptography.

[1859] 3. Server-side generated AI models

[1860] The generative AI model is placed on the server and performs real-time analysis of the received monitoring data. The generative AI model identifies fraudulent behavior patterns and detects anomalies.

[1861] 4. Anomaly detection and notification

[1862] When an abnormality is detected on the server, a summary of the problem and a solution are generated and sent to the user's device via the agent. The notification is displayed as a pop-up on the device screen, allowing the user to check the solution.

[1863] 5. Automatic Countermeasures

[1864] If the user does not respond promptly, the agent will automatically take measures such as cutting off the network connection or uninstalling the malicious application.

[1865] 6. System Updates

[1866] The server periodically updates the generative AI model based on new threat information to maintain up-to-date defense capabilities, and the updated model is automatically distributed to devices.

[1867] Example of a system

[1868] Example 1: Detecting the installation of fraudulent apps

[1869] 1. Terminal-side agent

[1870] When a user installs a malicious app, the application's behavior is recorded as monitoring data.

[1871] 2. Data Encryption and Transmission

[1872] The monitoring data is encrypted and sent to a server.

[1873] 3. Server-side generated AI models

[1874] Generative AI models analyze data in real time to detect fraudulent behavior.

[1875] 4. Anomaly detection and notification

[1876] The server detects the abnormality and notifies the user device that a malicious app has been detected. The user is then instructed to uninstall the malicious app.

[1877] 5. Automatic Countermeasures

[1878] If the user does not take immediate action, the agent will automatically uninstall the malicious app.

[1879] Example 2: Detecting anomalous network activity

[1880] 1. Terminal-side agent

[1881] When abnormal network activity is detected, the traffic data is recorded.

[1882] 2. Data Encryption and Transmission

[1883] The traffic data is encrypted and sent to the server.

[1884] 3. Server-side generated AI models

[1885] AI models analyze traffic data and identify anomalous activity.

[1886] 4. Anomaly detection and notification

[1887] When an anomaly is detected, a notification is sent to the user device stating that "anomalous network activity has been detected." The user is then instructed to check their network settings and make any necessary corrections.

[1888] 5. Automatic Countermeasures

[1889] If the user does not respond promptly, the agent will automatically cut off the relevant network connection.

[1890] Prompt Sentence Examples

[1891] "A malicious application has been detected. Please uninstall it immediately."

[1892] "Abnormal network traffic has been detected. Please check your network settings."

[1893] This allows users to enjoy high security and minimize the effort required to ensure the safety of their devices.The present invention provides a means to keep users' smartphones safe at all times by detecting fraudulent behavior early and taking prompt measures.

[1894] The flow of the specific processing in the application example 1 will be described with reference to FIG.

[1895] Step 1:

[1896] Installing and initializing the terminal agent

[1897] Input: Application installation request

[1898] Operation: The user installs the agent on the device and performs the initial setup. The agent then starts running in the background, ready to monitor application activity and network traffic regardless of user interaction.

[1899] Output: The status of the agent running in the background

[1900] Step 2:

[1901] Starting the virus detection process

[1902] Input: Execution by terminal agent

[1903] How it works: The agent continuously monitors applications running on the device and network traffic, collecting data to detect malicious activity.

[1904] Output: Application operation log, network traffic data

[1905] Step 3:

[1906] Encrypting data and sending it to the server

[1907] Input: Application operation logs, network traffic data

[1908] How it works: Collected data is encrypted using public key cryptography and securely sent to a server.

[1909] Output: Encrypted monitoring data

[1910] Step 4:

[1911] Analysis using server-side generated AI models

[1912] Input: Encrypted surveillance data

[1913] How it works: A server-based generative AI model receives surveillance data, decodes it, and analyzes it in real time to detect anomalous behavioral patterns.

[1914] Output: Abnormal behavior pattern detection results

[1915] Step 5:

[1916] Anomaly detection and user notification

[1917] Input: Abnormal behavior pattern detection results

[1918] Operation: The server generates a notification message containing a detailed explanation of the detected anomaly and how to resolve it, and sends it to the user's device via the agent.

[1919] Output: A message to inform the user

[1920] Step 6:

[1921] User Action

[1922] Input: Notification message

[1923] How it works: The user receives a notification message and follows the instructions to uninstall the malicious app and fix their network settings.

[1924] Output: User action

[1925] Step 7:

[1926] Implementing automatic countermeasures

[1927] Input: Detection when no countermeasures are taken by the user

[1928] How it works: If the user does not take action quickly enough, the agent will automatically block network connections and uninstall the malicious application.

[1929] Output: Blocking network connections, uninstalling malicious applications

[1930] Step 8:

[1931] System Updates

[1932] Input: New threat information

[1933] How it works: The server collects new threat information, trains and updates the generative AI model, and periodically pushes the updated model to the device and applies it automatically.

[1934] Output: Delivery and application of updated generative AI models

[1935] Furthermore, an emotion engine that estimates the user's emotion may be further combined. That is, the identification processing unit 290 may estimate the user's emotion using the emotion identification model 59, and perform identification processing using the user's emotion.

[1936] This invention combines a generative AI-based anti-tool system with an emotion engine that recognizes user emotions, and is a system for strengthening the security of smartphones and tablets. Specifically, an agent installed on the user's device monitors application behavior and network traffic, and uses the emotion engine to take appropriate action based on the user's emotional state.

[1937] System Components

[1938] 1. Terminal-side agent

[1939] Terminal: An agent program is installed on the user's terminal and runs in the background. The agent monitors application activity and network traffic.

[1940] 2. Data Encryption and Transmission

[1941] Terminal: The agent encrypts the collected monitoring data and periodically sends it to the server.

[1942] 3. Server-side generated AI models

[1943] Server: Analyzes incoming data in real time using generative AI models to detect fraudulent behavioral patterns and anomalies.

[1944] 4. Anomaly detection and notification

[1945] Server: Based on the detected abnormality, a message including a solution is generated and sent to the device.

[1946] 5. Emotion Engine

[1947] Device: The emotion engine analyzes the user's voice, facial expressions, input patterns, etc. to recognize the user's emotional state.

[1948] 6. Emotion-Based Notification Adjustment

[1949] On the device: Based on the analysis results of the emotion engine, the content and frequency of notifications are adjusted according to the user's emotional state. For example, if the user is in a state of high stress, the content of notifications will be simplified and the countermeasures will be changed to something that is intuitively understandable.

[1950] 7. User and Automatic Countermeasures

[1951] User: Follow the notification and take the appropriate action.

[1952] Device: If the user does not respond promptly, measures such as automatically cutting off the network connection will be taken.

[1953] 8. System Updates

[1954] Server: Regularly updates the generative AI model based on new threat information and delivers automatic updates to devices.

[1955] Explanation of program processing

[1956] The program processing of the system will be explained in natural language below.

[1957] Operation of the terminal agent

[1958] On the device: After the user installs the agent, it monitors application activity and network traffic, collecting monitoring data that is then encrypted and sent to a server.

[1959] Data transmission and analysis

[1960] Server: Inputs the received data into the generative AI model and performs real-time analysis. If an abnormal behavioral pattern is detected, a detailed report is generated and sent to the device along with countermeasures.

[1961] Emotion Engine Operation

[1962] Device: The emotion engine analyzes data such as the user's voice and facial expressions in real time to recognize the user's emotional state.

[1963] Emotion-based notification adjustment

[1964] Device: Adjust the content and frequency of notifications based on the user's emotional state. For example, if the user is stressed, notifications will be displayed in a simple and understandable way.

[1965] User actions and automatic measures

[1966] User: Follow the notification and uninstall the malicious app or change your network settings.

[1967] Device: If the user does not respond quickly, the agent will automatically cut off the network connection, minimizing the impact of malicious activity.

[1968] System Updates

[1969] Server: Trains generative AI models based on new threat information and distributes the latest versions to devices.

[1970] Device: Automatically applies updates to keep your security up to date.

[1971] Specific examples

[1972] Example 1: Installing a malicious app

[1973] 1. Device: Once a malicious app is installed, the agent monitors its behavior and collects data.

[1974] 2. Server: Generative AI models detect fraudulent behavior and identify anomalies.

[1975] 3. On the device: The emotion engine analyzes the user's emotional state and, for example, if they are feeling stressed, it will display a simplified notification.

[1976] 4. User: Follow the instructions and uninstall the malicious app.

[1977] Example 2: Anomalous Network Activity

[1978] 1. Terminal: When abnormal network activity is detected, traffic data is collected.

[1979] 2. Server: The generative AI model analyzes the data and identifies anomalies.

[1980] 3. On the device: The emotion engine analyzes the user's emotional state and sends detailed notifications if the user is relaxed.

[1981] 4. User: Follow the notification and change your network settings.

[1982] 5. Device: If the user does not take prompt action, the device will automatically shut down the network connection.

[1983] In this way, by combining a generative AI-based anti-tool system with an emotion engine, the present invention realizes flexible notifications and responses that take into account the user's emotional state, allowing users to enjoy a stress-free operating experience while maintaining high security.

[1984] The processing flow will be explained below.

[1985] Step 1:

[1986] User: Download and install the anti-tool app from the smartphone app store. Once the installation is complete, launch the app to begin the initial setup.

[1987] Step 2:

[1988] Device: When the device is launched for the first time, the user is asked to set permissions (e.g., permission to use the app, permission to notify) so that the agent can start operating in the background.

[1989] Step 3:

[1990] User: Grant the necessary permissions and complete the setup. From then on, the agent will monitor in the background.

[1991] Step 4:

[1992] Device: The agent monitors application behavior and network traffic on the smartphone and periodically collects monitoring data.

[1993] Step 5:

[1994] On the device: The collected monitoring data is encrypted and periodically sent to a server using a secure encryption protocol, ensuring the data remains confidential.

[1995] Step 6:

[1996] Server: The server decodes the received monitoring data and performs real-time analysis using generative AI models to detect malicious behavior patterns and anomalies.

[1997] Step 7:

[1998] Server: When an anomaly is detected, it classifies the type and impact of the anomaly and generates a detailed report.

[1999] Step 8:

[2000] Server: Generates a message to notify the user about the detected abnormality and sends instructions to the device, including how to deal with the problem.

[2001] Step 9:

[2002] On the device: A message is received and displayed as a notification pop-up to the user, providing specific instructions to the user, such as "A malicious app has been detected. Please uninstall it."

[2003] Step 10:

[2004] Device: The emotion engine analyzes the user's voice, facial expressions, and input patterns in parallel to recognize the user's emotional state.

[2005] Step 11:

[2006] Device: Adjust the content and frequency of notifications based on the user's emotional state. For example, if the user is in a stressful state, the notification content will be simplified and the solution will be more intuitive.

[2007] Step 12:

[2008] User: Check the notification and follow the instructions to take necessary action, such as uninstalling the malicious app or changing settings.

[2009] Step 13:

[2010] Device: If the user does not take prompt action, the agent will automatically take measures such as cutting off network connections to minimize the impact of malicious activity.

[2011] Step 14:

[2012] Server: Regularly updates and trains the generative AI model based on new threat information. By always maintaining the latest model, it is possible to respond quickly to new threats.

[2013] Step 15:

[2014] Server: Distributes updated generative AI models to devices, allowing the device agents to monitor and take countermeasures based on the latest information.

[2015] Step 16:

[2016] Devices: Automatically receive and apply new models, allowing users to enjoy the latest security measures without any special action.

[2017] By combining the above processing steps with an emotion engine, the present invention realizes flexible notification and response that takes into account the user's emotional state, allowing users to enjoy high security and a stress-free operating experience.

[2018] Example 2

[2019] Next, a description will be given of Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[2020] While modern smartphones and tablets offer convenience and many applications and network services, they are also facing increasing threats such as malicious applications, phishing, and malware. This creates a need for high levels of device security, but conventional systems have struggled to respond flexibly and take into account the user's emotional state. The present invention aims to address these issues.

[2021] The identification process by the identification processing unit 290 of the data processing device 12 in the second embodiment is realized by the following means. In this invention, the server includes means for installing an agent on a user terminal and running it in the background to monitor application operations and network traffic, means for encrypting the monitored data and transmitting it to the server, means for analyzing received data in real time using a generative AI model on the server and detecting abnormal behavioral patterns, means for notifying the user of the detected abnormality and providing a solution, and means for analyzing the user's voice, facial expressions, and input patterns using an emotion engine and adjusting the content and frequency of notifications based on the user's emotional state. This enables flexible and advanced security measures that take the user's emotional state into consideration.

[2022] An "agent" is software that is installed on a user's terminal, runs in the background, and monitors application operations and network traffic.

[2023] "Monitoring Data" refers to application operation information and network traffic information collected by the Agent.

[2024] A "generative AI model" is an artificial intelligence-based analytical model that analyzes incoming data in real time and detects abnormal behavioral patterns.

[2025] A "notification" is a message that notifies the user of an abnormality detected by the server and provides a solution to the problem.

[2026] An "emotion engine" is software that analyzes a user's voice, facial expressions, and input patterns to recognize the user's emotional state.

[2027] "Encryption" refers to the process of converting surveillance data into a format that cannot be deciphered by third parties.

[2028] "Blocking network connectivity" refers to temporarily disabling a device's network access to prevent fraudulent trading activity or attacks.

[2029] "Automatic updates" refers to the process of delivering the latest security measures based on new threat information from a server to a device and automatically applying the updates.

[2030] This invention is an anti-tool system that uses a generative AI model and realizes more flexible and advanced security measures by taking into account the user's emotional state. This system is installed on the user's device, such as a smartphone or tablet, and constantly runs in the background to monitor security.

[2031] A specific embodiment of the present invention will now be described.

[2032] Required Hardware and Software

[2033] Hardware: Mobile devices such as smartphones and tablets

[2034] software:

[2035] Agent program: Installed on the user's terminal, it monitors application behavior and network traffic.

[2036] Generative AI model: Uses a deep learning model based on ResNet to detect anomalous behavioral patterns.

[2037] Emotion engine: Utilizes OpenFace and IBM Watson emotion analysis engines to analyze the user's emotional state.

[2038] Backend servers: Hosted on AWS EC2 or Google Cloud Platform.

[2039] System Overview

[2040] An agent program is installed on the device and runs in the background to monitor application behavior and network traffic. The monitored data is AES-256 encrypted and sent to a server. On the server, the data is analyzed by a generative AI model, and if an abnormality is detected, a detailed report is generated and the user is notified along with how to deal with it. An emotion engine then analyzes the user's emotional state and determines the appropriate notification method based on that state.

[2041] Specific example explanation

[2042] Example 1: Installing a malicious app

[2043] 1. Device: Once a malicious app is installed, the agent monitors its behavior and collects data.

[2044] 2. Server: The generative AI model analyzes the incoming data and detects fraudulent behavior.

[2045] 3. On the device: The emotion engine analyzes the user's emotional state and displays simplified notifications if the user is feeling stressed.

[2046] 4. User: Follow the instructions and uninstall the malicious app.

[2047] Example 2: Anomalous Network Activity

[2048] 1. Terminal: Anomalous network activity is detected and traffic data is collected.

[2049] 2. Server: The generative AI model analyzes the data and identifies anomalies.

[2050] 3. On the device: The emotion engine analyzes the user's emotional state and sends detailed notifications if the user is relaxed.

[2051] 4. User: Follow the notification and change your network settings.

[2052] 5. Device: If the user does not take prompt action, the device will automatically shut down the network connection.

[2053] Prompt Sentence Examples

[2054] 1. Generate an explanation of a system that combines generative AI-based anti-tools with an emotional engine to enhance the security of smartphones and tablets.

[2055] 2. Describe how an agent installed on a user device can monitor application behavior and network traffic, encrypt collected data, and send it to a server for real-time analysis using a generative AI model.

[2056] Through these specific examples, the present invention can realize flexible security measures that take into account the emotional state of the user, thereby maintaining a high level of security for the terminal.

[2057] The flow of the identification process in the second embodiment will be described with reference to FIG.

[2058] Specific explanation of program processing

[2059] Step 1: Install and start the agent

[2060] On the device, the user installs the agent program and it starts running in the background. Once installed, the agent runs as a system process and, with the user's permission, begins monitoring application activity and network traffic.

[2061] Input: Agent installation file

[2062] Output: The agent starts running in the background.

[2063] Step 2: Monitor application behavior and network traffic

[2064] On the device, the agent monitors the behavior of installed applications and network traffic in real time. For example, when a new application is installed, it collects the application's communication details, CPU usage, memory usage, etc.

[2065] Input: Application behavior data and network traffic data

[2066] Output: Monitoring data collection (log file)

[2067] Step 3: Encrypt monitoring data

[2068] Terminal: Collected monitoring data is encrypted with AES-256. Specifically, the encryption process is performed on each batch of collected data once it reaches a certain size.

[2069] Input: Monitoring data

[2070] Output: Encrypted data

[2071] Step 4: Sending monitoring data to the server

[2072] Terminal: Periodically send encrypted data to the server. For example, every 10 minutes, upload the encrypted data to the server using the HTTPS protocol.

[2073] Input: Encrypted data

[2074] Output: Data sent to the server

[2075] Step 5: Receiving and Decrypting Data

[2076] Server: Receives the data sent from the device and decrypts it using AES-256. Specifically, the server passes the received data to a dedicated decryption module, which returns it to its original data format.

[2077] Input: Encrypted data

[2078] Output: Decrypted data

[2079] Step 6: Parse the received data

[2080] Server: The decrypted data is fed into the generative AI model for real-time analysis. This analysis includes detecting anomalous behavioral patterns. For example, if the model detects specific fraudulent activity in the data, it generates an anomaly report.

[2081] Input: Decrypted surveillance data

[2082] Output: Anomalous behavior report

[2083] Step 7: Anomaly detection and notification generation

[2084] Server: When the generative AI model detects an anomaly, it generates a detailed report and countermeasures and notifies the device. Specifically, it creates a notification containing a warning message and countermeasures based on the abnormal behavior report.

[2085] Input: Anomalous Behavior Report

[2086] Output: Information message

[2087] Step 8: Emotional state analysis by the emotion engine

[2088] Device: The emotion engine analyzes the user's voice, facial expressions, and input patterns in real time to assess the user's emotional state. Specifically, the emotion engine analyzes the user's actions, such as speaking to the screen, typing, and looking at the facial recognition camera.

[2089] Input: User voice, facial expressions, and input patterns

[2090] Output: Emotional state data

[2091] Step 9: Adjust notifications based on emotion

[2092] Device: Based on the analysis results of the emotion engine, the content and frequency of notifications are set appropriately according to the user's emotional state. For example, if the emotion engine determines that the user is feeling stressed, the content of notifications will be simplified and the frequency of notifications will be reduced.

[2093] Input: Emotional state data, notification message

[2094] Output: The adjusted notification message

[2095] Step 10: User actions and automated measures

[2096] Users: Follow the notification message and take appropriate measures such as uninstalling the malicious app or changing network settings. For example, follow the instructions to delete the app if it says "A malicious app has been detected on your device. Please uninstall it."

[2097] Input: Notification message

[2098] Output: Response action

[2099] Terminal: If the user does not respond promptly, the agent will automatically cut off the network connection, for example, by taking an action such as "The network connection has been temporarily cut off."

[2100] Input: User response delay

[2101] Output: Automatic countermeasure execution

[2102] Step 11: Update your system

[2103] Server: Trains the generative AI model based on new threat information and delivers the latest security information to devices. For example, it updates the model once a week and delivers security patches.

[2104] Input: New threat information

[2105] Output: Updated generative AI model, security patches

[2106] Device: Automatically apply received updates to keep your security up to date.

[2107] Input: security patch

[2108] Output: Updated security state

[2109] The above is a detailed description of the specific processing flow in the system of the present invention. The intention is that a series of processes for highly protecting user terminals will be executed rationally and effectively.

[2110] (Application example 2)

[2111] Next, a description will be given of Application Example 2. In the following description, the data processing device 12 will be referred to as a "server" and the robot 414 will be referred to as a "terminal."

[2112] While conventional security systems have the ability to monitor user device operation and network traffic and detect abnormalities, they do not provide notifications and responses that take into account the user's psychological state. As a result, even when users are in a state of high stress, they receive complex notifications and are unable to take appropriate action. This can result in ineffective measures being taken in situations where a quick response is required.

[2113] The specific processing by the specific processing unit 290 of the data processing device 12 in the application example 2 is realized by the following means.

[2114] In this invention, the server is a generative AI-based anti-tool system that includes: means for installing an agent on a user terminal and running it in the background to monitor application operation and network traffic; means for encrypting the monitored data and transmitting it to the server; means for analyzing the received data in real time using a generative AI model on the server to detect abnormal behavioral patterns; means for notifying the user of the detected abnormality and providing countermeasures; means for adjusting the content and frequency of notifications using an emotion engine that analyzes the user's emotions; and means for updating the generative AI model based on new threat information and distributing automatic updates from the server to the terminal. This enables flexible notifications and responses that take the user's psychological state into consideration, and promotes appropriate responses in high-stress situations.

[2115] A "generative AI model" is an artificial intelligence model that performs real-time analysis using data collected from user devices to detect fraudulent behavioral patterns and anomalies.

[2116] An "anti-tool system" is a system that monitors applications and network traffic on user terminals to detect unauthorized behavior and abnormalities.

[2117] An "agent" is a program that is installed on a user's terminal and runs in the background to monitor application operations and network traffic.

[2118] "Encryption" is a technology that prevents surveillance data from being deciphered by third parties by converting the data using a specific algorithm.

[2119] The "emotion engine" is a system that analyzes data such as the user's voice, facial expressions, and input patterns to recognize the user's emotional state in real time.

[2120] "Means" are methods or techniques for achieving a specific purpose.

[2121] The "server" is a central control device that analyzes data, detects anomalies, updates generative AI models, and sends notifications.

[2122] "Background" means that the system operates automatically behind the scenes, invisible to the user.

[2123] "Network traffic" refers to the transmission and reception of data between a user terminal and the Internet or other network.

[2124] A "notification" is a message or instruction that is displayed to the user when an abnormality is detected.

[2125] "Automatic updates" refers to a function that regularly updates the generative AI model based on new threat information and delivers the latest version to the user's device.

[2126] MODE FOR CARRYING OUT THE INVENTION

[2127] This invention combines a generative AI-based anti-tool system with an emotion engine that recognizes user emotions, and is a system for strengthening the security of smartphones and tablets. Specifically, an agent installed on the user's device monitors application behavior and network traffic, and uses the emotion engine to take appropriate action based on the user's emotional state.

[2128] System Components

[2129] 1. Terminal-side agent

[2130] Terminal: An agent program is installed on the user's terminal and runs in the background. The agent monitors application activity and network traffic, encrypts the monitored data, and temporarily stores it in SQLite.

[2131] 2. Data Encryption and Transmission

[2132] Terminal: The monitoring data collected by the agent is encrypted using the AES algorithm and periodically sent to the server via HTTP communication.

[2133] 3. Server-side generated AI models

[2134] Server: The server uses TensorFlow to build a generative AI model to analyze incoming data in real time, detect fraudulent behavior patterns and anomalies, and generate detailed reports using a Flask application.

[2135] 4. Anomaly detection and notification

[2136] Server: Based on the detected abnormality, a message including a solution is generated and sent to the device.

[2137] 5. Emotion Engine

[2138] On the device: The emotion engine uses OpenCV to analyze the user's voice and facial expressions, and Librosa to analyze the voice data, thereby recognizing the user's emotional state in real time.

[2139] 6. Emotion-Based Notification Adjustment

[2140] On the device: Based on the analysis results of the emotion engine, the content and frequency of notifications are adjusted according to the user's emotional state. For example, if the user is in a state of high stress, the content of notifications will be simplified and the countermeasures will be changed to something that is intuitively understandable.

[2141] 7. User and Automatic Countermeasures

[2142] User and device: The user takes the appropriate action based on the notification. If the user does not respond promptly, the agent will automatically take measures such as cutting off the network connection.

[2143] 8. System Updates

[2144] Server and device: The server trains the generative AI model based on new threat information and distributes the latest version to the device, which then automatically applies updates to maintain the latest security measures.

[2145] Specific examples

[2146] Example 1: Installing a malicious app

[2147] 1. Device: Once a malicious app is installed, the agent monitors its behavior and collects data.

[2148] 2. Server: Generative AI models detect fraudulent behavior and identify anomalies.

[2149] 3. On the device: The emotion engine analyzes the user's emotional state and displays simplified notifications if the user is in a high-stress state.

[2150] 4. User: Follow the instructions and uninstall the malicious app.

[2151] Example 2: Anomalous Network Activity

[2152] 1. Terminal: When abnormal network activity is detected, traffic data is collected.

[2153] 2. Server: The generative AI model analyzes the data and identifies anomalies.

[2154] 3. On the device: The emotion engine analyzes the user's emotional state and sends detailed notifications if the user is relaxed.

[2155] 4. User: Follow the notification and change your network settings.

[2156] 5. Device: If the user does not take prompt action, the device will automatically shut down the network connection.

[2157] Prompt Sentence Examples

[2158] "Detect malicious behavior in user network traffic and generate notifications based on the results. Simplify notifications if users are in a high-stress state."

[2159] As described above, by combining a generative AI-based anti-tool system with an emotion engine, this invention realizes flexible notification and response that takes into account the user's emotional state, allowing users to enjoy a stress-free operating experience while maintaining high security.

[2160] The flow of the specific processing in the application example 2 will be described with reference to FIG.

[2161] Step 1:

[2162] Terminal: An agent is installed on the user's terminal and runs in the background.

[2163] Input: An agent program is installed on the user terminal.

[2164] Action: The agent starts running in the background immediately after installation, monitoring the behavior of applications and network traffic on the device.

[2165] Output: Obtain application behavior data and network traffic data.

[2166] Step 2:

[2167] Terminal: Encrypts the monitoring data and sends it to the server.

[2168] Input: Application behavior data and network traffic data obtained in step 1.

[2169] Processing: The agent encrypts the monitoring data using the AES algorithm and periodically sends it to the server using HTTP communication.

[2170] Output: Encrypted monitoring data is sent to the server.

[2171] Step 3:

[2172] Server: Analyzes incoming data in real time using a generative AI model to detect abnormal behavioral patterns.

[2173] Input: Encrypted surveillance data sent from the device.

[2174] Processing: Decrypting encrypted data and feeding it into generative AI models using TensorFlow for real-time analysis to detect fraudulent behavioral patterns and anomalies.

[2175] Output: If an anomaly is detected, a detailed report is generated.

[2176] Step 4:

[2177] Server: Notifies the user of any detected anomalies and provides solutions.

[2178] Input: The anomaly details report generated in step 3.

[2179] Action: Use a Flask application to generate a notification for the user based on a detailed report of the anomaly. Send a message to the device with instructions on how to resolve the issue.

[2180] Output: A notification message containing a remedy is sent to the user's terminal.

[2181] Step 5:

[2182] Terminal: Analyzes the user's emotional state using an emotion engine.

[2183] Input: Data on the user's voice, facial expressions, and input patterns.

[2184] Processing: By using OpenCV to analyze facial expressions from camera input and Librosa to analyze audio data, the user's emotional state is recognized in real time.

[2185] Output: The user's emotional state (e.g., high stress, relaxed) is obtained as the analysis result.

[2186] Step 6:

[2187] Device: Adjust the content and frequency of notifications based on the analysis results of the emotion engine.

[2188] Input: A notification message containing the user's emotional state obtained in step 5 and the coping strategies provided in step 4.

[2189] Processing: Based on the analysis results of the emotion engine, the notification content is formatted according to the user's emotional state. For example, if the user is in a high-stress state, the notification will be simplified.

[2190] Output: A customized notification is displayed depending on the user's emotional state.

[2191] Step 7:

[2192] Users and devices: Based on notifications, the system takes the appropriate measures and automatically cuts off network connections if necessary.

[2193] Input: The notification message customized in step 6.

[2194] Action: The user takes corrective action based on the notification. If the user does not take action promptly, the agent automatically cuts off the network connection.

[2195] Output: Network connectivity is cut off, minimizing the impact of malicious activity.

[2196] Step 8:

[2197] Server and device: The generative AI model is updated based on new threat information and automatically distributed to the device.

[2198] Input: New threat information and existing generative AI models.

[2199] Processing: Trains generative AI models based on new threat information and delivers the latest version to devices, which automatically apply the received updates.

[2200] Output: Updated generative AI models and the latest security measures are applied to the device.

[2201] The specific processing unit 290 transmits the result of the specific processing to the robot 414. In the robot 414, the control unit 46A causes the speaker 240 and the control target 443 to output the result of the specific processing. The microphone 238 acquires voice indicating a user input regarding the result of the specific processing. The control unit 46A transmits voice data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the voice data.

[2202] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (Internet Search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search <url: https: gemini.google.com ?hl="ja">) and other generation AIs. The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating voice, text data indicating text, and image data indicating an image is also input. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt, and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[2203] In the above embodiment, an example was given in which the specific processing is performed by the data processing device 12, but the technology of the present disclosure is not limited to this, and the specific processing may be performed by the robot 414.

[2204] The emotion identification model 59 as an emotion engine may determine the user's emotion according to a specific mapping. Specifically, the emotion identification model 59 may determine the user's emotion according to an emotion map (see FIG. 9), which is a specific mapping. Similarly, the emotion identification model 59 may determine the robot's emotion, and the identification processing unit 290 may perform identification processing using the robot's emotion.

[2205] FIG. 9 is a diagram illustrating an emotion map 400 on which multiple emotions are mapped. In the emotion map 400, emotions are arranged in concentric circles radiating from the center. Emotions closer to the center of the concentric circles are more primitive. Emotions representing states and actions arising from a state of mind are arranged on the outer edges of the concentric circles. The concept of emotion includes both affect and mental states. Emotions generally generated from reactions occurring in the brain are arranged on the left side of the concentric circles. Emotions generally induced by situational judgment are arranged on the right side of the concentric circles. Emotions generally generated from reactions occurring in the brain and induced by situational judgment are arranged on the upper and lower sides of the concentric circles. Furthermore, the emotion of "pleasure" is arranged on the upper side of the concentric circles, and the emotion of "discomfort" is arranged on the lower side. In this way, in the emotion map 400, multiple emotions are mapped based on the structure by which emotions are generated, and emotions that tend to occur simultaneously are mapped close to each other.

[2206] These emotions are distributed in the 3 o'clock direction on emotion map 400, and typically fluctuate between relief and anxiety. In the right half of emotion map 400, situational awareness dominates over internal sensations, resulting in a sense of calm.

[2207] The inside of emotion map 400 represents what is going on in the mind, and the outside of emotion map 400 represents behavior, so the further you go outside emotion map 400, the more visible the emotions become (the more they are expressed in behavior).

[2208] Human emotions are based on various balances, such as posture and blood sugar levels. When these balances deviate from the ideal, a state of discomfort is indicated, and when they approach the ideal, a state of pleasure is indicated. Emotions can also be created for robots, automobiles, and motorcycles, based on various balances, such as posture and remaining battery life. When these balances deviate from the ideal, a state of discomfort is indicated, and when they approach the ideal, a state of pleasure is indicated. An emotion map can be generated, for example, based on Dr. Mitsuyoshi's emotion map (Research on Voice Emotion Recognition and Emotional Brain Physiological Signal Analysis Systems, Tokushima University, Doctoral Dissertation: https: / / ci.nii.ac.jp / naid / 500000375379). The left half of the emotion map lists emotions belonging to the "reaction" domain, where sensation is dominant. The right half of the emotion map lists emotions belonging to the "situation" domain, where situational awareness is dominant.

[2209] The emotion map defines two emotions that promote learning. One is a negative emotion on the situation side, around the middle of "repentance" or "reflection." In other words, this occurs when the robot experiences negative emotions such as "I never want to feel this way again" or "I don't want to be scolded again." The other is a positive emotion on the response side, around "desire." In other words, this occurs when the robot experiences positive feelings such as "I want more" or "I want to know more."

[2210] The emotion identification model 59 inputs user input into a pre-trained neural network, obtains emotion values ​​indicating each emotion shown in the emotion map 400, and determines the user's emotion. This neural network is pre-trained based on multiple pieces of training data that are combinations of user input and emotion values ​​indicating each emotion shown in the emotion map 400. Furthermore, this neural network is trained so that emotions that are located close to each other have similar values, as in the emotion map 900 shown in FIG. 10. FIG. 10 shows an example in which multiple emotions, "relieved," "calm," and "reassuring," have similar emotion values.

[2211] The system according to the present disclosure has been described above mainly with respect to the functions of the data processing device 12, but the system according to the present disclosure is not necessarily implemented on a server. The system according to the present disclosure may be implemented as a general information processing system. The present disclosure may be implemented, for example, as a software program running on a personal computer or an application running on a smartphone, etc. The method according to the present disclosure may be provided to users in the form of SaaS (Software as a Service).

[2212] In the above embodiment, an example was given in which the specific processing is performed by one computer 22, but the technology of the present disclosure is not limited to this, and the specific processing may be distributed and performed by a plurality of computers including the computer 22. For example, the data generation model 58 may be provided in an external device of the data processing device 12, and data may be generated in the external device in accordance with input data.

[2213] In the above embodiment, an example in which the specific processing program 56 is stored in the storage 32 has been described, but the technology of the present disclosure is not limited to this. For example, the specific processing program 56 may be stored in a portable, computer-readable, non-transitory storage medium such as a USB (Universal Serial Bus) memory. The specific processing program 56 stored in the non-transitory storage medium is installed in the computer 22 of the data processing device 12. The processor 28 executes the specific processing in accordance with the specific processing program 56.

[2214] Alternatively, the specific processing program 56 may be stored in a storage device such as a server connected to the data processing device 12 via the network 54, and the specific processing program 56 may be downloaded and installed on the computer 22 in response to a request from the data processing device 12.

[2215] It is not necessary to store all of the specific processing program 56 in a storage device such as a server connected to the data processing device 12 via the network 54, or to store all of the specific processing program 56 in the storage 32; only a portion of the specific processing program 56 may be stored.

[2216] The hardware resource for executing a specific process can be any of the following processors: An example of a processor is a CPU, which is a general-purpose processor that functions as a hardware resource for executing a specific process by executing software, i.e., a program. Another example of a processor is a dedicated electrical circuit, such as an FPGA (Field-Programmable Gate Array), a PLD (Programmable Logic Device), or an ASIC (Application Specific Integrated Circuit), which is a processor with a circuit configuration designed specifically for executing a specific process. Each processor has built-in or connected memory, and each processor uses the memory to execute the specific process.

[2217] The hardware resource that executes the specific processing may be configured with one of these various processors, or may be configured with a combination of two or more processors of the same or different types (for example, a combination of multiple FPGAs, or a combination of a CPU and an FPGA). Also, the hardware resource that executes the specific processing may be a single processor.

[2218] As an example of a system configured with a single processor, first, one processor is configured by combining one or more CPUs and software, and this processor functions as a hardware resource that executes a specific process. Second, there is a system that uses a processor that realizes the functions of an entire system including multiple hardware resources that execute a specific process on a single IC chip, as typified by SoC (System-on-a-chip). In this way, a specific process is realized using one or more of the above-mentioned various processors as hardware resources.

[2219] Furthermore, the hardware structure of these various processors can be, more specifically, an electric circuit that combines circuit elements such as semiconductor devices. The specific processing described above is merely an example. Therefore, it goes without saying that unnecessary steps may be deleted, new steps may be added, or the processing order may be rearranged, without departing from the spirit of the invention.

[2220] The above-described description and illustrations are a detailed explanation of the parts related to the technology of the present disclosure and are merely an example of the technology of the present disclosure. For example, the above description of the configuration, functions, actions, and effects is an explanation of an example of the configuration, functions, actions, and effects of the parts related to the technology of the present disclosure. Therefore, it goes without saying that unnecessary parts may be deleted, new elements may be added, or replacements may be made to the above-described description and illustrations within the scope of the gist of the technology of the present disclosure. Furthermore, to avoid confusion and facilitate understanding of the parts related to the technology of the present disclosure, the above-described description and illustrations omit explanations of common technical knowledge that do not require particular explanation to enable the implementation of the technology of the present disclosure.

[2221] All publications, patent applications, and technical standards mentioned in this specification are herein incorporated by reference to the same extent as if each individual publication, patent application, or technical standard was specifically and individually indicated to be incorporated by reference.

[2222] The following is further disclosed regarding the above embodiment.

[2223] (Claim 1)

[2224] 1. A generative AI-based anti-tool system, comprising:

[2225] a means for installing an agent on a user terminal and running it in the background to monitor application operations and network traffic;

[2226] means for encrypting and transmitting the monitoring data to a server;

[2227] a means for analyzing the received data in real time using a generative AI model on a server to detect abnormal behavioral patterns;

[2228] a means of notifying the user of detected anomalies and providing remedial action;

[2229] A means to update the generative AI model based on new threat information and distribute automatic updates from the server to the device;

[2230] A system including:

[2231] (Claim 2)

[2232] 10. The system of claim 1, further comprising means for the agent to automatically shut down the network connection if user action is not taken promptly.

[2233] (Claim 3)

[2234] 2. The system according to cl...

Claims

1. 1. A generative AI-based anti-tool system, comprising: a means for installing an agent on a user terminal and running it in the background to monitor application operations and network traffic; means for encrypting and transmitting the monitoring data to a server; a means for analyzing the received data in real time using a generative AI model on a server to detect abnormal behavioral patterns; a means of notifying the user of detected anomalies and providing remedial action; A means to update the generative AI model based on new threat information and distribute automatic updates from the server to the device; A system including:

2. 10. The system of claim 1, further comprising means for the agent to automatically disconnect the network connection if user action is not taken promptly.

3. 2. The system according to claim 1, further comprising means for encrypting the transmitted data and maintaining security of communications between the server and the terminal during the process of transmitting and analyzing the monitoring data.

Images