system

Abstract

The system according to the embodiment aims to detect phishing emails and warn users. [Solution] A system according to an embodiment includes an analysis unit, a determination unit, a notification unit, and a learning unit. The analysis unit analyzes emails. The determination unit determines the possibility of phishing scams based on the email analyzed by the analysis unit. The notification unit issues a warning to the user based on the determination result by the determination unit. The learning unit continuously learns the characteristics of phishing scams determined by the determination unit.

Description

[Technical Field]

[0001] The technology of the present disclosure relates to a system. [Background technology]

[0002] Patent document 1 discloses a persona chatbot control method performed by at least one processor, the method including the steps of receiving a user utterance, adding the user utterance to a prompt including an instruction sentence related to a description of the chatbot character, encoding the prompt, and inputting the encoded prompt into a language model to generate a chatbot utterance in response to the user utterance. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Publication No. 2022-180282 Summary of the Invention [Problem to be solved by the invention]

[0004] Conventional technologies do not adequately detect phishing emails or warn users, so there is room for improvement.

[0005] The system according to the embodiment aims to detect phishing emails and warn users. [Means for solving the problem]

[0006] The system according to the embodiment includes an analysis unit, a determination unit, a notification unit, and a learning unit. The analysis unit analyzes emails. The determination unit determines the possibility of phishing scams based on the email analyzed by the analysis unit. The notification unit issues a warning to the user based on the determination result by the determination unit. The learning unit continuously learns the characteristics of phishing scams determined by the determination unit. [Effects of the Invention]

[0007] The system according to the embodiment can detect phishing emails and warn users. [Brief explanation of the drawings]

[0008] [Figure 1] 1 is a conceptual diagram showing an example of the configuration of a data processing system according to a first embodiment. [Figure 2] 1 is a conceptual diagram showing an example of main functions of a data processing device and a smart device according to a first embodiment. [Figure 3] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a second embodiment. [Figure 4] FIG. 10 is a conceptual diagram showing an example of main functions of a data processing device and smart glasses according to a second embodiment. [Figure 5] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a third embodiment. [Figure 6] FIG. 11 is a conceptual diagram showing an example of main functions of a data processing device and a headset-type terminal according to a third embodiment. [Figure 7] FIG. 10 is a conceptual diagram showing an example of the configuration of a data processing system according to a fourth embodiment. [Figure 8] FIG. 10 is a conceptual diagram showing an example of main functions of a data processing device and a robot according to a fourth embodiment. [Figure 9] 1 shows an emotion map onto which multiple emotions are mapped. [Figure 10] 1 shows an emotion map onto which multiple emotions are mapped. DETAILED DESCRIPTION OF THE INVENTION

[0009] An example of an embodiment of a system according to the technology of the present disclosure will be described below with reference to the accompanying drawings.

[0010] First, the terms used in the following description will be explained.

[0011] In the following embodiments, a coded processor (hereinafter simply referred to as a "processor") may be a single arithmetic device or a combination of multiple arithmetic devices. Furthermore, the processor may be a single type of arithmetic device or a combination of multiple types of arithmetic devices. Examples of arithmetic devices include a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), a GPGPU (General-Purpose computing on Graphics Processing Units), an APU (Accelerated Processing Unit), or a TPU (Tensor Processing Unit).

[0012] In the following embodiments, a coded RAM (Random Access Memory) is a memory in which information is temporarily stored and is used as a working memory by a processor.

[0013] In the following embodiments, the coded storage is one or more non-volatile storage devices that store various programs, various parameters, etc. Examples of non-volatile storage devices include flash memory (SSD (Solid State Drive)), magnetic disks (e.g., hard disks), and magnetic tapes.

[0014] In the following embodiments, a communication I / F (Interface) with a symbol is an interface including a communication processor, an antenna, etc. The communication I / F controls communication between multiple computers. Examples of communication standards applied to the communication I / F include wireless communication standards including 5G (5th Generation Mobile Communication System), Wi-Fi (registered trademark), and Bluetooth (registered trademark).

[0015] In the following embodiments, "A and / or B" is synonymous with "at least one of A and B." In other words, "A and / or B" means that it may be only A, only B, or a combination of A and B. Furthermore, in this specification, the same concept as "A and / or B" is also applied when three or more things are expressed connected by "and / or."

[0016] [First embodiment] FIG. 1 shows an example of the configuration of a data processing system 10 according to the first embodiment.

[0017] 1, a data processing system 10 includes a data processing device 12 and a smart device 14. An example of the data processing device 12 is a server.

[0018] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0019] The smart device 14 includes a computer 36, a reception device 38, an output device 40, a camera 42, and a communication I / F 44. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The reception device 38, the output device 40, and the camera 42 are also connected to the bus 52.

[0020] The reception device 38 includes a touch panel 38A and a microphone 38B, and receives user input. The touch panel 38A detects contact with a pointer (for example, a pen or a finger) to receive user input by the touch of the pointer. The microphone 38B detects the user's voice to receive user input by voice. The control unit 46A transmits data indicating the user input received by the touch panel 38A and the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 (see FIG. 2) acquires the data indicating the user input.

[0021] Output device 40 includes a display 40A and a speaker 40B, and presents data to a user by outputting the data in a form of expression that the user can perceive (e.g., audio and / or text). Display 40A displays visible information such as text and images in accordance with instructions from processor 46. Speaker 40B outputs audio in accordance with instructions from processor 46. Camera 42 is a compact digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor.

[0022] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 control the exchange of various information between the processor 46 and the processor 28 via the network 54.

[0023] FIG. 2 shows an example of the main functions of the data processing device 12 and the smart device 14.

[0024] 2, in the data processing device 12, a specific process is performed by the processor 28. A specific processing program 56 is stored in the storage 32. The specific processing program 56 is an example of a "program" according to the technology of the present disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific process is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0025] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290. The identification processing unit 290 can estimate a user's emotion using the emotion identification model 59 and perform identification processing using the user's emotion. The emotion estimation function (emotion identification function) using the emotion identification model 59 performs various estimations and predictions regarding the user's emotion, including estimation and prediction of the user's emotion, but is not limited to these examples. Furthermore, the estimation and prediction of emotion also includes, for example, emotion analysis.

[0026] In the smart device 14, the specific processing is performed by the processor 46. The storage 50 stores a specific processing program 60. The specific processing program 60 is used together with the specific processing program 56 by the data processing system 10. The processor 46 reads the specific processing program 60 from the storage 50 and executes the read specific processing program 60 on the RAM 48. The specific processing is realized by the processor 46 operating as the control unit 46A in accordance with the specific processing program 60 executed on the RAM 48. Note that the smart device 14 has a data generation model and an emotion identification model similar to the data generation model 58 and the emotion identification model 59, and can also perform processing similar to that of the specific processing unit 290 using these models.

[0027] Note that a device other than the data processing device 12 may have the data generation model 58. For example, a server device (e.g., a generation server) may have the data generation model 58. In this case, the data processing device 12 obtains a processing result (prediction result, etc.) using the data generation model 58 by communicating with the server device having the data generation model 58. Furthermore, the data processing device 12 may be a server device, or may be a terminal device owned by a user (e.g., a mobile phone, a robot, a home appliance, etc.). Next, an example of processing by the data processing system 10 according to the first embodiment will be described.

[0028] (Example 1) A phishing detection system according to an embodiment of the present invention uses AI to detect phishing emails and warn users to prevent fraud. When an email is received, the AI ​​analyzes the email and determines whether it is likely to be a phishing scam. If a phishing scam is determined to be a phishing scam, the system displays a warning message to the user. For example, the phishing detection system performs detailed analysis of the email's sender address, subject, body content, and linked URL to detect phishing scam characteristics. Examples of such characteristics include the sender address being from an unreliable domain, the body containing unnatural language, and the linked URL being suspicious. If a phishing scam is determined to be a phishing scam, the system displays a warning message to the user. For example, the system adds a warning message such as "This is a possible phishing scam" to the email's subject or body. Furthermore, the system can warn users by displaying a warning pop-up when they attempt to click on a linked URL. Furthermore, the phishing detection system continuously learns the characteristics of phishing emails to improve its detection accuracy. For example, if a new phishing scam technique is discovered, the AI ​​can learn its characteristics and use them in future detections. This allows the phishing detection system to make users wary of phishing emails and prevent fraud before it happens. This allows the phishing detection system to make users wary of phishing emails and prevent fraud before it happens. Furthermore, as the AI ​​continues to learn, detection accuracy improves, enabling more effective countermeasures against phishing scams. For example, introducing it into a company's email system can be expected to raise security awareness among all employees and significantly reduce the number of phishing scams.

[0029] A phishing detection system according to an embodiment includes an analysis unit, a determination unit, a notification unit, and a learning unit. The analysis unit analyzes emails. For example, the analysis unit analyzes the sender address, subject, body content, and linked URL of the email. The analysis unit detects, for example, when the sender address is from an unreliable domain, when the body contains unnatural language, or when the linked URL is suspicious. The determination unit determines whether the email is a phishing scam based on the email analyzed by the analysis unit. The determination unit makes the determination based on, for example, the characteristics of the phishing scam. The notification unit issues a warning to the user based on the determination result by the determination unit. For example, the notification unit adds a warning message such as "This may be a phishing scam" to the subject or body of the email. The notification unit can also display a warning pop-up when the user attempts to click on the linked URL. The learning unit continuously learns the characteristics of phishing scams determined by the determination unit. For example, when a new phishing technique is discovered, the learning unit can learn the characteristics and use them for future detections. As a result, the phishing fraud detection system according to the embodiment can detect phishing fraud emails and warn users to prevent them from falling victim to fraud.

[0030] The analysis unit can analyze the sender address, subject, content of the body, and linked URL. For example, the analysis unit detects when the sender address is from an unreliable domain. For example, the analysis unit can also detect when a specific keyword is included in the subject. For example, the analysis unit can also detect when unnatural wording is included in the body. For example, the analysis unit can also detect when a linked URL is suspicious. This improves the accuracy of detecting characteristics of phishing scams through detailed analysis of emails. Some or all of the above-mentioned processing in the analysis unit may be performed using, for example, AI, or may be performed without using AI. For example, the analysis unit can perform analysis using an AI model that inputs the sender address, subject, content of the body, and linked URL and outputs characteristics of phishing scams.

[0031] The notification unit can add a warning message to the subject or body of the email. For example, the notification unit can add a warning message such as "Possible phishing scam" to the subject of the email. The notification unit can also add a warning message to the body of the email, for example. The notification unit can also customize the wording of the warning message, for example. This can alert the user to the possibility of a phishing scam and raise their awareness. Some or all of the above-mentioned processing in the notification unit can be performed using, for example, AI, or can be performed without using AI. For example, the notification unit can add a warning message using an AI model that inputs the subject or body of the email and outputs a warning message.

[0032] The notification unit can display a warning pop-up when a user attempts to click on a linked URL. For example, the notification unit can display a warning pop-up such as "This link may be a phishing scam" when a user attempts to click on a linked URL. The notification unit can also customize the design of the warning pop-up, for example. The notification unit can also adjust the timing of the display of the warning pop-up, for example. This allows a warning to be displayed before a user clicks on a link, preventing damage from phishing scams. Some or all of the above-described processing in the notification unit can be performed using, for example, AI, or can be performed without using AI. For example, the notification unit can display the warning pop-up using an AI model that receives the linked URL as input and outputs a warning pop-up.

[0033] The learning unit can learn new phishing techniques and use the information for future detections. For example, when a new phishing technique is discovered, the learning unit learns its characteristics. For example, the learning unit can automatically collect information about phishing techniques and reflect it in the learning data. For example, the learning unit can periodically review and improve the learning algorithm. This improves detection accuracy by adapting to new phishing techniques. Some or all of the above-mentioned processing in the learning unit may be performed using, for example, AI, or may be performed without using AI. For example, the learning unit can input data about new phishing techniques and perform learning using an AI model that updates the learning algorithm.

[0034] The analysis unit can perform a detailed analysis of the content of the email to detect characteristics of a phishing scam. For example, the analysis unit can detect specific phrases included in the body of the email. For example, the analysis unit can also analyze the writing style of the email and detect unnatural wording. For example, the analysis unit can evaluate the reliability of the URL linked to in the email. This allows for accurate detection of characteristics of a phishing scam through detailed analysis. Some or all of the above-mentioned processing in the analysis unit may be performed using, for example, AI, or may be performed without using AI. For example, the analysis unit can perform a detailed analysis using an AI model that inputs the body, writing style, and URL linked to the email and outputs characteristics of a phishing scam.

[0035] The notification unit can display a message to warn the user that a phishing scam may have occurred. For example, the notification unit displays a warning message such as "Possible phishing scam" in the subject line of an email. The notification unit can also display the warning message in the body of the email, for example. The notification unit can also adjust the timing of displaying the warning message. This can prevent damage from phishing scams by displaying a warning to the user. Some or all of the above-described processing in the notification unit may be performed using, for example, AI, or may be performed without using AI. For example, the notification unit can display the warning message using an AI model that inputs the subject line or body of an email and outputs a warning message.

[0036] The learning unit can improve detection accuracy by continuously learning the characteristics of phishing scams. The learning unit, for example, continuously learns the characteristics of phishing scams. The learning unit can, for example, periodically update learning data to adapt to the latest phishing scam techniques. The learning unit can, for example, improve the learning algorithm to improve detection accuracy. This improves the accuracy of phishing scam detection through continuous learning. Some or all of the above-mentioned processing in the learning unit may be performed using, for example, AI, or may be performed without using AI. For example, the learning unit can continuously learn using an AI model that inputs data related to the characteristics of phishing scams and updates the learning algorithm.

[0037] When analyzing emails, the analysis unit can optimize the analysis algorithm by referring to past analysis results. The analysis unit adjusts the analysis algorithm based on, for example, the characteristics of emails that have been previously determined to be phishing scams. The analysis unit can also improve the algorithm by learning, for example, patterns that frequently resulted in false positives from past analysis results. The analysis unit can also refer to, for example, past analysis results and prioritize the analysis of emails from specific senders. In this way, the accuracy of the analysis algorithm is improved by referring to past analysis results. Some or all of the above-described processing in the analysis unit may be performed using, for example, AI, or may be performed without using AI. For example, the analysis unit can optimize the analysis algorithm using an AI model that uses past analysis result data as input and optimizes the analysis algorithm.

[0038] When analyzing an email, the analysis unit can calculate the reliability score of the sender and reflect it in the analysis results. For example, the analysis unit can score whether the sender's domain is trustworthy and reflect it in the analysis results. For example, the analysis unit can also calculate the reliability score based on the sender's past email history and reflect it in the analysis results. For example, the analysis unit can also evaluate the reliability of the sender's IP address and reflect it in the analysis results. By taking the sender's reliability score into consideration, the accuracy of the analysis results is improved. Some or all of the above-mentioned processing in the analysis unit may be performed using, for example, AI, or may be performed without using AI. For example, the analysis unit can calculate the reliability score using an AI model that inputs sender information and outputs a reliability score and reflect it in the analysis results.

[0039] When analyzing an email, the analysis unit can analyze the language and writing style of the text and identify elements that increase the likelihood of a phishing scam. For example, the analysis unit can identify unnatural wording or a large number of typos in the text as elements that increase the likelihood of a phishing scam. For example, the analysis unit can also identify elements that increase the likelihood of a phishing scam as elements that increase the likelihood of a phishing scam if the language of the text is different from the user's usual language. For example, the analysis unit can also identify elements that increase the likelihood of a phishing scam as elements that increase the likelihood of a phishing scam if the writing style of the text is personal rather than formal. In this way, by analyzing the language and writing style of the text, elements that increase the likelihood of a phishing scam can be identified. Some or all of the above-described processing by the analysis unit may be performed using, for example, AI, or may be performed without using AI. For example, the analysis unit can analyze the language and writing style using an AI model that inputs the text of an email and outputs elements that increase the likelihood of a phishing scam.

[0040] When analyzing emails, the analysis unit can improve the accuracy of the analysis by referring to the user's past email reception history. The analysis unit, for example, adjusts the analysis algorithm based on the characteristics of emails received by the user in the past. The analysis unit can also, for example, prioritize the analysis of emails from specific senders based on the user's past email reception history. The analysis unit can, for example, refer to the user's past email reception history to identify emails that are likely to be phishing scams. By referring to the past email reception history, the accuracy of the analysis is improved. Some or all of the above-mentioned processing in the analysis unit may be performed using, for example, AI, or may be performed without using AI. For example, the analysis unit can improve the accuracy of the analysis by using an AI model that inputs the user's past email reception history data and optimizes the analysis algorithm.

[0041] When analyzing emails, the analysis unit can customize the analysis results by taking into account the user's geographical location information. For example, if the user's current location is in a specific region, the analysis unit performs analysis by taking into account the characteristics of phishing scams that are prevalent in that region. For example, the analysis unit can prioritize analysis of emails from a specific region based on the user's geographical location information. For example, the analysis unit can also refer to the user's geographical location information and reflect the trends in phishing scams in that region in the analysis results. This allows the analysis results to be more appropriately customized by taking the geographical location information into account. Some or all of the above-described processing in the analysis unit may be performed using, for example, AI, or may be performed without using AI. For example, the analysis unit can customize the analysis results by using an AI model that uses the user's geographical location information as input and customizes the analysis results.

[0042] When analyzing emails, the analysis unit can analyze the user's social media activity and reflect related information in the analysis. For example, the analysis unit analyzes the possibility of phishing scams based on information shared by the user on social media. For example, the analysis unit can refer to the user's social media activity history and prioritize analysis of related emails. For example, the analysis unit can also analyze the possibility of phishing scams by referring to the activity of the user's friends on social media. In this way, analyzing social media activity improves the accuracy of the analysis results. Some or all of the above-mentioned processing in the analysis unit may be performed using, for example, AI, or may be performed without using AI. For example, the analysis unit can optimize the analysis results using an AI model that inputs the user's social media activity data and optimizes the analysis results.

[0043] When making a judgment, the judgment unit can optimize the judgment algorithm by referring to past judgment results. The judgment unit adjusts the judgment algorithm, for example, based on the characteristics of emails that have been previously judged to be phishing scams. The judgment unit can also improve the algorithm by learning patterns that have resulted in frequent false judgments from past judgment results. The judgment unit can also refer to past judgment results and prioritize judgment of emails from specific senders. In this way, by referring to past judgment results, the accuracy of the judgment algorithm is improved. Some or all of the above-mentioned processing in the judgment unit may be performed using, for example, AI, or may be performed without using AI. For example, the judgment unit can optimize the judgment algorithm using an AI model that uses past judgment result data as input and optimizes the judgment algorithm.

[0044] When making a judgment, the judgment unit can adjust the judgment result by taking into account the reliability score of the sender of the email. The judgment unit, for example, scores whether the sender domain is trustworthy and reflects the result in the judgment. The judgment unit can also calculate a reliability score based on the sender's past email history and reflect the result in the judgment. The judgment unit can also evaluate the reliability of the sender's IP address and reflect the result in the judgment. By taking the sender's reliability score into account, the accuracy of the judgment result is improved. Some or all of the above-mentioned processing in the judgment unit may be performed using, for example, AI, or may be performed without using AI. For example, the judgment unit can calculate a reliability score using an AI model that inputs sender information and outputs a reliability score, and reflect the result in the judgment.

[0045] During the judgment, the judgment unit can analyze the language and writing style of the email body and identify elements that increase the likelihood of a phishing scam. For example, the judgment unit may identify unnatural wording or a large number of typos in the email body as elements that increase the likelihood of a phishing scam. For example, the judgment unit may also identify elements that increase the likelihood of a phishing scam as elements that increase the likelihood of a phishing scam if the language of the email body is different from the language normally used by the user. For example, the judgment unit may also identify elements that increase the likelihood of a phishing scam as elements that increase the likelihood of a phishing scam if the writing style of the email body is personal rather than formal. In this way, by analyzing the language and writing style of the email body, elements that increase the likelihood of a phishing scam can be identified. Some or all of the above-described processing by the judgment unit may be performed using, for example, AI, or may be performed without using AI. For example, the judgment unit may analyze the language and writing style using an AI model that inputs the email body and outputs elements that increase the likelihood of a phishing scam.

[0046] When making a judgment, the judgment unit can improve the accuracy of the judgment by referring to the user's past email reception history. The judgment unit, for example, adjusts the judgment algorithm based on the characteristics of emails received by the user in the past. The judgment unit can also, for example, prioritize emails from specific senders based on the user's past email reception history. The judgment unit can also, for example, refer to the user's past email reception history to identify emails that are likely to be phishing scams. By referring to the past email reception history, the accuracy of the judgment is improved. Some or all of the above-mentioned processing in the judgment unit may be performed using, for example, AI, or may be performed without using AI. For example, the judgment unit can improve the accuracy of the judgment by using an AI model that inputs the user's past email reception history data and optimizes the judgment algorithm.

[0047] The determination unit can customize the determination result by taking into account the user's geographical location information when making a determination. For example, if the user's current location is in a specific region, the determination unit makes a determination by taking into account the characteristics of phishing scams that are prevalent in that region. For example, the determination unit can prioritize emails from a specific region based on the user's geographical location information. For example, the determination unit can also reference the user's geographical location information and reflect the trends in phishing scams in that region in the determination result. This allows the determination result to be more appropriately customized by taking the geographical location information into account. Some or all of the above-described processing in the determination unit may be performed using, for example, AI, or may be performed without using AI. For example, the determination unit can customize the determination result by using an AI model that uses the user's geographical location information as input and customizes the determination result.

[0048] When making a judgment, the judgment unit can analyze the user's social media activity and reflect related information in the judgment. The judgment unit can judge the possibility of a phishing scam based on, for example, information shared by the user on social media. The judgment unit can also refer to the user's social media activity history and prioritize judgment of related emails. The judgment unit can also refer to, for example, the activity of the user's friends on social media to determine the possibility of a phishing scam. In this way, analyzing social media activity improves the accuracy of the judgment result. Some or all of the above-mentioned processing in the judgment unit can be performed using, for example, AI, or can be performed without using AI. For example, the judgment unit can optimize the judgment result by using an AI model that inputs the user's social media activity data and optimizes the judgment result.

[0049] The notification unit can optimize the notification algorithm by referring to past notification results when sending a notification. The notification unit adjusts the notification algorithm based on, for example, the characteristics of emails previously determined to be phishing scams. The notification unit can also improve the algorithm by learning patterns that frequently resulted in false positives from past notification results. The notification unit can also refer to past notification results and prioritize notifications of emails from specific senders. By referring to past notification results, the accuracy of the notification algorithm is improved. Some or all of the above-described processing in the notification unit may be performed using, for example, AI, or may be performed without using AI. For example, the notification unit can optimize the notification algorithm using an AI model that uses past notification result data as input and optimizes the notification algorithm.

[0050] When notifying, the notification unit can adjust the notification content taking into account the reliability score of the email sender. For example, the notification unit scores whether the sender domain is trustworthy and reflects the result in the notification content. For example, the notification unit can also calculate a reliability score based on the sender's past email history and reflect the result in the notification content. For example, the notification unit can also evaluate the reliability of the sender's IP address and reflect the result in the notification content. In this way, by taking the sender's reliability score into consideration, the accuracy of the notification content is improved. Some or all of the above-mentioned processing in the notification unit may be performed using, for example, AI, or may be performed without using AI. For example, the notification unit can calculate a reliability score using an AI model that inputs sender information and outputs a reliability score, and reflect the result in the notification content.

[0051] When notifying, the notification unit can analyze the language and writing style of the email body and identify elements that increase the likelihood of a phishing scam. For example, the notification unit can identify unnatural wording or a large number of typos in the email body as elements that increase the likelihood of a phishing scam. For example, the notification unit can also identify elements that increase the likelihood of a phishing scam as elements that increase the likelihood of a phishing scam if the language of the email body is different from the language normally used by the user. For example, the notification unit can also identify elements that increase the likelihood of a phishing scam as elements that increase the likelihood of a phishing scam if the writing style of the email body is personal rather than formal. In this way, by analyzing the language and writing style of the email body, elements that increase the likelihood of a phishing scam can be identified. Some or all of the above-described processing by the notification unit may be performed using, for example, AI, or may be performed without using AI. For example, the notification unit can analyze the language and writing style using an AI model that inputs the email body and outputs elements that increase the likelihood of a phishing scam.

[0052] The notification unit can improve the accuracy of notifications by referring to the user's past email reception history when making notifications. The notification unit can, for example, adjust the notification algorithm based on the characteristics of emails the user has received in the past. The notification unit can also, for example, prioritize notifying emails from specific senders based on the user's past email reception history. The notification unit can, for example, refer to the user's past email reception history to identify emails that are likely to be phishing scams. By referring to the past email reception history, the accuracy of notifications is improved. Some or all of the above-mentioned processing in the notification unit can be performed using, for example, AI, or can be performed without using AI. For example, the notification unit can improve the accuracy of notifications by using an AI model that inputs the user's past email reception history data and optimizes the notification algorithm.

[0053] The notification unit can customize the notification content by taking into account the user's geographical location information when sending a notification. For example, if the user's current location is in a specific area, the notification unit can send a notification by taking into account the characteristics of phishing scams that are prevalent in that area. For example, the notification unit can prioritize emails from a specific area based on the user's geographical location information. For example, the notification unit can reference the user's geographical location information and reflect the trends in phishing scams in that area in the notification content. This allows the notification content to be more appropriately customized by taking the geographical location information into account. Some or all of the above-described processing by the notification unit may be performed using, for example, AI, or may be performed without using AI. For example, the notification unit can customize the notification content using an AI model that uses the user's geographical location information as input and customizes the notification content.

[0054] The notification unit may analyze the user's social media activity at the time of notification and reflect relevant information in the notification. For example, the notification unit may notify the user of a possible phishing scam based on information shared by the user on social media. For example, the notification unit may refer to the user's social media activity history and prioritize notifying the user of relevant emails. For example, the notification unit may refer to the activity of the user's friends on social media to notify the user of a possible phishing scam. In this way, analyzing social media activity improves the accuracy of the notification content. Some or all of the above-described processing in the notification unit may be performed using, for example, AI, or may be performed without using AI. For example, the notification unit may input the user's social media activity data and optimize the notification content using an AI model that optimizes the notification content.

[0055] During learning, the learning unit can optimize the learning algorithm by referring to past learning data. The learning unit adjusts the learning algorithm based on, for example, the characteristics of emails previously determined to be phishing scams. The learning unit can also improve the algorithm by learning patterns that frequently resulted in false positives from past learning data. The learning unit can also refer to past learning data and prioritize learning of emails from specific senders, for example. By referring to past learning data, the accuracy of the learning algorithm is improved. Some or all of the above-described processing in the learning unit may be performed using, for example, AI, or may be performed without using AI. For example, the learning unit can optimize the learning algorithm using an AI model that uses past learning data as input and optimizes the learning algorithm.

[0056] During learning, the learning unit can improve the data collection method to quickly incorporate new phishing techniques. For example, when a new phishing technique is discovered, the learning unit quickly incorporates its characteristics into the learning data. For example, the learning unit can automatically collect information about new phishing techniques and reflect it in the learning data. For example, the learning unit can regularly review and improve the data collection method to quickly incorporate new phishing techniques. This improves the accuracy of learning by quickly incorporating new phishing techniques. Some or all of the above-mentioned processing in the learning unit may be performed using, for example, AI, or may be performed without using AI. For example, the learning unit can improve the data collection method by inputting data about new phishing techniques and using an AI model that improves the data collection method.

[0057] During learning, the learning unit can adjust the learning data taking into account the trustworthiness score of the email sender. For example, the learning unit scores whether the sender domain is trustworthy and reflects the result in the learning data. For example, the learning unit can also calculate a trustworthiness score based on the sender's past email history and reflect the result in the learning data. For example, the learning unit can evaluate the trustworthiness of the sender's IP address and reflect the result in the learning data. This improves the accuracy of the learning data by taking the sender's trustworthiness score into consideration. Some or all of the above-described processing in the learning unit may be performed using, for example, AI, or may be performed without using AI. For example, the learning unit can calculate a trustworthiness score using an AI model that inputs sender information and outputs a trustworthiness score, and reflect the result in the learning data.

[0058] During learning, the learning unit can improve the accuracy of the learning data by referring to the user's past email reception history. The learning unit, for example, adjusts the learning algorithm based on the characteristics of emails the user has received in the past. The learning unit can also, for example, prioritize learning emails from specific senders from the user's past email reception history. The learning unit can also, for example, refer to the user's past email reception history to identify emails that are likely to be phishing scams. By referring to the past email reception history, the accuracy of the learning data is improved. Some or all of the above-mentioned processing in the learning unit may be performed using, for example, AI, or may be performed without using AI. For example, the learning unit can improve the accuracy of the learning data by using an AI model that uses the user's past email reception history data as input and optimizes the learning algorithm.

[0059] During learning, the learning unit can customize the learning data by taking into account the user's geographical location information. For example, if the user's current location is in a specific region, the learning unit learns by taking into account the characteristics of phishing scams that are prevalent in that region. For example, the learning unit can prioritize learning emails from a specific region based on the user's geographical location information. For example, the learning unit can also reference the user's geographical location information and reflect the trends in phishing scams in that region in the learning data. This allows the learning data to be more appropriately customized by taking the geographical location information into account. Some or all of the above-described processing in the learning unit may be performed using, for example, AI, or may be performed without using AI. For example, the learning unit can customize the learning data using an AI model that uses the user's geographical location information as input and customizes the learning data.

[0060] During learning, the learning unit can analyze the user's social media activity and reflect related information in the learning. For example, the learning unit learns about the possibility of phishing scams based on information shared by the user on social media. For example, the learning unit can refer to the user's social media activity history and prioritize learning related emails. For example, the learning unit can also refer to the activity of the user's friends on social media to learn about the possibility of phishing scams. In this way, analyzing social media activity improves the accuracy of the learning data. Some or all of the above-mentioned processing in the learning unit may be performed using, for example, AI, or may be performed without using AI. For example, the learning unit can input the user's social media activity data and optimize the learning data using an AI model that optimizes the learning data.

[0061] The system according to the embodiment is not limited to the above-described example, and various modifications are possible, for example, as follows.

[0062] When analyzing emails, the analysis unit can improve the accuracy of the analysis by referring to the user's past search history. For example, the analysis unit can analyze the possibility of phishing scams based on keywords searched by the user in the past and information on websites visited by the user. For example, the analysis unit can prioritize the analysis of emails related to a specific topic from the user's search history. By referring to the past search history, the accuracy of the analysis can be improved. Some or all of the above-mentioned processing in the analysis unit can be performed using, for example, AI, or can be performed without using AI. For example, the analysis unit can improve the accuracy of the analysis by using an AI model that inputs the user's search history data and optimizes the analysis algorithm.

[0063] When analyzing emails, the analysis unit can improve the accuracy of the analysis by referring to the user's browser history. For example, the analysis unit can analyze the possibility of phishing scams based on information about websites the user has visited in the past. The analysis unit can also, for example, prioritize analysis of emails related to a specific topic from the user's browser history. By referring to the browser history, the accuracy of the analysis can be improved. Some or all of the above-mentioned processing in the analysis unit can be performed using, for example, AI, or can be performed without using AI. For example, the analysis unit can improve the accuracy of the analysis by using an AI model that inputs the user's browser history data and optimizes the analysis algorithm.

[0064] When analyzing emails, the analysis unit can improve the accuracy of the analysis by referring to the user's purchase history. For example, the analysis unit analyzes the possibility of phishing scams based on information about products the user has purchased in the past. The analysis unit can also, for example, prioritize the analysis of emails related to the purchase of specific products based on the user's purchase history. By referring to the purchase history, the accuracy of the analysis is improved. Some or all of the above-mentioned processing in the analysis unit may be performed using, for example, AI, or may be performed without using AI. For example, the analysis unit can improve the accuracy of the analysis by using an AI model that inputs the user's purchase history data and optimizes the analysis algorithm.

[0065] When analyzing emails, the analysis unit can analyze the user's social media activity and reflect related information in the analysis. For example, the analysis unit can analyze the possibility of phishing scams based on information shared by the user on social media. The analysis unit can also refer to the user's social media activity history and prioritize analysis of related emails. This analysis of social media activity improves the accuracy of the analysis results. Some or all of the above-mentioned processing in the analysis unit can be performed using, for example, AI, or can be performed without using AI. For example, the analysis unit can optimize the analysis results using an AI model that inputs the user's social media activity data and optimizes the analysis results.

[0066] When making a judgment, the judgment unit can customize the judgment result by taking into account the user's geographical location information. For example, if the user's current location is in a specific area, the judgment is made by taking into account the characteristics of phishing scams that are prevalent in that area. The judgment unit can also, for example, prioritize emails from a specific area based on the user's geographical location information. This allows the judgment result to be more appropriately customized by taking the geographical location information into account. Some or all of the above-mentioned processing in the judgment unit may be performed using, for example, AI, or may be performed without using AI. For example, the judgment unit can customize the judgment result by using an AI model that uses the user's geographical location information as input and customizes the judgment result.

[0067] The processing flow of the first embodiment will be briefly explained below.

[0068] Step 1: The analysis unit analyzes the email. For example, the analysis unit analyzes the sender address, subject, body content, and linked URL of the email. The analysis unit detects cases where the sender address is from an unreliable domain, where the body contains unnatural wording, or where the linked URL is suspicious. Step 2: The determination unit determines the possibility of phishing based on the email analyzed by the analysis unit. The determination unit makes a determination based on the characteristics of phishing. Step 3: The notification unit alerts the user based on the results of the judgment made by the judgment unit. The notification unit adds a warning message such as "This may be a phishing scam" to the subject or body of the email. It can also display a warning pop-up when the user tries to click on the linked URL. Step 4: The learning unit continuously learns the characteristics of phishing scams identified by the detection unit. When a new phishing technique is discovered, the learning unit learns its characteristics and can use them in future detections.

[0069] (Example 2) A phishing detection system according to an embodiment of the present invention uses AI to detect phishing emails and warn users to prevent fraud. When an email is received, the AI ​​analyzes the email and determines whether it is likely to be a phishing scam. If a phishing scam is determined to be a phishing scam, the system displays a warning message to the user. For example, the phishing detection system performs detailed analysis of the email's sender address, subject, body content, and linked URL to detect phishing scam characteristics. Examples of such characteristics include the sender address being from an unreliable domain, the body containing unnatural language, and the linked URL being suspicious. If a phishing scam is determined to be a phishing scam, the system displays a warning message to the user. For example, the system adds a warning message such as "This is a possible phishing scam" to the email's subject or body. Furthermore, the system can warn users by displaying a warning pop-up when they attempt to click on a linked URL. Furthermore, the phishing detection system continuously learns the characteristics of phishing emails to improve its detection accuracy. For example, if a new phishing scam technique is discovered, the AI ​​can learn its characteristics and use them in future detections. This allows the phishing detection system to make users wary of phishing emails and prevent fraud before it happens. This allows the phishing detection system to make users wary of phishing emails and prevent fraud before it happens. Furthermore, as the AI ​​continues to learn, detection accuracy improves, enabling more effective countermeasures against phishing scams. For example, introducing it into a company's email system can be expected to raise security awareness among all employees and significantly reduce the number of phishing scams.

[0070] A phishing detection system according to an embodiment includes an analysis unit, a determination unit, a notification unit, and a learning unit. The analysis unit analyzes emails. For example, the analysis unit analyzes the sender address, subject, body content, and linked URL of the email. The analysis unit detects, for example, when the sender address is from an unreliable domain, when the body contains unnatural language, or when the linked URL is suspicious. The determination unit determines whether the email is a phishing scam based on the email analyzed by the analysis unit. The determination unit makes the determination based on, for example, the characteristics of the phishing scam. The notification unit issues a warning to the user based on the determination result by the determination unit. For example, the notification unit adds a warning message such as "This may be a phishing scam" to the subject or body of the email. The notification unit can also display a warning pop-up when the user attempts to click on the linked URL. The learning unit continuously learns the characteristics of phishing scams determined by the determination unit. For example, when a new phishing technique is discovered, the learning unit can learn the characteristics and use them for future detections. As a result, the phishing fraud detection system according to the embodiment can detect phishing fraud emails and warn users to prevent them from falling victim to fraud.

[0071] The analysis unit can analyze the sender address, subject, content of the body, and linked URL. For example, the analysis unit detects when the sender address is from an unreliable domain. For example, the analysis unit can also detect when a specific keyword is included in the subject. For example, the analysis unit can also detect when unnatural wording is included in the body. For example, the analysis unit can also detect when a linked URL is suspicious. This improves the accuracy of detecting characteristics of phishing scams through detailed analysis of emails. Some or all of the above-mentioned processing in the analysis unit may be performed using, for example, AI, or may be performed without using AI. For example, the analysis unit can perform analysis using an AI model that inputs the sender address, subject, content of the body, and linked URL and outputs characteristics of phishing scams.

[0072] The notification unit can add a warning message to the subject or body of the email. For example, the notification unit can add a warning message such as "Possible phishing scam" to the subject of the email. The notification unit can also add a warning message to the body of the email, for example. The notification unit can also customize the wording of the warning message, for example. This can alert the user to the possibility of a phishing scam and raise their awareness. Some or all of the above-mentioned processing in the notification unit can be performed using, for example, AI, or can be performed without using AI. For example, the notification unit can add a warning message using an AI model that inputs the subject or body of the email and outputs a warning message.

[0073] The notification unit can display a warning pop-up when a user attempts to click on a linked URL. For example, the notification unit can display a warning pop-up such as "This link may be a phishing scam" when a user attempts to click on a linked URL. The notification unit can also customize the design of the warning pop-up, for example. The notification unit can also adjust the timing of the display of the warning pop-up, for example. This allows a warning to be displayed before a user clicks on a link, preventing damage from phishing scams. Some or all of the above-described processing in the notification unit can be performed using, for example, AI, or can be performed without using AI. For example, the notification unit can display the warning pop-up using an AI model that receives the linked URL as input and outputs a warning pop-up.

[0074] The learning unit can learn new phishing techniques and use the information for future detections. For example, when a new phishing technique is discovered, the learning unit learns its characteristics. For example, the learning unit can automatically collect information about phishing techniques and reflect it in the learning data. For example, the learning unit can periodically review and improve the learning algorithm. This improves detection accuracy by adapting to new phishing techniques. Some or all of the above-mentioned processing in the learning unit may be performed using, for example, AI, or may be performed without using AI. For example, the learning unit can input data about new phishing techniques and perform learning using an AI model that updates the learning algorithm.

[0075] The analysis unit can perform a detailed analysis of the content of the email to detect characteristics of a phishing scam. For example, the analysis unit can detect specific phrases included in the body of the email. For example, the analysis unit can also analyze the writing style of the email and detect unnatural wording. For example, the analysis unit can evaluate the reliability of the URL linked to in the email. This allows for accurate detection of characteristics of a phishing scam through detailed analysis. Some or all of the above-mentioned processing in the analysis unit may be performed using, for example, AI, or may be performed without using AI. For example, the analysis unit can perform a detailed analysis using an AI model that inputs the body, writing style, and URL linked to the email and outputs characteristics of a phishing scam.

[0076] The notification unit can display a message to warn the user that a phishing scam may have occurred. For example, the notification unit displays a warning message such as "Possible phishing scam" in the subject line of an email. The notification unit can also display the warning message in the body of the email, for example. The notification unit can also adjust the timing of displaying the warning message. This can prevent damage from phishing scams by displaying a warning to the user. Some or all of the above-described processing in the notification unit may be performed using, for example, AI, or may be performed without using AI. For example, the notification unit can display the warning message using an AI model that inputs the subject line or body of an email and outputs a warning message.

[0077] The learning unit can improve detection accuracy by continuously learning the characteristics of phishing scams. The learning unit, for example, continuously learns the characteristics of phishing scams. The learning unit can, for example, periodically update learning data to adapt to the latest phishing scam techniques. The learning unit can, for example, improve the learning algorithm to improve detection accuracy. This improves the accuracy of phishing scam detection through continuous learning. Some or all of the above-mentioned processing in the learning unit may be performed using, for example, AI, or may be performed without using AI. For example, the learning unit can continuously learn using an AI model that inputs data related to the characteristics of phishing scams and updates the learning algorithm.

[0078] The analysis unit can estimate the user's emotions and adjust the analysis priority based on the estimated user emotions. For example, when the user is feeling stressed, the analysis unit prioritizes analyzing emails of high importance. For example, when the user is relaxed, the analysis unit can analyze all emails equally. For example, when the user is in a hurry, the analysis unit can adjust the email analysis so that the analysis is completed in a short time. This enables more appropriate analysis by adjusting the analysis priority according to the user's emotions. Emotion estimation is realized using an emotion estimation function, for example, an emotion engine or a generative AI. The generative AI may be, but is not limited to, a text generation AI (e.g., LLM) or a multimodal generation AI. Some or all of the above-described processing in the analysis unit may be performed using, for example, an AI, or may be performed without using an AI. For example, the analysis unit can adjust the analysis priority using an AI model that inputs user emotion data and outputs analysis priorities.

[0079] When analyzing emails, the analysis unit can optimize the analysis algorithm by referring to past analysis results. The analysis unit adjusts the analysis algorithm based on, for example, the characteristics of emails that have been previously determined to be phishing scams. The analysis unit can also improve the algorithm by learning, for example, patterns that frequently resulted in false positives from past analysis results. The analysis unit can also refer to, for example, past analysis results and prioritize the analysis of emails from specific senders. In this way, the accuracy of the analysis algorithm is improved by referring to past analysis results. Some or all of the above-described processing in the analysis unit may be performed using, for example, AI, or may be performed without using AI. For example, the analysis unit can optimize the analysis algorithm using an AI model that uses past analysis result data as input and optimizes the analysis algorithm.

[0080] When analyzing an email, the analysis unit can calculate the reliability score of the sender and reflect it in the analysis results. For example, the analysis unit can score whether the sender's domain is trustworthy and reflect it in the analysis results. For example, the analysis unit can also calculate the reliability score based on the sender's past email history and reflect it in the analysis results. For example, the analysis unit can also evaluate the reliability of the sender's IP address and reflect it in the analysis results. By taking the sender's reliability score into consideration, the accuracy of the analysis results is improved. Some or all of the above-mentioned processing in the analysis unit may be performed using, for example, AI, or may be performed without using AI. For example, the analysis unit can calculate the reliability score using an AI model that inputs sender information and outputs a reliability score and reflect it in the analysis results.

[0081] When analyzing an email, the analysis unit can analyze the language and writing style of the text and identify elements that increase the likelihood of a phishing scam. For example, the analysis unit can identify unnatural wording or a large number of typos in the text as elements that increase the likelihood of a phishing scam. For example, the analysis unit can also identify elements that increase the likelihood of a phishing scam as elements that increase the likelihood of a phishing scam if the language of the text is different from the user's usual language. For example, the analysis unit can also identify elements that increase the likelihood of a phishing scam as elements that increase the likelihood of a phishing scam if the writing style of the text is personal rather than formal. In this way, by analyzing the language and writing style of the text, elements that increase the likelihood of a phishing scam can be identified. Some or all of the above-described processing by the analysis unit may be performed using, for example, AI, or may be performed without using AI. For example, the analysis unit can analyze the language and writing style using an AI model that inputs the text of an email and outputs elements that increase the likelihood of a phishing scam.

[0082] The analysis unit can estimate the user's emotions and adjust the display method of the analysis results based on the estimated user emotions. For example, if the user is nervous, the analysis unit can provide a simple, highly visible display method. For example, if the user is relaxed, the analysis unit can provide a display method that includes detailed information. For example, if the user is in a hurry, the analysis unit can provide a display method that focuses on the main points. This enables more appropriate display by adjusting the display method of the analysis results according to the user's emotions. Emotion estimation is achieved using an emotion estimation function, for example, using an emotion engine or a generation AI. The generation AI can be a text generation AI (e.g., LLM) or a multimodal generation AI, but is not limited to such examples. Some or all of the above-mentioned processing in the analysis unit can be performed using, for example, AI, or without AI. For example, the analysis unit can adjust the display method using an AI model that inputs user emotion data and outputs a display method for the analysis results.

[0083] When analyzing emails, the analysis unit can improve the accuracy of the analysis by referring to the user's past email reception history. The analysis unit, for example, adjusts the analysis algorithm based on the characteristics of emails received by the user in the past. The analysis unit can also, for example, prioritize the analysis of emails from specific senders based on the user's past email reception history. The analysis unit can, for example, refer to the user's past email reception history to identify emails that are likely to be phishing scams. By referring to the past email reception history, the accuracy of the analysis is improved. Some or all of the above-mentioned processing in the analysis unit may be performed using, for example, AI, or may be performed without using AI. For example, the analysis unit can improve the accuracy of the analysis by using an AI model that inputs the user's past email reception history data and optimizes the analysis algorithm.

[0084] When analyzing emails, the analysis unit can customize the analysis results by taking into account the user's geographical location information. For example, if the user's current location is in a specific region, the analysis unit performs analysis by taking into account the characteristics of phishing scams that are prevalent in that region. For example, the analysis unit can prioritize analysis of emails from a specific region based on the user's geographical location information. For example, the analysis unit can also refer to the user's geographical location information and reflect the trends in phishing scams in that region in the analysis results. This allows the analysis results to be more appropriately customized by taking the geographical location information into account. Some or all of the above-described processing in the analysis unit may be performed using, for example, AI, or may be performed without using AI. For example, the analysis unit can customize the analysis results by using an AI model that uses the user's geographical location information as input and customizes the analysis results.

[0085] When analyzing emails, the analysis unit can analyze the user's social media activity and reflect related information in the analysis. For example, the analysis unit analyzes the possibility of phishing scams based on information shared by the user on social media. For example, the analysis unit can refer to the user's social media activity history and prioritize analysis of related emails. For example, the analysis unit can also analyze the possibility of phishing scams by referring to the activity of the user's friends on social media. In this way, analyzing social media activity improves the accuracy of the analysis results. Some or all of the above-mentioned processing in the analysis unit may be performed using, for example, AI, or may be performed without using AI. For example, the analysis unit can optimize the analysis results using an AI model that inputs the user's social media activity data and optimizes the analysis results.

[0086] The determination unit can estimate the user's emotions and adjust the determination criteria based on the estimated user emotions. For example, when the user is stressed, the determination unit applies stricter determination criteria. For example, when the user is relaxed, the determination unit can also apply normal determination criteria. For example, when the user is in a hurry, the determination unit can also adjust the determination criteria to enable quicker determination. This enables more appropriate determination by adjusting the determination criteria according to the user's emotions. Emotion estimation is realized using an emotion estimation function, for example, using an emotion engine or a generation AI. The generation AI can be a text generation AI (e.g., LLM) or a multimodal generation AI, but is not limited to such examples. Some or all of the above-mentioned processing in the determination unit can be performed using, for example, AI, or without AI. For example, the determination unit can adjust the determination criteria using an AI model that inputs user emotion data and outputs determination criteria.

[0087] When making a judgment, the judgment unit can optimize the judgment algorithm by referring to past judgment results. The judgment unit adjusts the judgment algorithm, for example, based on the characteristics of emails that have been previously judged to be phishing scams. The judgment unit can also improve the algorithm by learning patterns that have resulted in frequent false judgments from past judgment results. The judgment unit can also refer to past judgment results and prioritize judgment of emails from specific senders. In this way, by referring to past judgment results, the accuracy of the judgment algorithm is improved. Some or all of the above-mentioned processing in the judgment unit may be performed using, for example, AI, or may be performed without using AI. For example, the judgment unit can optimize the judgment algorithm using an AI model that uses past judgment result data as input and optimizes the judgment algorithm.

[0088] When making a judgment, the judgment unit can adjust the judgment result by taking into account the reliability score of the sender of the email. The judgment unit, for example, scores whether the sender domain is trustworthy and reflects the result in the judgment. The judgment unit can also calculate a reliability score based on the sender's past email history and reflect the result in the judgment. The judgment unit can also evaluate the reliability of the sender's IP address and reflect the result in the judgment. By taking the sender's reliability score into account, the accuracy of the judgment result is improved. Some or all of the above-mentioned processing in the judgment unit may be performed using, for example, AI, or may be performed without using AI. For example, the judgment unit can calculate a reliability score using an AI model that inputs sender information and outputs a reliability score, and reflect the result in the judgment.

[0089] During the judgment, the judgment unit can analyze the language and writing style of the email body and identify elements that increase the likelihood of a phishing scam. For example, the judgment unit may identify unnatural wording or a large number of typos in the email body as elements that increase the likelihood of a phishing scam. For example, the judgment unit may also identify elements that increase the likelihood of a phishing scam as elements that increase the likelihood of a phishing scam if the language of the email body is different from the language normally used by the user. For example, the judgment unit may also identify elements that increase the likelihood of a phishing scam as elements that increase the likelihood of a phishing scam if the writing style of the email body is personal rather than formal. In this way, by analyzing the language and writing style of the email body, elements that increase the likelihood of a phishing scam can be identified. Some or all of the above-described processing by the judgment unit may be performed using, for example, AI, or may be performed without using AI. For example, the judgment unit may analyze the language and writing style using an AI model that inputs the email body and outputs elements that increase the likelihood of a phishing scam.

[0090] The determination unit can estimate the user's emotions and adjust the display method of the determination result based on the estimated user emotions. For example, if the user is nervous, the determination unit can provide a simple, highly visible display method. For example, if the user is relaxed, the determination unit can also provide a display method including detailed information. For example, if the user is in a hurry, the determination unit can also provide a display method that focuses on the main points. This enables more appropriate display by adjusting the display method of the determination result according to the user's emotions. Emotion estimation is realized using an emotion estimation function, for example, using an emotion engine or a generation AI. The generation AI can be a text generation AI (e.g., LLM) or a multimodal generation AI, but is not limited to such examples. Some or all of the above-mentioned processing in the determination unit can be performed using, for example, AI, or without AI. For example, the determination unit can adjust the display method using an AI model that inputs user emotion data and outputs a display method of the determination result.

[0091] When making a judgment, the judgment unit can improve the accuracy of the judgment by referring to the user's past email reception history. The judgment unit, for example, adjusts the judgment algorithm based on the characteristics of emails received by the user in the past. The judgment unit can also, for example, prioritize emails from specific senders based on the user's past email reception history. The judgment unit can also, for example, refer to the user's past email reception history to identify emails that are likely to be phishing scams. By referring to the past email reception history, the accuracy of the judgment is improved. Some or all of the above-mentioned processing in the judgment unit may be performed using, for example, AI, or may be performed without using AI. For example, the judgment unit can improve the accuracy of the judgment by using an AI model that inputs the user's past email reception history data and optimizes the judgment algorithm.

[0092] The determination unit can customize the determination result by taking into account the user's geographical location information when making a determination. For example, if the user's current location is in a specific region, the determination unit makes a determination by taking into account the characteristics of phishing scams that are prevalent in that region. For example, the determination unit can prioritize emails from a specific region based on the user's geographical location information. For example, the determination unit can also reference the user's geographical location information and reflect the trends in phishing scams in that region in the determination result. This allows the determination result to be more appropriately customized by taking the geographical location information into account. Some or all of the above-described processing in the determination unit may be performed using, for example, AI, or may be performed without using AI. For example, the determination unit can customize the determination result by using an AI model that uses the user's geographical location information as input and customizes the determination result.

[0093] When making a judgment, the judgment unit can analyze the user's social media activity and reflect related information in the judgment. The judgment unit can judge the possibility of a phishing scam based on, for example, information shared by the user on social media. The judgment unit can also refer to the user's social media activity history and prioritize judgment of related emails. The judgment unit can also refer to, for example, the activity of the user's friends on social media to determine the possibility of a phishing scam. In this way, analyzing social media activity improves the accuracy of the judgment result. Some or all of the above-mentioned processing in the judgment unit can be performed using, for example, AI, or can be performed without using AI. For example, the judgment unit can optimize the judgment result by using an AI model that inputs the user's social media activity data and optimizes the judgment result.

[0094] The notification unit can estimate the user's emotions and adjust the notification presentation method based on the estimated user emotions. For example, if the user is nervous, the notification unit can provide a simple, highly visible notification. For example, if the user is relaxed, the notification unit can also provide a notification with detailed information. For example, if the user is in a hurry, the notification unit can also provide a notification that focuses on the main points. This enables more appropriate notifications by adjusting the notification presentation method according to the user's emotions. Emotion estimation is achieved using an emotion estimation function, for example, an emotion engine or a generation AI. The generation AI can be a text generation AI (e.g., LLM) or a multimodal generation AI, but is not limited to such examples. Some or all of the above-mentioned processing in the notification unit can be performed using, for example, AI, or without AI. For example, the notification unit can adjust the presentation method using an AI model that inputs user emotion data and outputs a notification presentation method.

[0095] The notification unit can optimize the notification algorithm by referring to past notification results when sending a notification. The notification unit adjusts the notification algorithm based on, for example, the characteristics of emails previously determined to be phishing scams. The notification unit can also improve the algorithm by learning patterns that frequently resulted in false positives from past notification results. The notification unit can also refer to past notification results and prioritize notifications of emails from specific senders. By referring to past notification results, the accuracy of the notification algorithm is improved. Some or all of the above-described processing in the notification unit may be performed using, for example, AI, or may be performed without using AI. For example, the notification unit can optimize the notification algorithm using an AI model that uses past notification result data as input and optimizes the notification algorithm.

[0096] When notifying, the notification unit can adjust the notification content taking into account the reliability score of the email sender. For example, the notification unit scores whether the sender domain is trustworthy and reflects the result in the notification content. For example, the notification unit can also calculate a reliability score based on the sender's past email history and reflect the result in the notification content. For example, the notification unit can also evaluate the reliability of the sender's IP address and reflect the result in the notification content. In this way, by taking the sender's reliability score into consideration, the accuracy of the notification content is improved. Some or all of the above-mentioned processing in the notification unit may be performed using, for example, AI, or may be performed without using AI. For example, the notification unit can calculate a reliability score using an AI model that inputs sender information and outputs a reliability score, and reflect the result in the notification content.

[0097] When notifying, the notification unit can analyze the language and writing style of the email body and identify elements that increase the likelihood of a phishing scam. For example, the notification unit can identify unnatural wording or a large number of typos in the email body as elements that increase the likelihood of a phishing scam. For example, the notification unit can also identify elements that increase the likelihood of a phishing scam as elements that increase the likelihood of a phishing scam if the language of the email body is different from the language normally used by the user. For example, the notification unit can also identify elements that increase the likelihood of a phishing scam as elements that increase the likelihood of a phishing scam if the writing style of the email body is personal rather than formal. In this way, by analyzing the language and writing style of the email body, elements that increase the likelihood of a phishing scam can be identified. Some or all of the above-described processing by the notification unit may be performed using, for example, AI, or may be performed without using AI. For example, the notification unit can analyze the language and writing style using an AI model that inputs the email body and outputs elements that increase the likelihood of a phishing scam.

[0098] The notification unit can estimate the user's emotions and adjust the timing of notifications based on the estimated user emotions. For example, if the user is nervous, the notification unit can immediately display an important notification. For example, if the user is relaxed, the notification unit can also delay the display of the notification. For example, if the user is in a hurry, the notification unit can also quickly display the notification. This allows for more appropriate timing by adjusting the timing of notifications according to the user's emotions. Emotion estimation is achieved using an emotion estimation function, for example, an emotion engine or a generation AI. The generation AI can be a text generation AI (e.g., LLM) or a multimodal generation AI, but is not limited to such examples. Some or all of the above-mentioned processing in the notification unit can be performed using, for example, AI, or without AI. For example, the notification unit can adjust the timing using an AI model that inputs user emotion data and outputs the timing of notifications.

[0099] The notification unit can improve the accuracy of notifications by referring to the user's past email reception history when making notifications. The notification unit can, for example, adjust the notification algorithm based on the characteristics of emails the user has received in the past. The notification unit can also, for example, prioritize notifying emails from specific senders based on the user's past email reception history. The notification unit can, for example, refer to the user's past email reception history to identify emails that are likely to be phishing scams. By referring to the past email reception history, the accuracy of notifications is improved. Some or all of the above-mentioned processing in the notification unit can be performed using, for example, AI, or can be performed without using AI. For example, the notification unit can improve the accuracy of notifications by using an AI model that inputs the user's past email reception history data and optimizes the notification algorithm.

[0100] The notification unit can customize the notification content by taking into account the user's geographical location information when sending a notification. For example, if the user's current location is in a specific area, the notification unit can send a notification by taking into account the characteristics of phishing scams that are prevalent in that area. For example, the notification unit can prioritize emails from a specific area based on the user's geographical location information. For example, the notification unit can reference the user's geographical location information and reflect the trends in phishing scams in that area in the notification content. This allows the notification content to be more appropriately customized by taking the geographical location information into account. Some or all of the above-described processing by the notification unit may be performed using, for example, AI, or may be performed without using AI. For example, the notification unit can customize the notification content using an AI model that uses the user's geographical location information as input and customizes the notification content.

[0101] The notification unit may analyze the user's social media activity at the time of notification and reflect relevant information in the notification. For example, the notification unit may notify the user of a possible phishing scam based on information shared by the user on social media. For example, the notification unit may refer to the user's social media activity history and prioritize notifying the user of relevant emails. For example, the notification unit may refer to the activity of the user's friends on social media to notify the user of a possible phishing scam. In this way, analyzing social media activity improves the accuracy of the notification content. Some or all of the above-described processing in the notification unit may be performed using, for example, AI, or may be performed without using AI. For example, the notification unit may input the user's social media activity data and optimize the notification content using an AI model that optimizes the notification content.

[0102] The learning unit can estimate the user's emotions and select training data based on the estimated user emotions. For example, if the user is stressed, the learning unit prioritizes learning of features of phishing scam emails with high importance. For example, if the user is relaxed, the learning unit can equally learn the features of all phishing scam emails. For example, if the user is in a hurry, the learning unit can select training data so that learning is completed in a short time. This enables more appropriate training by selecting training data according to the user's emotions. Emotion estimation is achieved using an emotion estimation function, for example, using an emotion engine or generative AI. Generative AI includes, but is not limited to, text generation AI (e.g., LLM) and multimodal generation AI. Some or all of the above-described processing in the learning unit may be performed using AI, or may be performed without AI. For example, the learning unit can select training data using an AI model that inputs user emotion data and outputs a selection of training data.

[0103] During learning, the learning unit can optimize the learning algorithm by referring to past learning data. The learning unit adjusts the learning algorithm based on, for example, the characteristics of emails previously determined to be phishing scams. The learning unit can also improve the algorithm by learning patterns that frequently resulted in false positives from past learning data. The learning unit can also refer to past learning data and prioritize learning of emails from specific senders, for example. By referring to past learning data, the accuracy of the learning algorithm is improved. Some or all of the above-described processing in the learning unit may be performed using, for example, AI, or may be performed without using AI. For example, the learning unit can optimize the learning algorithm using an AI model that uses past learning data as input and optimizes the learning algorithm.

[0104] During learning, the learning unit can improve the data collection method to quickly incorporate new phishing techniques. For example, when a new phishing technique is discovered, the learning unit quickly incorporates its characteristics into the learning data. For example, the learning unit can automatically collect information about new phishing techniques and reflect it in the learning data. For example, the learning unit can regularly review and improve the data collection method to quickly incorporate new phishing techniques. This improves the accuracy of learning by quickly incorporating new phishing techniques. Some or all of the above-mentioned processing in the learning unit may be performed using, for example, AI, or may be performed without using AI. For example, the learning unit can improve the data collection method by inputting data about new phishing techniques and using an AI model that improves the data collection method.

[0105] During learning, the learning unit can adjust the learning data taking into account the trustworthiness score of the email sender. For example, the learning unit scores whether the sender domain is trustworthy and reflects the result in the learning data. For example, the learning unit can also calculate a trustworthiness score based on the sender's past email history and reflect the result in the learning data. For example, the learning unit can evaluate the trustworthiness of the sender's IP address and reflect the result in the learning data. This improves the accuracy of the learning data by taking the sender's trustworthiness score into consideration. Some or all of the above-described processing in the learning unit may be performed using, for example, AI, or may be performed without using AI. For example, the learning unit can calculate a trustworthiness score using an AI model that inputs sender information and outputs a trustworthiness score, and reflect the result in the learning data.

[0106] The learning unit can estimate the user's emotions and adjust the learning frequency based on the estimated user emotions. For example, the learning unit can reduce the learning frequency when the user is stressed. For example, the learning unit can also normalize the learning frequency when the user is relaxed. For example, the learning unit can increase the learning frequency when the user is in a hurry. This allows for more appropriate learning by adjusting the learning frequency according to the user's emotions. Emotion estimation is achieved using an emotion estimation function, for example, an emotion engine or a generative AI. The generative AI can be a text generation AI (e.g., LLM) or a multimodal generation AI, but is not limited to such examples. Some or all of the above-described processing in the learning unit can be performed using, for example, AI, or without AI. For example, the learning unit can adjust the learning frequency using an AI model that inputs user emotion data and outputs the learning frequency.

[0107] During learning, the learning unit can improve the accuracy of the learning data by referring to the user's past email reception history. The learning unit, for example, adjusts the learning algorithm based on the characteristics of emails the user has received in the past. The learning unit can also, for example, prioritize learning emails from specific senders from the user's past email reception history. The learning unit can also, for example, refer to the user's past email reception history to identify emails that are likely to be phishing scams. By referring to the past email reception history, the accuracy of the learning data is improved. Some or all of the above-mentioned processing in the learning unit may be performed using, for example, AI, or may be performed without using AI. For example, the learning unit can improve the accuracy of the learning data by using an AI model that uses the user's past email reception history data as input and optimizes the learning algorithm.

[0108] During learning, the learning unit can customize the learning data by taking into account the user's geographical location information. For example, if the user's current location is in a specific region, the learning unit learns by taking into account the characteristics of phishing scams that are prevalent in that region. For example, the learning unit can prioritize learning emails from a specific region based on the user's geographical location information. For example, the learning unit can also reference the user's geographical location information and reflect the trends in phishing scams in that region in the learning data. This allows the learning data to be more appropriately customized by taking the geographical location information into account. Some or all of the above-described processing in the learning unit may be performed using, for example, AI, or may be performed without using AI. For example, the learning unit can customize the learning data using an AI model that uses the user's geographical location information as input and customizes the learning data.

[0109] During learning, the learning unit can analyze the user's social media activity and reflect related information in the learning. For example, the learning unit learns about the possibility of phishing scams based on information shared by the user on social media. For example, the learning unit can refer to the user's social media activity history and prioritize learning related emails. For example, the learning unit can also refer to the activity of the user's friends on social media to learn about the possibility of phishing scams. In this way, analyzing social media activity improves the accuracy of the learning data. Some or all of the above-mentioned processing in the learning unit may be performed using, for example, AI, or may be performed without using AI. For example, the learning unit can input the user's social media activity data and optimize the learning data using an AI model that optimizes the learning data. === Hard Collateral 1-1 === Each of the multiple elements including the above-mentioned analysis unit, determination unit, notification unit, and learning unit is realized, for example, by at least one of the smart device 14 and the data processing device 12. For example, the analysis unit is realized by the processor 46 of the smart device 14 and analyzes the sender address, subject, body content, and linked URL of an email. The determination unit is realized, for example, by the specific processing unit 290 of the data processing device 12 and determines the possibility of phishing fraud based on the analyzed email. The notification unit is realized, for example, by the control unit 46A of the smart device 14 and displays a warning message to the user. The learning unit is realized, for example, by the specific processing unit 290 of the data processing device 12 and continuously learns the characteristics of phishing fraud. === Hard Collateral 1-2 === Each of the multiple elements including the above-mentioned analysis unit, determination unit, notification unit, and learning unit is realized, for example, by at least one of the smart glasses 214 and the data processing device 12. For example, the analysis unit is realized by the processor 46 of the smart glasses 214 and analyzes the sender address, subject, body content, and linked URL of an email. The determination unit is realized, for example, by the specific processing unit 290 of the data processing device 12 and determines the possibility of a phishing scam based on the analyzed email. The notification unit is realized, for example, by the control unit 46A of the smart glasses 214 and displays a warning message to the user. The learning unit is realized, for example, by the specific processing unit 290 of the data processing device 12 and continuously learns the characteristics of phishing scams. === Hard Collateral 1-3 === Each of the multiple elements including the above-mentioned analysis unit, determination unit, notification unit, and learning unit is realized, for example, by at least one of the headset type terminal 314 and the data processing device 12. For example, the analysis unit is realized by the processor 46 of the headset type terminal 314 and analyzes the sender address, subject, body content, and linked URL of an email. The determination unit is realized, for example, by the specific processing unit 290 of the data processing device 12 and determines the possibility of a phishing scam based on the analyzed email. The notification unit is realized, for example, by the control unit 46A of the headset type terminal 314 and displays a warning message to the user. The learning unit is realized, for example, by the specific processing unit 290 of the data processing device 12 and continuously learns the characteristics of phishing scams. === Hard Collateral 1-4 === Each of the multiple elements including the above-mentioned analysis unit, determination unit, notification unit, and learning unit is realized, for example, by at least one of the robot 414 and the data processing device 12. For example, the analysis unit is realized by the processor 46 of the robot 414 and analyzes the sender address, subject, body content, and linked URL of an email. The determination unit is realized, for example, by the specific processing unit 290 of the data processing device 12 and determines the possibility of a phishing scam based on the analyzed email. The notification unit is realized, for example, by the control unit 46A of the robot 414 and displays a warning message to the user. The learning unit is realized, for example, by the specific processing unit 290 of the data processing device 12 and continuously learns the characteristics of phishing scams.

[0110] The system according to the embodiment is not limited to the above-described example, and various modifications are possible, for example, as follows.

[0111] When analyzing emails, the analysis unit can improve the accuracy of the analysis by referring to the user's past search history. For example, the analysis unit can analyze the possibility of phishing scams based on keywords searched by the user in the past and information on websites visited by the user. For example, the analysis unit can prioritize the analysis of emails related to a specific topic from the user's search history. By referring to the past search history, the accuracy of the analysis can be improved. Some or all of the above-mentioned processing in the analysis unit can be performed using, for example, AI, or can be performed without using AI. For example, the analysis unit can improve the accuracy of the analysis by using an AI model that inputs the user's search history data and optimizes the analysis algorithm.

[0112] The determination unit can estimate the user's emotions and adjust the priority of the determination results based on the estimated user emotions. For example, if the user is feeling stressed, it can prioritize phishing scam emails with high importance. For example, if the user is relaxed, the determination unit can also evaluate all emails equally. This allows for more appropriate determination by adjusting the priority of the determination results according to the user's emotions. Emotion estimation is achieved using an emotion estimation function, for example, using an emotion engine or a generative AI. The generative AI can be, but is not limited to, a text generation AI (e.g., LLM) or a multimodal generation AI. Some or all of the above-described processing in the determination unit can be performed using, for example, an AI, or can be performed without using an AI. For example, the determination unit can adjust the priority of the determination results using an AI model that inputs user emotion data and outputs the priority of the determination results.

[0113] The notification unit can estimate the user's emotions and customize the content of the notification based on the estimated user's emotions. For example, if the user is nervous, the notification unit can provide a concise and clear notification. For example, if the user is relaxed, the notification unit can also provide a notification with detailed information. This allows for more appropriate notification by customizing the content of the notification according to the user's emotions. Emotion estimation is achieved using an emotion estimation function, for example, an emotion engine or a generation AI. The generation AI can be a text generation AI (e.g., LLM) or a multimodal generation AI, but is not limited to such examples. Some or all of the above-mentioned processing in the notification unit can be performed using, for example, AI, or can be performed without using AI. For example, the notification unit can customize the content of the notification using an AI model that inputs user emotion data and outputs the content of the notification.

[0114] The learning unit can estimate the user's emotions and adjust the priority of the training data based on the estimated user emotions. For example, if the user is stressed, the learning unit can prioritize learning of features of phishing emails with high importance. For example, if the user is relaxed, the learning unit can equally learn the features of all phishing emails. This enables more appropriate training by adjusting the priority of the training data according to the user's emotions. Emotion estimation is achieved using an emotion estimation function, for example, an emotion engine or a generative AI. The generative AI can be, but is not limited to, a text generation AI (e.g., LLM) or a multimodal generation AI. Some or all of the above-described processing in the learning unit can be performed using, for example, AI, or without AI. For example, the learning unit can adjust the priority of the training data using an AI model that inputs user emotion data and outputs the priority of the training data.

[0115] When analyzing emails, the analysis unit can improve the accuracy of the analysis by referring to the user's browser history. For example, the analysis unit can analyze the possibility of phishing scams based on information about websites the user has visited in the past. The analysis unit can also, for example, prioritize analysis of emails related to a specific topic from the user's browser history. By referring to the browser history, the accuracy of the analysis can be improved. Some or all of the above-mentioned processing in the analysis unit can be performed using, for example, AI, or can be performed without using AI. For example, the analysis unit can improve the accuracy of the analysis by using an AI model that inputs the user's browser history data and optimizes the analysis algorithm.

[0116] The determination unit can estimate the user's emotion and adjust the display method of the determination result based on the estimated user emotion. For example, if the user is nervous, the determination unit can provide a simple, highly visible display method. For example, if the user is relaxed, the determination unit can also provide a display method including detailed information. This allows for more appropriate display by adjusting the display method of the determination result according to the user's emotion. Emotion estimation is achieved using an emotion estimation function, for example, using an emotion engine or a generation AI. The generation AI can be a text generation AI (e.g., LLM) or a multimodal generation AI, but is not limited to such examples. Some or all of the above-mentioned processing in the determination unit can be performed using, for example, AI, or without AI. For example, the determination unit can adjust the display method using an AI model that inputs user emotion data and outputs a display method of the determination result.

[0117] When analyzing emails, the analysis unit can improve the accuracy of the analysis by referring to the user's purchase history. For example, the analysis unit analyzes the possibility of phishing scams based on information about products the user has purchased in the past. The analysis unit can also, for example, prioritize the analysis of emails related to the purchase of specific products based on the user's purchase history. By referring to the purchase history, the accuracy of the analysis is improved. Some or all of the above-mentioned processing in the analysis unit may be performed using, for example, AI, or may be performed without using AI. For example, the analysis unit can improve the accuracy of the analysis by using an AI model that inputs the user's purchase history data and optimizes the analysis algorithm.

[0118] The notification unit can estimate the user's emotions and adjust the timing of notifications based on the estimated user emotions. For example, if the user is nervous, an important notification can be displayed immediately. For example, if the user is relaxed, the notification unit can also delay the display of notifications slightly. This allows for more appropriate timing by adjusting the timing of notifications according to the user's emotions. Emotion estimation is achieved using an emotion estimation function, for example, an emotion engine or a generation AI. The generation AI can be a text generation AI (e.g., LLM) or a multimodal generation AI, but is not limited to such examples. Some or all of the above-mentioned processing in the notification unit can be performed using, for example, AI, or can be performed without using AI. For example, the notification unit can adjust the timing using an AI model that inputs user emotion data and outputs the timing of notifications.

[0119] When analyzing emails, the analysis unit can analyze the user's social media activity and reflect related information in the analysis. For example, the analysis unit can analyze the possibility of phishing scams based on information shared by the user on social media. The analysis unit can also refer to the user's social media activity history and prioritize analysis of related emails. This analysis of social media activity improves the accuracy of the analysis results. Some or all of the above-mentioned processing in the analysis unit can be performed using, for example, AI, or can be performed without using AI. For example, the analysis unit can optimize the analysis results using an AI model that inputs the user's social media activity data and optimizes the analysis results.

[0120] When making a judgment, the judgment unit can customize the judgment result by taking into account the user's geographical location information. For example, if the user's current location is in a specific area, the judgment is made by taking into account the characteristics of phishing scams that are prevalent in that area. The judgment unit can also, for example, prioritize emails from a specific area based on the user's geographical location information. This allows the judgment result to be more appropriately customized by taking the geographical location information into account. Some or all of the above-mentioned processing in the judgment unit may be performed using, for example, AI, or may be performed without using AI. For example, the judgment unit can customize the judgment result by using an AI model that uses the user's geographical location information as input and customizes the judgment result.

[0121] The processing flow of the second embodiment will be briefly explained below.

[0122] Step 1: The analysis unit analyzes the email. For example, the analysis unit analyzes the sender address, subject, body content, and linked URL of the email. The analysis unit detects cases where the sender address is from an unreliable domain, where the body contains unnatural wording, or where the linked URL is suspicious. Step 2: The determination unit determines the possibility of phishing based on the email analyzed by the analysis unit. The determination unit makes a determination based on the characteristics of phishing. Step 3: The notification unit alerts the user based on the results of the judgment made by the judgment unit. The notification unit adds a warning message such as "This may be a phishing scam" to the subject or body of the email. It can also display a warning pop-up when the user tries to click on the linked URL. Step 4: The learning unit continuously learns the characteristics of phishing scams identified by the detection unit. When a new phishing technique is discovered, the learning unit learns its characteristics and can use them in future detections.

[0123] The specific processing unit 290 transmits the result of the specific processing to the smart device 14. In the smart device 14, the control unit 46A causes the output device 40 to output the result of the specific processing. The microphone 38B acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0124] The data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of the data generation model 58 is ChatGPT (registered trademark) (Internet search engine).<URL: https: / / openai.com / blog / chatgpt> Examples of generative AIs include the data generation model 58, such as a neural network model (e.g., a neural network model), and a neural network model (e.g., a neural network model). The data generation model 58 is obtained by performing deep learning on a neural network. A prompt including an instruction is input to the data generation model 58, and inference data such as voice data indicating speech, text data indicating text, and image data indicating an image is also input to the data generation model 58. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization. The specification processing unit 290 performs the above-mentioned specification processing using the data generation model 58. The data generation model 58 may be a fine-tuned model so as to output an inference result from a prompt that does not include an instruction. In this case, the data generation model 58 can output an inference result from a prompt that does not include an instruction. The data processing device 12 and the like include multiple types of data generation models 58, and the data generation model 58 includes AIs other than the generative AI. The AI ​​other than the generative AI may be, for example, linear regression, logistic regression, decision tree, random forest, support vector machine (SVM), k-means clustering, convolutional neural network (CNN), recurrent neural network (RNN), generative adversarial network (GAN), or naive Bayes, and can perform various processes, but is not limited to these examples. The AI ​​may also be an AI agent. When the processes of each of the above-mentioned parts are performed by AI, the processes may be performed in part or entirely by AI, but are not limited to these examples. The processes performed by AI, including the generative AI, may be replaced with rule-based processes.

[0125] Furthermore, the processing by the data processing system 10 described above is executed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the smart device 14, but may also be executed by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the smart device 14. Furthermore, the specific processing unit 290 of the data processing device 12 acquires or collects information necessary for processing from the smart device 14 or an external device, and the smart device 14 acquires or collects information necessary for processing from the data processing device 12 or an external device.

[0126] The correspondence between each part and the device or control part is not limited to the example described above, and various modifications are possible.

[0127] [Second embodiment] FIG. 3 shows an example of the configuration of a data processing system 210 according to the second embodiment.

[0128] 3, the data processing system 210 includes a data processing device 12 and smart glasses 214. An example of the data processing device 12 is a server.

[0129] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN and / or a LAN.

[0130] The smart glasses 214 include a computer 36, a microphone 238, a speaker 240, a camera 42, and a communication I / F 44. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, and the camera 42 are also connected to the bus 52.

[0131] The microphone 238 receives instructions and the like from the user by receiving voice uttered by the user. The microphone 238 captures the voice uttered by the user, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to instructions from the processor 46.

[0132] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the user's surroundings (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[0133] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[0134] Fig. 4 shows an example of the main functions of the data processing device 12 and the smart glasses 214. As shown in Fig. 4, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0135] The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0136] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290. The identification processing unit 290 can estimate a user's emotion using the emotion identification model 59 and perform identification processing using the user's emotion. The emotion estimation function (emotion identification function) using the emotion identification model 59 performs various estimations and predictions regarding the user's emotion, including estimation and prediction of the user's emotion, but is not limited to these examples. Furthermore, the estimation and prediction of emotion also includes, for example, emotion analysis.

[0137] In the smart glasses 214, the specific processing is performed by the processor 46. A specific processing program 60 is stored in the storage 50. The processor 46 reads the specific processing program 60 from the storage 50 and executes the read specific processing program 60 on the RAM 48. The specific processing is realized by the processor 46 operating as the control unit 46A in accordance with the specific processing program 60 executed on the RAM 48. The smart glasses 214 also have a data generation model and an emotion identification model similar to the data generation model 58 and the emotion identification model 59, and can perform processing similar to that of the specific processing unit 290 using these models.

[0138] Note that a device other than the data processing device 12 may have the data generation model 58. For example, a server device may have the data generation model 58. In this case, the data processing device 12 communicates with the server device having the data generation model 58 to obtain a processing result (such as a prediction result) using the data generation model 58. Furthermore, the data processing device 12 may be a server device, or may be a terminal device (for example, a mobile phone, a robot, a home appliance, etc.) owned by a user.

[0139] The specific processing unit 290 transmits the result of the specific processing to the smart glasses 214. In the smart glasses 214, the control unit 46A causes the speaker 240 to output the result of the specific processing. The microphone 238 acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0140] The data generation model 58 is a so-called generative AI. An example of the data generation model 58 is a generative AI such as ChatGPT. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 receives a prompt containing an instruction, as well as inference data such as voice data representing speech, text data representing text, and image data representing an image. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization. The identification processing unit 290 performs the above-mentioned identification processing using the data generation model 58. The data generation model 58 may be a fine-tuned model so as to output an inference result from a prompt that does not include an instruction. In this case, the data generation model 58 can output an inference result from a prompt that does not include an instruction. The data processing device 12 and the like include multiple types of data generation models 58, and the data generation model 58 includes AIs other than the generative AI. The AI ​​other than the generative AI may be, for example, linear regression, logistic regression, decision tree, random forest, support vector machine (SVM), k-means clustering, convolutional neural network (CNN), recurrent neural network (RNN), generative adversarial network (GAN), or naive Bayes, and can perform various processes, but is not limited to these examples. The AI ​​may also be an AI agent. When the processes of each of the above-mentioned parts are performed by AI, the processes may be performed in part or entirely by AI, but are not limited to these examples. The processes performed by AI, including the generative AI, may be replaced with rule-based processes.

[0141] The data processing system 210 according to the second embodiment performs the same processing as the data processing system 10 according to the first embodiment. The processing by the data processing system 210 is executed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the smart glasses 214, but may also be executed by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the smart glasses 214. Furthermore, the specific processing unit 290 of the data processing device 12 acquires or collects information required for processing from the smart glasses 214 or an external device, etc., and the smart glasses 214 acquires or collects information required for processing from the data processing device 12 or an external device, etc.

[0142] The correspondence between each part and the device or control part is not limited to the example described above, and various modifications are possible.

[0143] [Third embodiment] FIG. 5 shows an example of the configuration of a data processing system 310 according to the third embodiment.

[0144] 5, the data processing system 310 includes the data processing device 12 and a headset type terminal 314. An example of the data processing device 12 is a server.

[0145] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN and / or a LAN.

[0146] The headset type terminal 314 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication I / F 44, and a display 343. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, the camera 42, and the display 343 are also connected to the bus 52.

[0147] The microphone 238 receives instructions and the like from the user by receiving voice uttered by the user. The microphone 238 captures the voice uttered by the user, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to instructions from the processor 46.

[0148] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the user's surroundings (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[0149] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[0150] Fig. 6 shows an example of the main functions of the data processing device 12 and the headset type terminal 314. As shown in Fig. 6, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0151] The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0152] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290. The identification processing unit 290 can estimate a user's emotion using the emotion identification model 59 and perform identification processing using the user's emotion. The emotion estimation function (emotion identification function) using the emotion identification model 59 performs various estimations and predictions regarding the user's emotion, including estimation and prediction of the user's emotion, but is not limited to these examples. Furthermore, the estimation and prediction of emotion also includes, for example, emotion analysis.

[0153] In the headset type terminal 314, the identification process is performed by the processor 46. A identification program 60 is stored in the storage 50. The processor 46 reads the identification program 60 from the storage 50 and executes the read identification program 60 on the RAM 48. The identification process is realized by the processor 46 operating as a control unit 46A in accordance with the identification program 60 executed on the RAM 48. Note that the headset type terminal 314 has a data generation model and an emotion identification model similar to the data generation model 58 and the emotion identification model 59, and can also perform processing similar to that of the identification processing unit 290 using these models.

[0154] Note that a device other than the data processing device 12 may have the data generation model 58. For example, a server device may have the data generation model 58. In this case, the data processing device 12 communicates with the server device having the data generation model 58 to obtain a processing result (such as a prediction result) using the data generation model 58. Furthermore, the data processing device 12 may be a server device, or may be a terminal device (for example, a mobile phone, a robot, a home appliance, etc.) owned by a user.

[0155] The specific processing unit 290 transmits the result of the specific processing to the headset type terminal 314. In the headset type terminal 314, the control unit 46A causes the speaker 240 and the display 343 to output the result of the specific processing. The microphone 238 acquires audio indicating a user input regarding the result of the specific processing. The control unit 46A transmits audio data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0156] The data generation model 58 is a so-called generative AI. An example of the data generation model 58 is a generative AI such as ChatGPT. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 receives a prompt containing an instruction, as well as inference data such as voice data representing speech, text data representing text, and image data representing an image. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization. The identification processing unit 290 performs the above-mentioned identification processing using the data generation model 58. The data generation model 58 may be a fine-tuned model so as to output an inference result from a prompt that does not include an instruction. In this case, the data generation model 58 can output an inference result from a prompt that does not include an instruction. The data processing device 12 and the like include multiple types of data generation models 58, and the data generation model 58 includes AIs other than the generative AI. The AI ​​other than the generative AI may be, for example, linear regression, logistic regression, decision tree, random forest, support vector machine (SVM), k-means clustering, convolutional neural network (CNN), recurrent neural network (RNN), generative adversarial network (GAN), or naive Bayes, and can perform various processes, but is not limited to these examples. The AI ​​may also be an AI agent. When the processes of each of the above-mentioned parts are performed by AI, the processes may be performed in part or entirely by AI, but are not limited to these examples. The processes performed by AI, including the generative AI, may be replaced with rule-based processes.

[0157] The data processing system 310 according to the third embodiment performs the same processing as the data processing system 10 according to the first embodiment. The processing by the data processing system 310 is executed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the headset type terminal 314, but may also be executed by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the headset type terminal 314. Furthermore, the specific processing unit 290 of the data processing device 12 acquires or collects information required for processing from the headset type terminal 314 or an external device, etc., and the headset type terminal 314 acquires or collects information required for processing from the data processing device 12 or an external device, etc.

[0158] The correspondence between each part and the device or control part is not limited to the example described above, and various modifications are possible.

[0159] [Fourth embodiment] FIG. 7 shows an example of the configuration of a data processing system 410 according to the fourth embodiment.

[0160] 7, the data processing system 410 includes a data processing device 12 and a robot 414. An example of the data processing device 12 is a server.

[0161] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication I / F 26 are also connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN and / or a LAN.

[0162] The robot 414 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication I / F 44, and a control target 443. The computer 36 includes a processor 46, a RAM 48, and a storage 50. The processor 46, the RAM 48, and the storage 50 are connected to a bus 52. The microphone 238, the speaker 240, the camera 42, and the control target 443 are also connected to the bus 52.

[0163] The microphone 238 receives instructions and the like from the user by receiving voice uttered by the user. The microphone 238 captures the voice uttered by the user, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to instructions from the processor 46.

[0164] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an imaging element such as a CMOS image sensor or a CCD image sensor, and captures images of the user's surroundings (for example, an imaging range defined by an angle of view equivalent to the field of vision of a typical healthy person).

[0165] The communication I / F 44 is connected to a network 54. The communication I / Fs 44 and 26 are responsible for the exchange of various information between the processor 46 and the processor 28 via the network 54. The exchange of various information between the processor 46 and the processor 28 using the communication I / Fs 44 and 26 is carried out in a secure state.

[0166] The control object 443 includes a display device, LEDs in the eyes, and motors that drive the arms, hands, and feet. The posture and gestures of the robot 414 are controlled by controlling the motors of the arms, hands, and feet. Some of the emotions of the robot 414 can be expressed by controlling these motors. In addition, the facial expressions of the robot 414 can also be expressed by controlling the light emission state of the LEDs in the eyes of the robot 414.

[0167] Fig. 8 shows an example of the main functions of the data processing device 12 and the robot 414. As shown in Fig. 8, in the data processing device 12, a specific process is performed by the processor 28. A specific process program 56 is stored in the storage 32.

[0168] The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0169] The storage 32 stores a data generation model 58 and an emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290. The identification processing unit 290 can estimate a user's emotion using the emotion identification model 59 and perform identification processing using the user's emotion. The emotion estimation function (emotion identification function) using the emotion identification model 59 performs various estimations and predictions regarding the user's emotion, including estimation and prediction of the user's emotion, but is not limited to these examples. Furthermore, the estimation and prediction of emotion also includes, for example, emotion analysis.

[0170] In the robot 414, the processor 46 performs the identification process. The storage 50 stores the identification program 60. The processor 46 reads the identification program 60 from the storage 50 and executes the read identification program 60 on the RAM 48. The identification process is realized by the processor 46 operating as the control unit 46A in accordance with the identification program 60 executed on the RAM 48. The robot 414 also has a data generation model and an emotion identification model similar to the data generation model 58 and the emotion identification model 59, and can perform the same process as the identification processing unit 290 using these models.

[0171] Note that a device other than the data processing device 12 may have the data generation model 58. For example, a server device may have the data generation model 58. In this case, the data processing device 12 communicates with the server device having the data generation model 58 to obtain a processing result (such as a prediction result) using the data generation model 58. Furthermore, the data processing device 12 may be a server device, or may be a terminal device (for example, a mobile phone, a robot, a home appliance, etc.) owned by a user.

[0172] The specific processing unit 290 transmits the result of the specific processing to the robot 414. In the robot 414, the control unit 46A causes the speaker 240 and the control target 443 to output the result of the specific processing. The microphone 238 acquires voice indicating a user input regarding the result of the specific processing. The control unit 46A transmits voice data indicating the user input acquired by the microphone 238 to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the voice data.

[0173] The data generation model 58 is a so-called generative AI. An example of the data generation model 58 is a generative AI such as ChatGPT. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 receives a prompt containing an instruction, as well as inference data such as voice data representing speech, text data representing text, and image data representing an image. The data generation model 58 performs inference on the input inference data in accordance with the instruction indicated by the prompt and outputs the inference result in a data format such as voice data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization. The identification processing unit 290 performs the above-mentioned identification processing using the data generation model 58. The data generation model 58 may be a fine-tuned model so as to output an inference result from a prompt that does not include an instruction. In this case, the data generation model 58 can output an inference result from a prompt that does not include an instruction. The data processing device 12 and the like include multiple types of data generation models 58, and the data generation model 58 includes AIs other than the generative AI. The AI ​​other than the generative AI may be, for example, linear regression, logistic regression, decision tree, random forest, support vector machine (SVM), k-means clustering, convolutional neural network (CNN), recurrent neural network (RNN), generative adversarial network (GAN), or naive Bayes, and can perform various processes, but is not limited to these examples. The AI ​​may also be an AI agent. When the processes of each of the above-mentioned parts are performed by AI, the processes may be performed in part or entirely by AI, but are not limited to these examples. The processes performed by AI, including the generative AI, may be replaced with rule-based processes.

[0174] The data processing system 410 according to the fourth embodiment performs the same processing as the data processing system 10 according to the first embodiment. The processing by the data processing system 410 is executed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the robot 414, but may also be executed by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the robot 414. Furthermore, the specific processing unit 290 of the data processing device 12 acquires or collects information required for processing from the robot 414 or an external device, etc., and the robot 414 acquires or collects information required for processing from the data processing device 12 or an external device, etc.

[0175] The correspondence between each part and the device or control part is not limited to the example described above, and various modifications are possible.

[0176] The emotion identification model 59 as an emotion engine may determine the user's emotion according to a specific mapping. Specifically, the emotion identification model 59 may determine the user's emotion according to an emotion map (see FIG. 9), which is a specific mapping. Similarly, the emotion identification model 59 may determine the robot's emotion, and the identification processing unit 290 may perform identification processing using the robot's emotion.

[0177] FIG. 9 illustrates an emotion map 400 on which multiple emotions are mapped. In the emotion map 400, emotions are arranged in concentric circles radiating from the center. Emotions closer to the center of the concentric circles are more primitive. Emotions representing states and behaviors arising from a state of mind are arranged on the outer edges of the concentric circles. The concept of emotion encompasses both emotions and mental states. Emotions generally generated from reactions occurring in the brain are arranged on the left side of the concentric circles. Emotions generally induced by situational judgment are arranged on the right side of the concentric circles. Emotions generally generated from reactions occurring in the brain and induced by situational judgment are arranged on the upper and lower sides of the concentric circles. Furthermore, the emotion of "pleasure" is arranged on the upper side of the concentric circles, and the emotion of "discomfort" is arranged on the lower side. In this way, in the emotion map 400, multiple emotions are mapped based on the structure by which emotions are generated, and emotions that tend to occur simultaneously are mapped close to each other.

[0178] These emotions are distributed in the 3 o'clock direction on emotion map 400, and typically fluctuate between relief and anxiety. In the right half of emotion map 400, situational awareness dominates over internal sensations, resulting in a sense of calm.

[0179] The inside of emotion map 400 represents what is going on in the mind, and the outside of emotion map 400 represents behavior, so the further you go outside emotion map 400, the more visible the emotions become (the more they are expressed in behavior).

[0180] Human emotions are based on various balances, such as posture and blood sugar levels. When these balances deviate from the ideal, a state of discomfort is expressed, and when they approach the ideal, a state of pleasure is expressed. Emotions can also be created for robots, cars, and motorcycles, based on various balances, such as posture and remaining battery life. When these balances deviate from the ideal, a state of discomfort is expressed, and when they approach the ideal, a state of pleasure is expressed. An emotion map can be generated, for example, based on Dr. Mitsuyoshi's emotion map (Research on speech emotion recognition and brain physiological signal analysis systems for emotions, Tokushima University, doctoral dissertation: https: / / ci.nii.ac.jp / naid / 500000375379). The left half of the emotion map lists emotions belonging to the area called "reaction," where sensation is dominant. The right half of the emotion map lists emotions belonging to the area called "situation," where situational awareness is dominant.

[0181] The emotion map defines two emotions that promote learning. One is a negative emotion on the situation side, around the middle of "repentance" or "reflection." In other words, this occurs when the robot experiences negative emotions such as "I never want to feel this way again" or "I don't want to be scolded again." The other is a positive emotion on the response side, around "desire." In other words, this occurs when the robot experiences positive feelings such as "I want more" or "I want to know more."

[0182] The emotion identification model 59 inputs user input into a pre-trained neural network, obtains emotion values ​​indicating each emotion shown in the emotion map 400, and determines the user's emotion. This neural network is pre-trained based on multiple pieces of training data that are combinations of user input and emotion values ​​indicating each emotion shown in the emotion map 400. Furthermore, this neural network is trained so that emotions that are located close to each other have similar values, as in the emotion map 900 shown in FIG. 10. FIG. 10 shows an example in which multiple emotions, "relieved," "calm," and "reassuring," have similar emotion values.

[0183] In the above embodiment, an example was given in which a specific process is performed by one computer 22, but the technology disclosed herein is not limited to this, and distributed processing of the specific process may be performed by multiple computers including computer 22.

[0184] In the above embodiment, an example in which the specific processing program 56 is stored in the storage 32 has been described, but the technology of the present disclosure is not limited to this. For example, the specific processing program 56 may be stored in a portable, computer-readable, non-transitory storage medium such as a USB (Universal Serial Bus) memory. The specific processing program 56 stored in the non-transitory storage medium is installed in the computer 22 of the data processing device 12. The processor 28 executes the specific processing in accordance with the specific processing program 56.

[0185] Alternatively, the specific processing program 56 may be stored in a storage device such as a server connected to the data processing device 12 via the network 54, and the specific processing program 56 may be downloaded and installed on the computer 22 in response to a request from the data processing device 12.

[0186] It is not necessary to store all of the specific processing program 56 in a storage device such as a server connected to the data processing device 12 via the network 54, or to store all of the specific processing program 56 in the storage 32; only a portion of the specific processing program 56 may be stored.

[0187] The hardware resource for executing a specific process can be any of the following types of processors: A processor, for example, is a CPU, which is a general-purpose processor that functions as a hardware resource for executing a specific process by executing software, i.e., a program. A processor also includes a dedicated electrical circuit, such as an FPGA (Field-Programmable Gate Array), a PLD (Programmable Logic Device), or an ASIC (Application Specific Integrated Circuit), which is a processor with a circuit configuration designed specifically for executing a specific process. Each processor has built-in or connected memory, and each processor uses the memory to execute the specific process.

[0188] The hardware resource that executes the specific process may be configured with one of these various processors, or may be configured with a combination of two or more processors of the same or different types (for example, a combination of multiple FPGAs, or a combination of a CPU and an FPGA). Also, the hardware resource that executes the specific process may be a single processor.

[0189] As an example of a system configured with a single processor, first, one processor is configured by combining one or more CPUs and software, and this processor functions as a hardware resource that executes a specific process. Second, there is a system that uses a processor that realizes the functions of an entire system including multiple hardware resources that execute a specific process on a single IC chip, as typified by SoC (System-on-a-chip). In this way, a specific process is realized using one or more of the above-mentioned various processors as hardware resources.

[0190] Furthermore, the hardware structure of these various processors can be, more specifically, an electric circuit that combines circuit elements such as semiconductor devices. The specific processing described above is merely an example. Therefore, it goes without saying that unnecessary steps may be deleted, new steps may be added, or the processing order may be rearranged, without departing from the spirit of the invention.

[0191] In the above example, the first to fourth embodiments have been described separately, but some or all of these embodiments may be combined. The smart device 14, smart glasses 214, headset terminal 314, and robot 414 are merely examples, and they may be combined, or other devices may be used. In the above example, the first and second embodiments have been described separately, but they may be combined.

[0192] The above-described description and illustrations are a detailed explanation of the parts related to the technology of the present disclosure and are merely an example of the technology of the present disclosure. For example, the above description of the configuration, functions, actions, and effects is an explanation of an example of the configuration, functions, actions, and effects of the parts related to the technology of the present disclosure. Therefore, it goes without saying that unnecessary parts may be deleted, new elements may be added, or replacements may be made to the above-described description and illustrations within the scope of the gist of the technology of the present disclosure. Furthermore, to avoid confusion and facilitate understanding of the parts related to the technology of the present disclosure, the above-described description and illustrations omit explanations of common technical knowledge that do not require particular explanation to enable the implementation of the technology of the present disclosure.

[0193] All publications, patent applications, and technical standards mentioned in this specification are herein incorporated by reference to the same extent as if each individual publication, patent application, or technical standard was specifically and individually indicated to be incorporated by reference.

[0194] [Explanation of symbols]

[0195] 10, 210, 310, 410 Data Processing Systems 12 Data Processing Device 14 Smart Devices 214 Smart Glasses 314 Headset-type terminal 414 Robot

Claims

1. an analysis unit that analyzes emails; a determination unit that determines whether the email is a phishing scam based on the email analyzed by the analysis unit; a notification unit that issues a warning to a user based on the result of the determination by the determination unit; a learning unit that continuously learns the characteristics of phishing fraud determined by the determination unit. A system characterized by:

2. The analysis unit We will show you how to analyze the sender address, subject, body content, and destination URL.

2. The system of claim 1.

3. The notification unit Demonstrate how to add a warning message to the subject or body of an email 2. The system of claim 1.

4. The notification unit Here's how to display a warning popup when you click on a link URL:

2. The system of claim 1.

5. The learning unit Learn about new phishing scam techniques and show specific methods to use to detect them in the future 2. The system of claim 1.

6. The analysis unit Demonstrates specific methods for analyzing email content in detail to detect phishing scams 2. The system of claim 1.

7. The notification unit Demonstrate specific methods for displaying a message to users warning them of a potential phishing scam 2. The system of claim 1.

8. The learning unit Improve detection accuracy by continuously learning the characteristics of phishing scams 2. The system of claim 1.

Images