system

Abstract

We provide the system. [Solution] A means for inputting customer system information, A means for generating software configuration information based on input system information, A method for collecting vulnerability-related information using a web crawler, A means of storing and analyzing collected vulnerability information in an AI learning database, A means of comparing software configuration information with vulnerability data to assess risk, A system that includes means for generating evaluation results as a report and providing it to the user.

Description

Technical Field

[0001] The technology of the present disclosure relates to a system.

Background Art

[0002] Patent Document 1 discloses a persona chatbot control method performed by at least one processor, including steps of receiving a user utterance, adding the user utterance to a prompt including an instruction sentence related to an explanation of a chatbot character, encoding the prompt, and inputting the encoded prompt into a language model to generate a chatbot utterance in response to the user utterance.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] In recent years, cyberattacks exploiting vulnerabilities in information systems have been increasing rapidly. Especially for small-scale enterprises, the collection and management of vulnerable information have become a heavy burden. In the current system, it is difficult to collect vulnerable information in a timely manner and conduct accurate analysis, and a large amount of time and labor are also required for reporting to upper levels. As a result, there arises a problem that effective countermeasures are delayed and the security risks of enterprises increase. An object of the present invention is to solve these problems and provide a system for efficiently and quickly collecting, analyzing, and reporting vulnerable information.

Means for Solving the Problems

[0005] The present invention first provides means for inputting customer system information and means for generating software configuration information based on the input system information. This software configuration information includes the names and version information of installed software. Next, it provides means for collecting vulnerability-related information using a web crawler, and means for storing and analyzing the collected vulnerability information in an AI learning database. Specifically, the AI ​​model learns based on the collected data and analyzes the characteristics and risk level of the vulnerabilities. Furthermore, it includes means for comparing the software configuration information with the vulnerability data, evaluating the risk, generating the evaluation results as a report, and providing it to the user. Through this process, the user can quickly and efficiently collect and analyze vulnerability information and easily report it to higher levels.

[0006] "Customer system information" refers to data provided by the user, including software names and version information that constitute components of the information system.

[0007] "Software configuration information" refers to configuration information that lists the names, versions, and dependencies of software installed within a system, and is known as SBOM (Software-Based Configuration Information).

[0008] A "web crawler" is a program that automatically collects information from specific websites on the internet.

[0009] "Vulnerability-related information" refers to data about potential security flaws or attackable areas in a system, including CVE numbers, scope of impact, and countermeasures.

[0010] An "AI learning database" is a database that stores collected vulnerability-related information, allowing AI models to use that data for learning.

[0011] "Means of risk assessment" refers to methods and processes for evaluating security risks to a system based on collected and analyzed vulnerability information.

[0012] "Means of generating evaluation results as a report" refers to methods or processes for outputting the results of a risk assessment in a format that is easy for humans to understand (e.g., PDF or HTML). [Brief explanation of the drawing]

[0013] [Figure 1] This is a conceptual diagram showing an example of the configuration of a data processing system according to the first embodiment. [Figure 2] This is a conceptual diagram showing an example of the essential functions of the data processing device and smart device according to the first embodiment. [Figure 3] This is a conceptual diagram showing an example of the configuration of a data processing system according to the second embodiment. [Figure 4] This is a conceptual diagram showing an example of the main functions of a data processing device and smart glasses according to the second embodiment. [Figure 5] This is a conceptual diagram showing an example of the configuration of a data processing system according to the third embodiment. [Figure 6] This is a conceptual diagram showing an example of the main functions of a data processing device and a headset-type terminal according to the third embodiment. [Figure 7] This is a conceptual diagram showing an example of the configuration of a data processing system according to the fourth embodiment. [Figure 8] This is a conceptual diagram showing an example of the main functions of a data processing device and a robot according to the fourth embodiment. [Figure 9] This shows an emotion map where multiple emotions are mapped. [Figure 10] This shows an emotion map where multiple emotions are mapped. [Figure 11] This is a sequence diagram showing the processing flow of the data processing system in Example 1. [Figure 12] This is a sequence diagram showing the processing flow of the data processing system in Application Example 1. [Figure 13] This is a sequence diagram showing the processing flow of the data processing system in Example 2, which incorporates an emotion engine. [Figure 14]It is a sequence diagram showing the processing flow of a data processing system in Application Example 2 when a sentiment engine is combined.

Embodiments for Carrying Out the Invention

[0014] Hereinafter, an example of an embodiment of a system according to the technology of the present disclosure will be described with reference to the accompanying drawings.

[0015] First, the terms used in the following description will be explained.

[0016] In the following embodiments, a numbered processor (hereinafter simply referred to as "processor") may be a single arithmetic unit or a combination of multiple arithmetic units. Also, the processor may be a single type of arithmetic unit or a combination of multiple types of arithmetic units. Examples of arithmetic units include a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), a GPGPU (General-Purpose computing on Graphics Processing Units), an APU (Accelerated Processing Unit), and the like.

[0017] In the following embodiments, a numbered RAM (Random Access Memory) is a memory in which information is temporarily stored and is used as a work memory by the processor.

[0018] In the following embodiments, a numbered storage is one or more non-volatile storage devices that store various programs and various parameters, etc. Examples of non-volatile storage devices include flash memory (SSD (Solid State Drive)), magnetic disks (e.g., hard disks), or magnetic tapes, etc.

[0019] In the following embodiments, the signed communication interface (I / F) is an interface that includes a communication processor and an antenna, etc. The communication interface manages communication between multiple computers. Examples of communication standards applicable to the communication interface include wireless communication standards such as 5G (5th Generation Mobile Communication System), Wi-Fi (registered trademark), or Bluetooth (registered trademark).

[0020] In the following embodiments, "A and / or B" is synonymous with "at least one of A and B." That is, "A and / or B" means that it may be A alone, or B alone, or a combination of A and B. Furthermore, in this specification, the same concept as "A and / or B" applies when expressing three or more things linked by "and / or."

[0021] [First Embodiment]

[0022] Figure 1 shows an example of the configuration of the data processing system 10 according to the first embodiment.

[0023] As shown in Figure 1, the data processing system 10 includes a data processing device 12 and a smart device 14. An example of the data processing device 12 is a server.

[0024] The data processing device 12 comprises a computer 22, a database 24, and a communication interface 26. The computer 22 is an example of a "computer" related to the technology of this disclosure. The computer 22 comprises a processor 28, RAM 30, and storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication interface 26 are also connected to the bus 34. The communication interface 26 is connected to a network 54. An example of the network 54 is a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0025] The smart device 14 comprises a computer 36, a reception device 38, an output device 40, a camera 42, and a communication interface 44. The computer 36 comprises a processor 46, RAM 48, and storage 50. The processor 46, RAM 48, and storage 50 are connected to a bus 52. The reception device 38, output device 40, and camera 42 are also connected to the bus 52.

[0026] The reception device 38 is equipped with a touch panel 38A and a microphone 38B, etc., and receives user input. The touch panel 38A receives user input by detecting contact with an object (e.g., a pen or finger). The microphone 38B receives user input by detecting the user's voice. The control unit 46A transmits data indicating the user input received by the touch panel 38A and microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the data indicating the user input.

[0027] The output device 40 includes a display 40A and a speaker 40B, and presents data to the user 20 by outputting the data in a form perceptible to the user 20 (e.g., audio and / or text). The display 40A displays visible information such as text and images according to instructions from the processor 46. The speaker 40B outputs audio according to instructions from the processor 46. The camera 42 is a small digital camera equipped with an optical system such as a lens, aperture, and shutter, and an image sensor such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor.

[0028] Communication interface 44 is connected to network 54. Communication interfaces 44 and 26 are responsible for the exchange of various types of information between processor 46 and processor 28 via network 54.

[0029] Figure 2 shows an example of the main functions of the data processing device 12 and the smart device 14.

[0030] As shown in Figure 2, in the data processing device 12, a specific processing is performed by the processor 28. A specific processing program 56 is stored in the storage 32. The specific processing program 56 is an example of a "program" related to the technology of this disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 according to the specific processing program 56 executed on the RAM 30.

[0031] The storage 32 stores the data generation model 58 and the emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0032] In the smart device 14, the processor 46 performs the reception output processing. The storage 50 stores the reception output program 60. The reception output program 60 is used in conjunction with a specific processing program 56 by the data processing system 10. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output processing is realized by the processor 46 operating as a control unit 46A according to the reception output program 60 executed on the RAM 48.

[0033] Next, the specific processing performed by the specific processing unit 290 of the data processing device 12 will be described. In the following description, the data processing device 12 will be referred to as the "server" and the smart device 14 as the "terminal".

[0034] This invention provides a system for efficiently collecting, analyzing, and reporting vulnerability information of information systems. The main components of this system are means for inputting customer system information, means for generating software configuration information (SBOM), means for collecting vulnerability-related information using a web crawler, means for storing and analyzing the information in an AI learning database, means for evaluating the risks, and means for generating the evaluation results as a report and providing it to the user.

[0035] Enter customer system information and generate SBOM

[0036] User

[0037] The first step a user should take is to enter system information. After logging into the system using a web browser or dedicated application from a terminal, they should enter the names and version information of the installed software. For example, they should enter information such as "Apache 2.4.48" or "OpenSSL 1.1.1k".

[0038] server

[0039] The server generates Software Bill of Materials (SBOM) based on information provided by the user. This SBOM is stored in a structured data format (such as JSON or XML) and includes the names, versions, and dependencies of each software within the system.

[0040] Collection of vulnerability information

[0041] server

[0042] Next, the server periodically runs a web crawler to collect vulnerability-related information from the internet. Target sites include security information sites and vulnerability databases (e.g., JVN and NVD). The collected data is stored in a vulnerability information database. This database includes information such as CVE numbers, scope of impact, mitigation methods, and release dates.

[0043] Learning and analysis of vulnerability information

[0044] server

[0045] The collected vulnerability information is stored in an AI training database, and the server uses this data to train an AI learning model. The AI ​​model learns and analyzes the characteristics and patterns of vulnerabilities. Specifically, it analyzes the impact, similar past cases, and the characteristics of affected software, and updates the model accordingly.

[0046] Matching SBOM with vulnerability data and risk assessment

[0047] server

[0048] The server analyzes the generated SBOM and extracts version information for each software component. It then compares this information with vulnerability data learned by the AI ​​to detect any matching vulnerabilities. For any matching vulnerabilities, an evaluation is conducted based on the degree of risk and past incidents. For example, if "Apache 2.4.48" corresponds to "CVE-2021-41773," the degree of risk and the scope of impact are evaluated in detail.

[0049] Provision of evaluation results and alert notifications

[0050] server

[0051] The server generates a report based on the evaluation results and saves it in the specified format (such as PDF or HTML). If necessary, alert notifications are sent to the user. Email or a dedicated application are used as notification methods. For example, an alert might be sent stating, "A critical vulnerability (CVE-2021-41773) has been discovered."

[0052] User

[0053] Users can review reports generated through their devices to gain detailed information about system vulnerabilities. This allows them to take appropriate measures or report to higher management. For example, they can use the report content to create meeting materials and explain the current security risks to management.

[0054] Thus, the system of the present invention starts by inputting customer system information and generating software configuration information, and through a series of processes including vulnerability information collection, learning, analysis, risk assessment, and provision of assessment results, it is possible to efficiently and quickly manage vulnerability information and take appropriate countermeasures.

[0055] The following describes the processing flow.

[0056] Step 1:

[0057] User

[0058] Users log in to the system from their terminal using a web browser or a dedicated application.

[0059] Step 2:

[0060] User

[0061] The user enters the name and version information of the software installed on the system.

[0062] For example, enter information such as "Apache 2.4.48" or "OpenSSL 1.1.1k".

[0063] Step 3:

[0064] server

[0065] The server receives system information entered by the user and generates a Software Configuration Map (SBOM). The SBOM is stored in a structured data format such as JSON or XML and includes the name, version, and dependencies of each software.

[0066] Step 4:

[0067] server

[0068] The server periodically activates a web crawler to collect vulnerability-related information from security information sites and vulnerability databases (such as JVN and NVD).

[0069] Step 5:

[0070] server

[0071] The collected vulnerability information is stored in a vulnerability database on the server. This database includes information such as the CVE number, scope of impact, mitigation methods, and release date.

[0072] Step 6:

[0073] server

[0074] The server retrieves the latest data from the vulnerability information database and feeds it to the AI ​​learning model.

[0075] Step 7:

[0076] server

[0077] The AI ​​model learns from acquired vulnerability information and analyzes the characteristics and patterns of vulnerabilities. This analysis includes factors such as impact, similar past cases, and characteristics of affected software.

[0078] Step 8:

[0079] server

[0080] The server analyzes the generated SBOM and extracts version information for each software component.

[0081] Step 9:

[0082] server

[0083] The server compares the extracted version information with the learned vulnerability data to detect the corresponding vulnerabilities.

[0084] Step 10:

[0085] server

[0086] We assess the risks associated with the detected vulnerabilities and conduct a detailed evaluation based on the scope of impact and the degree of risk.

[0087] Step 11:

[0088] server

[0089] The server generates a report based on the evaluation results. This report is saved in formats such as PDF or HTML.

[0090] Step 12:

[0091] server

[0092] If necessary, alert notifications will be sent to the user. Notification methods include email and dedicated applications.

[0093] For example, an alert might be sent stating, "A critical vulnerability (CVE-2021-41773) has been discovered."

[0094] Step 13:

[0095] User

[0096] Users can review reports generated through their devices to gain detailed information about system vulnerabilities.

[0097] Step 14:

[0098] User

[0099] Users consider appropriate measures based on the report content and report to higher management. For example, they might create meeting materials or presentations based on the report.

[0100] (Example 1)

[0101] Next, we will describe Example 1. In the following description, the data processing device 12 will be referred to as the "server," and the smart device 14 will be referred to as the "terminal."

[0102] Modern information systems utilize numerous software components, each potentially containing vulnerabilities. However, manually collecting and analyzing this vulnerability information and taking appropriate countermeasures is extremely difficult. Furthermore, a lack of vulnerability risk assessment and prompt notification to users significantly compromises system security. Therefore, there is a need for a system that efficiently collects and analyzes vulnerability information and provides appropriate countermeasures.

[0103] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 1 is realized by the following means.

[0104] In this invention, the server includes means for inputting customer information, means for generating configuration information based on the input information, means for collecting vulnerability-related information using a web crawler, means for storing and analyzing the collected vulnerability information in a machine learning database, means for comparing the configuration information with vulnerability data and evaluating the risk, means for generating the evaluation results as a report and providing it to the user, means for the user to input detailed system information using a terminal, means for saving the evaluation results in a specific format, and means for sending alerts using email or a dedicated application as a notification means. This enables the rapid and efficient management of vulnerability information and the presentation of appropriate risk assessments and countermeasures.

[0105] "Customer" refers to the person who receives a service or product.

[0106] "Information" refers to a collection of data, knowledge, reports, or other forms of facts or insights.

[0107] "Configuration information" refers to data that details the names, versions, and dependencies of each software component within a system.

[0108] A "web crawler" refers to a software program that automatically visits websites on the internet and collects information.

[0109] "Vulnerability-related information" refers to information about vulnerabilities in software and system security, countermeasures against them, and the scope of their impact.

[0110] A "machine learning database" refers to a database used by AI and machine learning models to learn from collected data.

[0111] "Vulnerability data" refers to a dataset containing detailed information about each vulnerability that has been collected.

[0112] "Risk" refers to vulnerabilities or other dangerous elements that could potentially affect a system.

[0113] A "report" refers to a document that organizes specific information and provides it in a standardized format.

[0114] A "terminal" refers to a computer or other electronic device that a user uses to access a system.

[0115] "Format" refers to the rules or protocols that define the arrangement and structure of information and data.

[0116] An "alert" refers to a notification that immediately informs users of urgent or important information.

[0117] This invention provides a system for efficiently collecting, analyzing, and reporting vulnerability information of information systems. The main components of this system are means for inputting customer information, means for generating configuration information, means for collecting vulnerability-related information using a web crawler, means for storing and analyzing the information in a machine learning database, means for evaluating the risks, and means for generating the evaluation results as a report and providing it to the user.

[0118] Customers input information and generate configuration information.

[0119] User

[0120] The first step a user should take is to enter system information. After logging into the system using a dedicated application or web browser from a terminal, the user enters the names and version information of the installed software. For example, the user might enter "Apache 2.4.48" or "OpenSSL 1.1.1k" into the text box, then confirm the entered information and press the submit button.

[0121] server

[0122] The server receives information provided by the user and generates a Software Bill of Materials (SBOM) based on it. The SBOM is stored in JSON or XML format and contains the name, version, and dependencies of each software program. For example, the generated JSON file might include data such as:

[0123] json

[0124] {

[0125] "software_components": [

[0126] {

[0127] "name": "Apache",

[0128] "version": "2.4.48",

[0129] "dependencies": []

[0130] },

[0131] {

[0132] "name": "OpenSSL",

[0133] "version": "1.1.1k",

[0134] "dependencies": []

[0135] }

[0136] ]

[0137] }

[0138] Collection of vulnerability information

[0139] server

[0140] The server periodically launches a web crawler to collect vulnerability-related information from the internet. The crawler visits security information sites and vulnerability databases (e.g., JVN and NVD). The collected information is stored in the vulnerability information database, recording information such as the CVE number, scope of impact, mitigation methods, and release date for each vulnerability.

[0141] Learning and analysis of vulnerability information

[0142] server

[0143] The collected vulnerability information is stored in a machine learning database, and the server uses this data to train an AI learning model. Specifically, a neural network model is used to analyze the data and integrate the characteristics and patterns of vulnerabilities into the model. For example, the model is periodically updated by learning about impact, similar past cases, and the characteristics of affected software.

[0144] Matching configuration information with vulnerability data and risk assessment

[0145] server

[0146] The server analyzes the generated SBOM and extracts version information for each software component. Based on this information, the AI ​​model compares it with learned vulnerability data to identify the corresponding vulnerabilities. For example, it compares "Apache 2.4.48" with "CVE-2021-41773" and performs a risk assessment. Past cases and the scope of impact are also considered in the risk assessment.

[0147] Provision of evaluation results and alert notifications

[0148] server

[0149] The server generates a report of the risk assessment results and saves it in a specified format (such as PDF or HTML). If a critical vulnerability is found, an alert notification is sent to the user. The notification is sent via email or a dedicated application. For example, an alert stating "A critical vulnerability (CVE-2021-41773) has been discovered" might be sent.

[0150] User

[0151] Users can use their terminals to review reports provided by the server and understand detailed system vulnerability information. This allows them to take appropriate countermeasures quickly. For example, it is possible to create meeting materials based on the report content and explain the current security risks to management.

[0152] Example of a prompt

[0153] For example, possible prompts for a generative AI model include the following:

[0154] Please provide the latest vulnerability information regarding "Apache 2.4.48".

[0155] Thus, the system of the present invention can efficiently and quickly manage vulnerability information and provide users with information to take appropriate countermeasures.

[0156] The flow of the specific processing in Example 1 will be explained using Figure 11.

[0157] Step 1:

[0158] The user enters system information.

[0159] Users log in to the system from their terminal using a dedicated application or web browser. After logging in, they enter the names and version information of the installed software. For example, they might enter "Apache 2.4.48" or "OpenSSL 1.1.1k" and send that information to the server. This input is performed manually by the user.

[0160] Input: User-entered software name and version information

[0161] Output: Software information sent to the server

[0162] Step 2:

[0163] The server generates Software Configuration Information (SBOM).

[0164] The server receives software name and version information sent by the user and generates Software Bill of Materials (SBOM) based on this information. The SBOM is stored in a structured data format (such as JSON or XML) that details the name, version, and dependencies of each software. For example, it generates corresponding JSON data based on the information for "Apache 2.4.48".

[0165] Input: Software information submitted by the user

[0166] Output: Generated SBOM (JSON or XML file)

[0167] Step 3:

[0168] The server collects vulnerability information.

[0169] The server periodically activates a web crawler to collect vulnerability-related information from the internet. The crawler visits security information sites and vulnerability databases (e.g., JVN and NVD), extracts the latest vulnerability information, and stores it in the vulnerability information database. The collected information includes the CVE number, scope of impact, mitigation methods, and release date for each vulnerability.

[0170] Input: None (It is launched periodically)

[0171] Output: Latest vulnerability information stored in the vulnerability information database

[0172] Step 4:

[0173] The server learns and analyzes vulnerability information.

[0174] The server stores the collected vulnerability information in a machine learning database and uses this to train an AI learning model. The learning process uses a neural network model to analyze factors such as impact, past occurrences, and the characteristics of affected software. For example, the AI ​​model learns vulnerability occurrence patterns to improve prediction accuracy.

[0175] Input: Data stored in the vulnerability information database

[0176] Output: Trained AI learning model

[0177] Step 5:

[0178] The server performs matching of SBOM and vulnerability data and risk assessment.

[0179] The server analyzes the generated SBOM and extracts version information for each software component. Based on this information, the AI ​​model compares it with learned vulnerability data to detect relevant vulnerabilities. For example, it might compare "Apache 2.4.48" with "CVE-2021-41773" and perform a risk assessment. The risk assessment also takes into account the impact and similar past cases.

[0180] Input: Generated SBOM, trained AI learning model

[0181] Output: Risk assessment results

[0182] Step 6:

[0183] The server provides evaluation results and sends alert notifications.

[0184] The server generates a report based on the risk assessment results and saves it in a specified format (such as PDF or HTML). If a critical vulnerability is found as a result of the assessment, an alert notification is sent to the user. The notification is sent via email or a dedicated application. For example, an alert might be sent stating, "A critical vulnerability (CVE-2021-41773) has been discovered."

[0185] Input: Risk assessment results

[0186] Output: Generated reports, sent alert notifications

[0187] Step 7:

[0188] Users can view the evaluation results.

[0189] Users can use their terminals to review reports provided by the server and understand detailed system vulnerability information. This allows them to take appropriate countermeasures quickly. For example, they can use the report content to create meeting materials and explain the current security risks to management.

[0190] Input: Provided report

[0191] Output: Implementation of countermeasures, creation of meeting materials

[0192] Through this series of processing steps, it is possible to efficiently and quickly manage vulnerability information and provide users with information to take appropriate countermeasures.

[0193] (Application Example 1)

[0194] Next, we will explain Application Example 1. In the following explanation, the data processing device 12 will be referred to as the "server," and the smart device 14 will be referred to as the "terminal."

[0195] Modern information systems are complex, making it difficult to quickly and efficiently grasp information about software vulnerabilities. This can lead to delays in discovering vulnerabilities and implementing appropriate countermeasures. Furthermore, there is a lack of means to notify users of assessment results in real time and encourage prompt action.

[0196] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 1 is realized by the following means.

[0197] In this invention, the server includes means for inputting customer system information, means for generating software configuration information based on the input system information, means for collecting vulnerability-related information using a web crawler, means for storing and analyzing the collected vulnerability information in an AI learning database, means for comparing the software configuration information and vulnerability data to evaluate the risk, means for generating the evaluation results as a report and providing it to the user, and means for notifying the user of the evaluation results in real time. This makes it possible to quickly and efficiently collect, analyze, and notify the user of vulnerability information in real time.

[0198] "Customer system information" refers to configuration and setting information related to the information systems used by the user, including software names and version information.

[0199] "Software configuration information" refers to information that represents the name, version, and dependencies of each installed software in a structured data format.

[0200] A "web crawler" is a program that automatically collects information from the internet and is used to obtain data from vulnerability information sites and vulnerability databases.

[0201] "Vulnerability-related information" refers to information about security holes and flaws in systems and software, including CVE numbers, scope of impact, and countermeasures.

[0202] An "AI learning database" is a database that stores collected vulnerability information and is used for training and analyzing AI models.

[0203] "Assessing risk" is the process of analyzing the degree of risk and scope of impact that a particular vulnerability poses to a user's system, based on vulnerability information matched with software configuration information.

[0204] "Generating and providing a report to the user" means creating the evaluation results in a document format (e.g., PDF or HTML) and providing it to the user.

[0205] "Notifying users in real time" refers to a means of immediately communicating information to users when a vulnerability is discovered, and includes notifications made via email or dedicated applications, for example.

[0206] This invention is a vulnerability management system specifically designed for security services. This system takes customer system information as input, analyzes the collected vulnerability-related information using AI, and provides it to the user in real time.

[0207] First, the user installs a dedicated application and logs into the system from their device. Next, the user enters their system information. For example, they enter the software name and version information, such as "Apache 2.4.48" or "OpenSSL 1.1.1k".

[0208] The entered information is sent to the server and generated as Software Bill of Materials (SBOM). The SBOM is stored as structured data such as JSON or XML. The SBOM contains detailed information such as the name, version, and dependencies of each software.

[0209] Next, the server periodically runs a web crawler to collect vulnerability-related information from the internet. The target sites are security information sites and vulnerability databases. The collected data is stored in the vulnerability information database and includes CVE numbers, scope of impact, mitigation methods, and release dates.

[0210] The collected vulnerability information is stored in an AI training database. The server uses this data to train an AI learning model, analyzing the characteristics and patterns of vulnerabilities. The AI ​​model analyzes the impact, similar past cases, and the characteristics of the affected software, and updates the model accordingly.

[0211] The server analyzes the generated SBOM and extracts version information for each software component. It then compares this information with vulnerability data learned by the AI ​​to detect matching vulnerabilities. For matched vulnerabilities, an evaluation is conducted based on risk level and past incidents. For example, if "Apache 2.4.48" corresponds to "CVE-2021-41773," the risk level and scope of impact are evaluated in detail.

[0212] The evaluation results are generated as a report and saved in formats such as PDF and HTML. Users are also notified in real time. Email and dedicated applications are used as notification methods. For example, an alert stating "A critical vulnerability (CVE-2021-41773) has been discovered" might be sent.

[0213] Users can review reports generated through their devices to gain detailed information about system vulnerabilities. This allows them to take appropriate measures and report issues to higher management. Specifically, they can create meeting materials based on the report content and explain the current security risks to management.

[0214] Hardware and software to be used

[0215] Hardware: Smartphones, smart glasses, head-mounted displays, robots

[0216] Software: Python 3.x, requests (web crawler), JSON (data processing), smtplib (email sending)

[0217] Specific example

[0218] As a concrete example, a user launches an application and enters "Apache 2.4.48" and "OpenSSL 1.1.1k". The application generates an SBOM from this information. A web crawler collects vulnerability data from sites such as "https: / / examplevulnerabilities.com / data1". The SBOM is compared with the collected vulnerability data to detect relevant vulnerabilities and perform a risk assessment. A risk report is sent to the user via email to notify them that a critical vulnerability has been found.

[0219] Example of a prompt:

[0220] "My system has Apache 2.4.48 and OpenSSL 1.1.1k installed. Please check for vulnerabilities in these versions and generate a risk report."

[0221] This makes it possible to quickly and efficiently collect and analyze vulnerability information and notify users in real time.

[0222] The flow of a specific process in Application Example 1 will be explained using Figure 12.

[0223] Step 1:

[0224] Users install a dedicated application and log in to the system from their device. They access the system login screen on their device and enter their authentication information to authenticate access to the system. This generates a user ID and a token for accessing the system information input screen.

[0225] Input: User authentication information

[0226] Output: User ID, Access Token

[0227] Step 2:

[0228] The user enters system information through a dedicated application. They enter the software name and version information and send it to the server. This information may include details such as "Apache 2.4.48" or "OpenSSL 1.1.1k". This information is sent to the server in JSON format.

[0229] Input: Software name, version information

[0230] Output: System information in JSON format

[0231] Step 3:

[0232] The server generates Software Base of Management (SBOM) information based on the received system information. The server parses the received JSON data and extracts the name and version information of each software. This is then saved as an SBOM in a structured data format (JSON or XML).

[0233] Input: System information in JSON format

[0234] Output: SBOM (Structured Data)

[0235] Step 4:

[0236] The server periodically activates a web crawler to collect vulnerability-related information. Target sites include security information sites and vulnerability databases (e.g., "https: / / examplevulnerabilities.com / data1"). The crawler visits each site and retrieves vulnerability information.

[0237] Input: URL of the security information site

[0238] Output: List of vulnerability information

[0239] Step 5:

[0240] The collected vulnerability information is stored in an AI training database. The server analyzes the vulnerability information list and saves it as training data for the AI ​​model. This ensures that the AI ​​model is trained based on the latest vulnerability information.

[0241] Input: List of vulnerability information

[0242] Output: AI learning database

[0243] Step 6:

[0244] The server compares the collected vulnerability information with the SBOM and performs a risk assessment. It matches the version information of each software component in the SBOM with the vulnerability information. If a relevant vulnerability is found, it evaluates the degree of risk and the scope of impact.

[0245] Input: SBOM, vulnerability information

[0246] Output: Risk assessment results

[0247] Step 7:

[0248] The evaluation results are generated as a report and provided to the user. The server creates the report based on the risk assessment results and saves it in formats such as PDF or HTML. The report is sent to the user via email.

[0249] Input: Risk assessment results

[0250] Output: Reports (PDF or HTML), email notifications

[0251] Step 8:

[0252] If a critical vulnerability is detected, users will be notified in real time. Based on the risk assessment results, the server generates alert notifications according to the severity of the vulnerability. Email and push notifications via a dedicated application are used as notification methods.

[0253] Input: Risk assessment results

[0254] Output: Alert notifications (email, push notifications)

[0255] This allows users to receive vulnerability information in real time and respond quickly. As a concrete example, if a user enters "Apache 2.4.48" and "OpenSSL 1.1.1k", the system will collect and analyze vulnerability information related to them, perform a risk assessment, and immediately notify the user.

[0256] Furthermore, an emotion engine that estimates the user's emotions may be incorporated. That is, the identification processing unit 290 may use the emotion identification model 59 to estimate the user's emotions and perform identification processing using the user's emotions.

[0257] This invention aims to further improve a system that collects customer system information and efficiently manages, analyzes, and reports vulnerability information by combining it with an emotion engine that recognizes user emotions. The main components of this system include means for inputting customer system information, means for generating software configuration information (SBOM), means for collecting vulnerability-related information using a web crawler, means for storing and analyzing the collected information in an AI learning database, means for performing risk assessment, means for generating and providing the assessment results as a report to the user, and an emotion engine that recognizes user emotions.

[0258] Enter customer system information and generate SBOM

[0259] User

[0260] The user logs into the system from their terminal using a web browser or a dedicated application. Next, they enter the name and version information of the software installed on the system. For example, they might enter information such as "Apache 2.4.48" or "OpenSSL 1.1.1k".

[0261] server

[0262] The server generates a Software Configuration Map (SBOM) based on system information provided by the user. This SBOM is stored in a structured data format such as JSON or XML and includes the names, versions, and dependencies of each software within the system.

[0263] Collection of vulnerability information

[0264] server

[0265] The server periodically runs a web crawler to collect vulnerability-related information from security information sites and vulnerability databases (such as JVN and NVD) on the internet. The collected information is stored in the server's vulnerability information database. This database includes information such as CVE numbers, scope of impact, mitigation methods, and release dates.

[0266] Learning and analysis of vulnerability information

[0267] server

[0268] The server retrieves the latest data from the vulnerability information database and feeds it to an AI learning model. The AI ​​model learns from the retrieved vulnerability information and analyzes the characteristics and patterns of vulnerabilities. The analysis includes factors such as impact, similar past cases, and characteristics of affected software.

[0269] Matching SBOM with vulnerability data and risk assessment

[0270] server

[0271] The server analyzes the generated SBOM and extracts version information for each software component. The server then compares the extracted version information with learned vulnerability data to detect the corresponding vulnerabilities. It assesses the risk of the detected vulnerabilities and performs a detailed evaluation based on the scope of impact and the degree of risk. For example, if "Apache 2.4.48" corresponds to "CVE-2021-41773", the server will perform a detailed evaluation of its risk level and scope of impact.

[0272] Emotion recognition and report generation / delivery

[0273] server

[0274] The server is equipped with an emotion engine that recognizes user emotions. This emotion engine determines user emotions in real time through facial recognition and voice analysis. The results of this emotion recognition are reflected in how reports are displayed, the timing of alert notifications, and their content.

[0275] For example, if a user is experiencing stress, the report display will be simplified and focused on the most urgent information. Additionally, if it's determined that the user is not in a state to calmly receive information, the alert notification will be softened and resent later.

[0276] Provision of evaluation results and alert notifications

[0277] server

[0278] The server generates a report based on the evaluation results and saves it in the specified format (such as PDF or HTML). If necessary, an alert notification is sent to the user. Based on the emotion engine, alerts are sent at a timing and in a manner appropriate to the user's emotional state. For example, an immediate notification is sent in an emergency, but the notification is delayed if the user is feeling stressed.

[0279] User

[0280] Users review reports generated through their devices to gain detailed information about system vulnerabilities. Based on the report, users consider appropriate countermeasures and report to higher management. For example, they might use the report to create meeting materials or presentations to explain the current security risks to management.

[0281] Thus, the system of the present invention can manage and provide vulnerability information more appropriately and effectively by recognizing and considering the user's emotions.

[0282] The following describes the processing flow.

[0283] Step 1:

[0284] User

[0285] The user logs in to the system using a web browser or a dedicated application from the terminal.

[0286] ] Step 2:

[0287] User

[0288] After logging in, the user enters the name and version information of the software installed in the system.

[0289] For example, enter information such as "Apache 2.4.48" or "OpenSSL 1.1.1k".

[0290] Step 3:

[0291] Server

[0292] The server receives the system information entered by the user and generates software composition information (SBOM: Software Bill of Materials). The SBOM is stored in a structured data format such as JSON or XML.

[0293] Step 4:

[0294] Server

[0295] The server periodically launches a web crawler to collect vulnerability-related information. The target sites are security information sites and vulnerability databases (e.g., JVN and NVD).

[0296] Step 5:

[0297] Server

[0298] The collected vulnerability information is stored in the vulnerability information database within the server. The database contains information such as CVE numbers, scope of impact, countermeasure methods, release dates, etc.

[0299] Step 6:

[0300] Server

[0301] The server retrieves the latest data from the vulnerability information database and feeds it into the AI learning model.

[0302] Step 7:

[0303] Server

[0304] The AI model conducts learning based on the acquired vulnerability information and analyzes the characteristics and patterns of vulnerabilities. Specifically, it analyzes the degree of impact, similar past cases, characteristics of the software affected, etc.

[0305] Step 8:

[0306] Server

[0307] The server analyzes the generated SBOM and extracts the version information of each software component.

[0308] Step 9:

[0309] Server

[0310] The server matches the extracted version information with the learned vulnerability data to detect corresponding vulnerabilities.

[0311] Step 10:

[0312] Server

[0313] The detected vulnerabilities are assessed for their risk, and a detailed evaluation is conducted based on the scope of impact and the degree of risk. For example, if "Apache 2.4.48" corresponds to "CVE-2021-41773", the degree of risk and the scope of impact are evaluated in detail.

[0314] Step 11:

[0315] server

[0316] The server activates an emotion engine that recognizes the user's emotions and determines the user's emotional state in real time. The emotion engine analyzes emotions through the user's facial recognition and voice analysis.

[0317] Step 12:

[0318] server

[0319] Based on the emotion engine, the report generation process takes the user's emotional state into account when generating reports based on evaluation results. For example, if the user is stressed, the report display will be simplified and focus on more urgent information.

[0320] Step 13:

[0321] server

[0322] The server saves the generated report in a specified format (such as PDF or HTML) and sends alert notifications at a time appropriate to the user's emotional state based on the emotion engine. For example, it can send an immediate notification in an emergency, or postpone notifications if the user is feeling stressed.

[0323] Step 14:

[0324] User

[0325] Users can review reports generated through their devices to gain detailed information about system vulnerabilities.

[0326] Step 15:

[0327] User

[0328] Users consider appropriate countermeasures based on the report and report to higher management. For example, they might create meeting materials or presentations based on the report to explain the current security risks to management.

[0329] (Example 2)

[0330] Next, we will describe Example 2. In the following description, the data processing device 12 will be referred to as the "server" and the smart device 14 as the "terminal".

[0331] In conventional systems, vulnerability management based on customer system information was insufficient, making it difficult to collect vulnerability information, assess risks, and propose appropriate countermeasures. Furthermore, responses did not take into account the user's feelings, making it challenging to provide appropriate information when users were experiencing stress or anxiety.

[0332] The identification processing performed by the identification processing unit 290 of the data processing device 12 in Example 2 is realized by the following means. In this invention, the server includes means for inputting customer system information, means for generating software configuration information based on the input system information, means for collecting vulnerability-related information using a web crawler, means for storing and analyzing the collected vulnerability information in a learning database, means for comparing the software configuration information and vulnerability data and evaluating the risk, means for recognizing the user's emotions, and means for generating the evaluation results as a report and providing it while taking the user's emotions into consideration. This enables efficient management of vulnerability information, risk assessment, and appropriate information provision while taking the user's emotions into consideration.

[0333] "Customer system information" refers to the software and hardware configuration information related to the systems used by the customer.

[0334] "Software configuration information" refers to detailed information including the names, versions, and dependencies of the software installed on the customer's system.

[0335] A "web crawler" refers to a program that automatically visits websites on the internet to collect information.

[0336] "Vulnerability-related information" refers to information about security flaws and vulnerabilities present in software and systems.

[0337] A "training database" refers to a database where AI learning models store vulnerability information for analysis and learning purposes.

[0338] "Risk assessment" refers to the process of evaluating the impact and risks that a particular vulnerability may have on a system.

[0339] "Means of recognizing emotions" refers to technologies that analyze a user's facial expressions and voice in real time to determine their emotional state.

[0340] "Means of providing information as a report" refers to functions that provide users with easily understandable information such as risk assessment results and vulnerability information.

[0341] This invention relates to a system that efficiently manages customer system information, collects, analyzes, and assesses vulnerability information, and provides information while considering user sentiment. This system is implemented using multiple hardware and software components to achieve both user convenience and information accuracy.

[0342] First, the user accesses the system from their terminal using a web browser or a dedicated application. They enter their user ID and password on the login screen, and upon successful authentication, they are redirected to the dashboard. On the dashboard, they enter the name and version information of the installed software (e.g., "Apache 2.4.48") into a dedicated form and click the "Submit" button. This information is then sent to the server.

[0343] The server receives software information sent by the user and generates Software Base of Memory (SBOM) based on it. Specifically, it converts the received software name and version information into JSON format and saves it, including dependency information. For example, the information is saved in a JSON format like the following:

[0344] json

[0345] {

[0346] "components": [

[0347] {

[0348] "name": "Apache",

[0349] "version": "2.4.48",

[0350] "dependencies": ["mod_ssl"]

[0351] },

[0352] {

[0353] "name": "OpenSSL",

[0354] "version": "1.1.1k",

[0355] "dependencies": []

[0356] }

[0357] ]

[0358] }

[0359] Next, the server periodically starts a web crawler based on a pre-configured schedule. The web crawler collects the latest vulnerability information from security information sites and vulnerability databases on the internet (e.g., JVN and NVD). The collected information is stored in the vulnerability information database and includes information such as the CVE number, scope of impact, mitigation methods, and release date. For example, new CVE information is stored as follows:

[0360] json

[0361] {

[0362] "CVE-2021-41773": {

[0363] "impact": "High",

[0364] "description": "Path traversal vulnerability in Apache 2.4.48.",

[0365] "fix": "Upgrade to Apache 2.4.49 or later."

[0366] }

[0367] }

[0368] Subsequently, the server retrieves the latest data from the vulnerability information database and feeds it into a pre-built generative AI model. The generative AI model learns the characteristics and patterns of vulnerabilities using past vulnerability data and newly acquired data. As a result of the learning, the impact and similar past cases are analyzed. For example, it is clearly indicated which past cases "CVE-2021-41773" is similar to and what the degree of impact is.

[0369] The server analyzes the generated SBOM and extracts version information for each software component. It then compares the extracted version information with the analyzed vulnerability data to detect any vulnerabilities. For example, if "Apache 2.4.48" corresponds to "CVE-2021-41773," the server performs a detailed assessment of its impact and risk level. This assessment result is saved as detailed risk analysis data.

[0370] Furthermore, the server is equipped with an emotion engine that recognizes the user's emotions. The emotion engine determines the user's emotional state in real time through facial expression recognition and voice analysis as the user interacts with the system. For example, if the camera identifies the user's face and determines that they are experiencing stress, the content and display method of the report will be adjusted accordingly.

[0371] The server generates a report based on the risk assessment results and saves it in the specified format (such as PDF or HTML). If necessary, it sends alert notifications at a time appropriate to the user's emotional state. For example, if the user is feeling stressed, the notification will be delayed and alerts will be sent at an appropriate time.

[0372] Users review reports generated through their devices to gain detailed information about system vulnerabilities. Based on the report, they consider appropriate countermeasures and report to higher management. For example, they might create meeting materials or presentations to explain the current security risks to management.

[0373] In this way, this system achieves more effective security measures by managing and providing vulnerability information while taking user emotions into consideration.

[0374] The flow of the specific processing in Example 2 will be explained using Figure 13.

[0375] Step 1: Log in to the system and enter system information.

[0376] The user accesses the system by launching a web browser or dedicated application using their terminal. They enter their user ID and password on the login screen (input). Upon successful authentication, they are redirected to the dashboard. On the dashboard, the user enters the name and version information of the installed software into a dedicated form and clicks the "Submit" button (input). This information is sent to the server (output).

[0377] Step 2: Generate Software Configuration Information (SBOM)

[0378] The server receives software information sent by the user (input). Based on the received software information, it generates software configuration information (SBOM) (data processing). Specifically, it converts the input software name and version information into JSON format and saves it, including dependencies (output). As an example, the following JSON structure is generated.

[0379] json

[0380] {

[0381] "components": [

[0382] {

[0383] "name": "Apache",

[0384] "version": "2.4.48",

[0385] "dependencies": ["mod_ssl"]

[0386] },

[0387] {

[0388] "name": "OpenSSL",

[0389] "version": "1.1.1k",

[0390] "dependencies": []

[0391] }

[0392] ]

[0393] }

[0394] Step 3: Gather vulnerability information

[0395] The server periodically starts the web crawler based on a pre-configured schedule (startup). The web crawler collects the latest vulnerability information from security information sites and vulnerability databases on the internet (e.g., JVN and NVD) (input). The collected information is stored in the vulnerability information database on the server (output).

[0396] Step 4: Learning and analyzing vulnerability information

[0397] The server retrieves the latest data from a vulnerability information database (input). It feeds the retrieved data into a pre-built generative AI model, which learns the characteristics and patterns of vulnerabilities (data computation). Specifically, it analyzes factors such as impact and similar past cases, and generates new vulnerability information as a result of the analysis (output).

[0398] Step 5: Matching SBOM with vulnerability data and risk assessment

[0399] The server analyzes the generated SBOM and extracts version information for each software component (input). It then compares the extracted version information with the analyzed vulnerability data (data calculation). For example, if "Apache 2.4.48" corresponds to "CVE-2021-41773", the degree of risk and the scope of impact are evaluated (output).

[0400] Step 6: Emotion recognition and report generation / delivery

[0401] The server is equipped with an emotion engine that recognizes the user's emotions. The emotion engine analyzes the user's facial expressions and voice in real time as they operate the system and recognizes their emotional state (input). Based on this information, a report including risk assessment results is generated, but the content and display method of the report are adjusted according to the user's emotional state (data processing and output).

[0402] Step 7: Provision of evaluation results and alert notifications

[0403] The server generates a report based on the risk assessment results and saves it in a format (such as PDF or HTML) (output). It also adjusts the timing of alert notifications according to the user's emotional state. For example, if the user is stressed, less urgent notifications are delayed (data processing and output). The user reviews the generated report through their terminal to understand detailed information about system vulnerabilities. Based on the report content, they consider appropriate countermeasures and report to higher levels (output).

[0404] (Application Example 2)

[0405] Next, we will explain application example 2. In the following explanation, the data processing device 12 will be referred to as a "server" and the smart device 14 as a "terminal".

[0406] Traditional vulnerability management systems often caused stress and burden on users because, when collecting customer system information, analyzing vulnerability data, and providing reports, they did not consider the user's emotional state when displaying notifications or reports. Furthermore, even in situations requiring urgent security measures, notifications were not provided at an appropriate time based on the user's situation, potentially delaying countermeasures. There is a need to address these issues and provide a more user-friendly vulnerability management system.

[0407] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means.

[0408] In this invention, the server includes means for inputting customer computer system information, means for generating software configuration information based on the input computer system information, means for collecting vulnerability-related information using a web crawler, means for storing and analyzing the collected vulnerability information in an AI learning database, means for comparing the software configuration information with the vulnerability data and evaluating the risk, means for generating the evaluation results as a report and providing it to the terminal user, and an emotion engine that recognizes the terminal user's emotions and adjusts the method of displaying reports and providing alert notifications. This enables flexible report display and alert notifications according to the terminal user's emotional state.

[0409] "Customer computer system information" refers to software and hardware information related to the computer system used by the customer.

[0410] "Software configuration information" refers to information that includes the names, versions, and dependencies of software installed on a computer system.

[0411] A "web crawler" is software that automatically collects information from the internet.

[0412] "Vulnerability-related information" refers to information about security flaws and risks present in software and systems.

[0413] An "AI training database" is a database that stores data used to train artificial intelligence models.

[0414] An "emotion engine" is a technology that determines a user's emotional state in real time through facial recognition and voice analysis.

[0415] "Risk assessment" is the process of evaluating the impact and risks to a computer system based on collected vulnerability information.

[0416] A "report" is a collection of documents and information that summarizes the results of a risk assessment and provides them to terminal users.

[0417] An "alert notification" is a notification that alerts or warns the device user when certain conditions are met.

[0418] A "terminal user" refers to an individual or organizational representative who uses this system.

[0419] As an example of this invention's application, consider a vulnerability management application called "Secure Guardian." This application collects customer computer system information, analyzes vulnerability information, and provides a risk assessment report. It is installed and used on smartphones.

[0420] Hardware and software usage

[0421] The server uses a high-performance cloud server (for example, AWS EC2), and the user's terminal is a smartphone (iPhone or Android device).

[0422] On the server side, the following software and technologies are used:

[0423] 1. Web crawler: Use BeautifulSoup or Scrapy to collect vulnerability information.

[0424] 2. AI Learning Model: Analyze vulnerability data using TensorFlow or PyTorch.

[0425] 3. Emotion Engine: OpenCV or DeepFace is used for face recognition, and Google Cloud Speech-to-Text is used for speech recognition.

[0426] Application features and operation

[0427] 1. Input of computer system information and generation of SBOM

[0428] Terminal users enter the name and version information of the software they are using through a smartphone application. Based on this information, the server automatically generates Software Base of Memory (SBOM) in JSON or XML format.

[0429] 2. Collection of vulnerability information

[0430] The server periodically runs a web crawler to collect the latest vulnerability-related information from internet vulnerability databases (such as JVN and NVD). The collected information is stored in the vulnerability information database.

[0431] 3. Learning and analyzing vulnerability information

[0432] The server-side AI learning model obtains the latest data from a vulnerability information database and performs training. This allows it to analyze the characteristics and impact of vulnerabilities and generate prediction results.

[0433] 4. Matching SBOM with vulnerability data and risk assessment

[0434] The server analyzes the generated SBOM and compares the version information of each software component with vulnerability data. This allows it to detect relevant vulnerabilities and perform a risk assessment.

[0435] 5. Emotion recognition and reporting

[0436] The system uses the smartphone's camera and microphone to recognize the user's emotions in real time. OpenCV and DeepFace are used for facial recognition, and Google Cloud Speech-to-Text is used for speech analysis. The display of reports and the timing of alert notifications are adjusted according to the user's emotional state.

[0437] 6. Provision of evaluation results and alert notifications

[0438] Based on the risk assessment results, the server generates a report and provides it to the terminal user in PDF or HTML format. Using an emotion engine, alert notifications are sent at the appropriate time according to the user's emotional state.

[0439] Examples of specific cases and prompt statements

[0440] As a concrete example, a company's security officer installs "Secure Guardian" and uses the application to input a list of software used within the company. Then, based on the SBOM generated by the server, the system collects the latest vulnerability information and automatically performs a risk assessment. Furthermore, if an officer is experiencing high stress levels, the system is configured to notify them later, allowing them to view a detailed report once they have calmed down.

[0441] Example of a prompt:

[0442] "Use SecureGuardian to input system vulnerability information for Apache 2.4.48 and OpenSSL 1.1.1k. Collect the latest vulnerability information and generate a risk assessment report. Utilize sentiment recognition to delay notifications if stress levels are high, allowing users to calmly review the detailed report."

[0443] The flow of a specific process in Application Example 2 will be explained using Figure 14.

[0444] Step 1:

[0445] Users log in using a smartphone application. They enter the name and version information of the software they are using. This data is sent to the server and becomes the source data for generating Software Configuration Information (SBOM).

[0446] Step 2:

[0447] The server generates Software Base of Memory (SBOM) in JSON or XML format based on the received software information. Data processing involves organizing software names and version information, and constructing dependencies between software components. This SBOM is then used to verify vulnerability information later on.

[0448] Step 3:

[0449] The server periodically activates a web crawler to collect the latest vulnerability information from internet vulnerability databases (e.g., JVN and NVD). The collected vulnerability information is stored in an internal database. Data processing involves parsing and saving the collected information.

[0450] Step 4:

[0451] The server retrieves the latest vulnerability information from a vulnerability database and feeds it to an AI learning model. The generated AI learning model is used to analyze the characteristics and impact of vulnerabilities. It receives vulnerability data as input and generates vulnerability risk assessment information as output.

[0452] Step 5:

[0453] The server compares the generated SBOM with vulnerability data to detect matching vulnerabilities. It then performs a risk assessment of the matched vulnerabilities and outputs information on their impact and mitigation methods. Data processing includes version information matching and risk level calculation.

[0454] Step 6:

[0455] The server analyzes user emotion information obtained from smartphones. It uses the device's camera and microphone for facial recognition and voice analysis to recognize emotions in real time. The results of emotion recognition are reflected in subsequent reports and alert notifications.

[0456] Step 7:

[0457] The server generates a report based on the risk assessment results and provides it to the user in PDF or HTML format. The report's display method is adjusted based on the emotion engine's results. For example, if the user is stressed, the report is displayed concisely; if they are calm, detailed information is provided.

[0458] Step 8:

[0459] The server will send alert notifications at the appropriate time based on the user's emotional state. In urgent cases, notifications will be sent immediately, while notifications will be delayed if the user is experiencing stress. For example, even if an urgent vulnerability is discovered, if the user is stressed, the notification will be sent only after they have calmed down.

[0460] The specific processing unit 290 transmits the result of the specific processing to the smart device 14. In the smart device 14, the control unit 46A causes the output device 40 to output the result of the specific processing. The microphone 38B acquires audio indicating user input for the result of the specific processing. The control unit 46A transmits the audio data indicating user input acquired by the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0461] Data generation model 58 is a type of so-called generative AI (Artificial Intelligence). One example of data generation model 58 is ChatGPT (Internet search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search) <url: https: gemini.google.com ?hl="ja">Examples of generative AI include the following. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 is input with prompts containing instructions, and with inference data such as audio data representing speech, text data representing text, and image data representing images. The data generation model 58 infers from the input inference data according to the instructions indicated by the prompts, and outputs the inference results in data formats such as audio data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0462] In the above embodiment, an example was given in which specific processing is performed by the data processing device 12, but the technology of this disclosure is not limited thereto, and the specific processing may also be performed by the smart device 14.

[0463] [Second Embodiment]

[0464] Figure 3 shows an example of the configuration of the data processing system 210 according to the second embodiment.

[0465] As shown in Figure 3, the data processing system 210 includes a data processing device 12 and smart glasses 214. An example of the data processing device 12 is a server.

[0466] The data processing device 12 comprises a computer 22, a database 24, and a communication interface 26. The computer 22 is an example of a "computer" related to the technology of this disclosure. The computer 22 comprises a processor 28, RAM 30, and storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication interface 26 are also connected to the bus 34. The communication interface 26 is connected to a network 54. An example of the network 54 is a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0467] The smart glasses 214 include a computer 36, a microphone 238, a speaker 240, a camera 42, and a communication interface 44. The computer 36 includes a processor 46, RAM 48, and storage 50. The processor 46, RAM 48, and storage 50 are connected to a bus 52. The microphone 238, speaker 240, and camera 42 are also connected to the bus 52.

[0468] The microphone 238 receives voice signals from the user 20 and receives instructions from the user 20. The microphone 238 captures the voice signals from the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to the instructions from the processor 46.

[0469] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an image sensor such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the area around the user 20 (for example, an imaging range defined by a field of view equivalent to the width of a typical healthy person's field of vision).

[0470] Communication interface 44 is connected to network 54. Communication interfaces 44 and 26 are responsible for the exchange of various information between processor 46 and processor 28 via network 54. The exchange of various information between processor 46 and processor 28 using communication interfaces 44 and 26 is performed in a secure manner.

[0471] Figure 4 shows an example of the main functions of the data processing device 12 and the smart glasses 214. As shown in Figure 4, the data processing device 12 performs specific processing using the processor 28. The storage 32 stores the specific processing program 56.

[0472] The specific processing program 56 is an example of a "program" relating to the technology of this disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0473] The storage 32 stores the data generation model 58 and the emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0474] In the smart glasses 214, the processor 46 performs the reception output processing. The storage 50 stores the reception output program 60. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output processing is realized by the processor 46 operating as a control unit 46A according to the reception output program 60 executed on the RAM 48.

[0475] Next, the identification processing performed by the identification processing unit 290 of the data processing device 12 will be described. In the following description, the data processing device 12 will be referred to as the "server" and the smart glasses 214 will be referred to as the "terminal".

[0476] This invention provides a system for efficiently collecting, analyzing, and reporting vulnerability information of information systems. The main components of this system are means for inputting customer system information, means for generating software configuration information (SBOM), means for collecting vulnerability-related information using a web crawler, means for storing and analyzing the information in an AI learning database, means for evaluating the risks, and means for generating the evaluation results as a report and providing it to the user.

[0477] Enter customer system information and generate SBOM

[0478] User

[0479] The first step a user should take is to enter system information. After logging into the system using a web browser or dedicated application from a terminal, they should enter the names and version information of the installed software. For example, they should enter information such as "Apache 2.4.48" or "OpenSSL 1.1.1k".

[0480] server

[0481] The server generates Software Bill of Materials (SBOM) based on information provided by the user. This SBOM is stored in a structured data format (such as JSON or XML) and includes the names, versions, and dependencies of each software within the system.

[0482] Collection of vulnerability information

[0483] server

[0484] Next, the server periodically runs a web crawler to collect vulnerability-related information from the internet. Target sites include security information sites and vulnerability databases (e.g., JVN and NVD). The collected data is stored in a vulnerability information database. This database includes information such as CVE numbers, scope of impact, mitigation methods, and release dates.

[0485] Learning and analysis of vulnerability information

[0486] server

[0487] The collected vulnerability information is stored in an AI training database, and the server uses this data to train an AI learning model. The AI ​​model learns and analyzes the characteristics and patterns of vulnerabilities. Specifically, it analyzes the impact, similar past cases, and the characteristics of affected software, and updates the model accordingly.

[0488] Matching SBOM with vulnerability data and risk assessment

[0489] server

[0490] The server analyzes the generated SBOM and extracts version information for each software component. It then compares this information with vulnerability data learned by the AI ​​to detect any matching vulnerabilities. For any matching vulnerabilities, an evaluation is conducted based on the degree of risk and past incidents. For example, if "Apache 2.4.48" corresponds to "CVE-2021-41773," the degree of risk and the scope of impact are evaluated in detail.

[0491] Provision of evaluation results and alert notifications

[0492] server

[0493] The server generates a report based on the evaluation results and saves it in the specified format (such as PDF or HTML). If necessary, alert notifications are sent to the user. Email or a dedicated application are used as notification methods. For example, an alert might be sent stating, "A critical vulnerability (CVE-2021-41773) has been discovered."

[0494] User

[0495] Users can review reports generated through their devices to gain detailed information about system vulnerabilities. This allows them to take appropriate measures or report to higher management. For example, they can use the report content to create meeting materials and explain the current security risks to management.

[0496] Thus, the system of the present invention starts by inputting customer system information and generating software configuration information, and through a series of processes including vulnerability information collection, learning, analysis, risk assessment, and provision of assessment results, it is possible to efficiently and quickly manage vulnerability information and take appropriate countermeasures.

[0497] The following describes the processing flow.

[0498] Step 1:

[0499] User

[0500] Users log in to the system from their terminal using a web browser or a dedicated application.

[0501] Step 2:

[0502] User

[0503] The user enters the name and version information of the software installed on the system.

[0504] For example, enter information such as "Apache 2.4.48" or "OpenSSL 1.1.1k".

[0505] Step 3:

[0506] server

[0507] The server receives system information entered by the user and generates a Software Configuration Map (SBOM). The SBOM is stored in a structured data format such as JSON or XML and includes the name, version, and dependencies of each software.

[0508] Step 4:

[0509] server

[0510] The server periodically activates a web crawler to collect vulnerability-related information from security information sites and vulnerability databases (such as JVN and NVD).

[0511] Step 5:

[0512] server

[0513] The collected vulnerability information is stored in a vulnerability database on the server. This database includes information such as the CVE number, scope of impact, mitigation methods, and release date.

[0514] Step 6:

[0515] server

[0516] The server retrieves the latest data from the vulnerability information database and feeds it to the AI ​​learning model.

[0517] Step 7:

[0518] server

[0519] The AI ​​model learns from acquired vulnerability information and analyzes the characteristics and patterns of vulnerabilities. This analysis includes factors such as impact, similar past cases, and characteristics of affected software.

[0520] Step 8:

[0521] server

[0522] The server analyzes the generated SBOM and extracts version information for each software component.

[0523] Step 9:

[0524] server

[0525] The server compares the extracted version information with the learned vulnerability data to detect the corresponding vulnerabilities.

[0526] Step 10:

[0527] server

[0528] We assess the risks associated with the detected vulnerabilities and conduct a detailed evaluation based on the scope of impact and the degree of risk.

[0529] Step 11:

[0530] server

[0531] The server generates a report based on the evaluation results. This report is saved in formats such as PDF or HTML.

[0532] Step 12:

[0533] server

[0534] If necessary, alert notifications will be sent to the user. Notification methods include email and dedicated applications.

[0535] For example, an alert might be sent stating, "A critical vulnerability (CVE-2021-41773) has been discovered."

[0536] Step 13:

[0537] User

[0538] Users can review reports generated through their devices to gain detailed information about system vulnerabilities.

[0539] Step 14:

[0540] User

[0541] Users consider appropriate measures based on the report content and report to higher management. For example, they might create meeting materials or presentations based on the report.

[0542] (Example 1)

[0543] Next, we will describe Example 1. In the following description, the data processing device 12 will be referred to as the "server," and the smart glasses 214 will be referred to as the "terminal."

[0544] Modern information systems utilize numerous software components, each potentially containing vulnerabilities. However, manually collecting and analyzing this vulnerability information and taking appropriate countermeasures is extremely difficult. Furthermore, a lack of vulnerability risk assessment and prompt notification to users significantly compromises system security. Therefore, there is a need for a system that efficiently collects and analyzes vulnerability information and provides appropriate countermeasures.

[0545] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 1 is realized by the following means.

[0546] In this invention, the server includes means for inputting customer information, means for generating configuration information based on the input information, means for collecting vulnerability-related information using a web crawler, means for storing and analyzing the collected vulnerability information in a machine learning database, means for comparing the configuration information with vulnerability data and evaluating the risk, means for generating the evaluation results as a report and providing it to the user, means for the user to input detailed system information using a terminal, means for saving the evaluation results in a specific format, and means for sending alerts using email or a dedicated application as a notification means. This enables the rapid and efficient management of vulnerability information and the presentation of appropriate risk assessments and countermeasures.

[0547] "Customer" refers to the person who receives a service or product.

[0548] "Information" refers to a collection of data, knowledge, reports, or other forms of facts or insights.

[0549] "Configuration information" refers to data that details the names, versions, and dependencies of each software component within a system.

[0550] A "web crawler" refers to a software program that automatically visits websites on the internet and collects information.

[0551] "Vulnerability-related information" refers to information about vulnerabilities in software and system security, countermeasures against them, and the scope of their impact.

[0552] A "machine learning database" refers to a database used by AI and machine learning models to learn from collected data.

[0553] "Vulnerability data" refers to a dataset containing detailed information about each vulnerability that has been collected.

[0554] "Risk" refers to vulnerabilities or other dangerous elements that could potentially affect a system.

[0555] A "report" refers to a document that organizes specific information and provides it in a standardized format.

[0556] A "terminal" refers to a computer or other electronic device that a user uses to access a system.

[0557] "Format" refers to the rules or protocols that define the arrangement and structure of information and data.

[0558] An "alert" refers to a notification that immediately informs users of urgent or important information.

[0559] This invention provides a system for efficiently collecting, analyzing, and reporting vulnerability information of information systems. The main components of this system are means for inputting customer information, means for generating configuration information, means for collecting vulnerability-related information using a web crawler, means for storing and analyzing the information in a machine learning database, means for evaluating the risks, and means for generating the evaluation results as a report and providing it to the user.

[0560] Customers input information and generate configuration information.

[0561] User

[0562] The first step a user should take is to enter system information. After logging into the system using a dedicated application or web browser from a terminal, the user enters the names and version information of the installed software. For example, the user might enter "Apache 2.4.48" or "OpenSSL 1.1.1k" into the text box, then confirm the entered information and press the submit button.

[0563] server

[0564] The server receives information provided by the user and generates a Software Bill of Materials (SBOM) based on it. The SBOM is stored in JSON or XML format and contains the name, version, and dependencies of each software program. For example, the generated JSON file might include data such as:

[0565] json

[0566] {

[0567] "software_components": [

[0568] {

[0569] "name": "Apache",

[0570] "version": "2.4.48",

[0571] "dependencies": []

[0572] },

[0573] {

[0574] "name": "OpenSSL",

[0575] "version": "1.1.1k",

[0576] "dependencies": []

[0577] }

[0578] ]

[0579] }

[0580] Collection of vulnerability information

[0581] server

[0582] The server periodically launches a web crawler to collect vulnerability-related information from the internet. The crawler visits security information sites and vulnerability databases (e.g., JVN and NVD). The collected information is stored in the vulnerability information database, recording information such as the CVE number, scope of impact, mitigation methods, and release date for each vulnerability.

[0583] Learning and analysis of vulnerability information

[0584] server

[0585] The collected vulnerability information is stored in a machine learning database, and the server uses this data to train an AI learning model. Specifically, a neural network model is used to analyze the data and integrate the characteristics and patterns of vulnerabilities into the model. For example, the model is periodically updated by learning about impact, similar past cases, and the characteristics of affected software.

[0586] Matching configuration information with vulnerability data and risk assessment

[0587] server

[0588] The server analyzes the generated SBOM and extracts version information for each software component. Based on this information, the AI ​​model compares it with learned vulnerability data to identify the corresponding vulnerabilities. For example, it compares "Apache 2.4.48" with "CVE-2021-41773" and performs a risk assessment. Past cases and the scope of impact are also considered in the risk assessment.

[0589] Provision of evaluation results and alert notifications

[0590] server

[0591] The server generates a report of the risk assessment results and saves it in a specified format (such as PDF or HTML). If a critical vulnerability is found, an alert notification is sent to the user. The notification is sent via email or a dedicated application. For example, an alert stating "A critical vulnerability (CVE-2021-41773) has been discovered" might be sent.

[0592] User

[0593] Users can use their terminals to review reports provided by the server and understand detailed system vulnerability information. This allows them to take appropriate countermeasures quickly. For example, it is possible to create meeting materials based on the report content and explain the current security risks to management.

[0594] Example of a prompt

[0595] For example, possible prompts for a generative AI model include the following:

[0596] Please provide the latest vulnerability information regarding "Apache 2.4.48".

[0597] Thus, the system of the present invention can efficiently and quickly manage vulnerability information and provide users with information to take appropriate countermeasures.

[0598] The flow of the specific processing in Example 1 will be explained using Figure 11.

[0599] Step 1:

[0600] The user enters system information.

[0601] Users log in to the system from their terminal using a dedicated application or web browser. After logging in, they enter the names and version information of the installed software. For example, they might enter "Apache 2.4.48" or "OpenSSL 1.1.1k" and send that information to the server. This input is performed manually by the user.

[0602] Input: User-entered software name and version information

[0603] Output: Software information sent to the server

[0604] Step 2:

[0605] The server generates Software Configuration Information (SBOM).

[0606] The server receives software name and version information sent by the user and generates Software Bill of Materials (SBOM) based on this information. The SBOM is stored in a structured data format (such as JSON or XML) that details the name, version, and dependencies of each software. For example, it generates corresponding JSON data based on the information for "Apache 2.4.48".

[0607] Input: Software information submitted by the user

[0608] Output: Generated SBOM (JSON or XML file)

[0609] Step 3:

[0610] The server collects vulnerability information.

[0611] The server periodically activates a web crawler to collect vulnerability-related information from the internet. The crawler visits security information sites and vulnerability databases (e.g., JVN and NVD), extracts the latest vulnerability information, and stores it in the vulnerability information database. The collected information includes the CVE number, scope of impact, mitigation methods, and release date for each vulnerability.

[0612] Input: None (It is launched periodically)

[0613] Output: Latest vulnerability information stored in the vulnerability information database

[0614] Step 4:

[0615] The server learns and analyzes vulnerability information.

[0616] The server stores the collected vulnerability information in a machine learning database and uses this to train an AI learning model. The learning process uses a neural network model to analyze factors such as impact, past occurrences, and the characteristics of affected software. For example, the AI ​​model learns vulnerability occurrence patterns to improve prediction accuracy.

[0617] Input: Data stored in the vulnerability information database

[0618] Output: Trained AI learning model

[0619] Step 5:

[0620] The server performs matching of SBOM and vulnerability data and risk assessment.

[0621] The server analyzes the generated SBOM and extracts version information for each software component. Based on this information, the AI ​​model compares it with learned vulnerability data to detect relevant vulnerabilities. For example, it might compare "Apache 2.4.48" with "CVE-2021-41773" and perform a risk assessment. The risk assessment also takes into account the impact and similar past cases.

[0622] Input: Generated SBOM, trained AI learning model

[0623] Output: Risk assessment results

[0624] Step 6:

[0625] The server provides evaluation results and sends alert notifications.

[0626] The server generates a report based on the risk assessment results and saves it in a specified format (such as PDF or HTML). If a critical vulnerability is found as a result of the assessment, an alert notification is sent to the user. The notification is sent via email or a dedicated application. For example, an alert might be sent stating, "A critical vulnerability (CVE-2021-41773) has been discovered."

[0627] Input: Risk assessment results

[0628] Output: Generated reports, sent alert notifications

[0629] Step 7:

[0630] Users can view the evaluation results.

[0631] Users can use their terminals to review reports provided by the server and understand detailed system vulnerability information. This allows them to take appropriate countermeasures quickly. For example, they can use the report content to create meeting materials and explain the current security risks to management.

[0632] Input: Provided report

[0633] Output: Implementation of countermeasures, creation of meeting materials

[0634] Through this series of processing steps, it is possible to efficiently and quickly manage vulnerability information and provide users with information to take appropriate countermeasures.

[0635] (Application Example 1)

[0636] Next, we will explain Application Example 1. In the following explanation, the data processing device 12 will be referred to as the "server," and the smart glasses 214 will be referred to as the "terminal."

[0637] Modern information systems are complex, making it difficult to quickly and efficiently grasp information about software vulnerabilities. This can lead to delays in discovering vulnerabilities and implementing appropriate countermeasures. Furthermore, there is a lack of means to notify users of assessment results in real time and encourage prompt action.

[0638] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 1 is realized by the following means.

[0639] In this invention, the server includes means for inputting customer system information, means for generating software configuration information based on the input system information, means for collecting vulnerability-related information using a web crawler, means for storing and analyzing the collected vulnerability information in an AI learning database, means for comparing the software configuration information and vulnerability data to evaluate the risk, means for generating the evaluation results as a report and providing it to the user, and means for notifying the user of the evaluation results in real time. This makes it possible to quickly and efficiently collect, analyze, and notify the user of vulnerability information in real time.

[0640] "Customer system information" refers to configuration and setting information related to the information systems used by the user, including software names and version information.

[0641] "Software configuration information" refers to information that represents the name, version, and dependencies of each installed software in a structured data format.

[0642] A "web crawler" is a program that automatically collects information from the internet and is used to obtain data from vulnerability information sites and vulnerability databases.

[0643] "Vulnerability-related information" refers to information about security holes and flaws in systems and software, including CVE numbers, scope of impact, and countermeasures.

[0644] An "AI learning database" is a database that stores collected vulnerability information and is used for training and analyzing AI models.

[0645] "Assessing risk" is the process of analyzing the degree of risk and scope of impact that a particular vulnerability poses to a user's system, based on vulnerability information matched with software configuration information.

[0646] "Generating and providing a report to the user" means creating the evaluation results in a document format (e.g., PDF or HTML) and providing it to the user.

[0647] "Notifying users in real time" refers to a means of immediately communicating information to users when a vulnerability is discovered, and includes notifications made via email or dedicated applications, for example.

[0648] This invention is a vulnerability management system specifically designed for security services. This system takes customer system information as input, analyzes the collected vulnerability-related information using AI, and provides it to the user in real time.

[0649] First, the user installs a dedicated application and logs into the system from their device. Next, the user enters their system information. For example, they enter the software name and version information, such as "Apache 2.4.48" or "OpenSSL 1.1.1k".

[0650] The entered information is sent to the server and generated as Software Bill of Materials (SBOM). The SBOM is stored as structured data such as JSON or XML. The SBOM contains detailed information such as the name, version, and dependencies of each software.

[0651] Next, the server periodically runs a web crawler to collect vulnerability-related information from the internet. The target sites are security information sites and vulnerability databases. The collected data is stored in the vulnerability information database and includes CVE numbers, scope of impact, mitigation methods, and release dates.

[0652] The collected vulnerability information is stored in an AI training database. The server uses this data to train an AI learning model, analyzing the characteristics and patterns of vulnerabilities. The AI ​​model analyzes the impact, similar past cases, and the characteristics of the affected software, and updates the model accordingly.

[0653] The server analyzes the generated SBOM and extracts version information for each software component. It then compares this information with vulnerability data learned by the AI ​​to detect matching vulnerabilities. For matched vulnerabilities, an evaluation is conducted based on risk level and past incidents. For example, if "Apache 2.4.48" corresponds to "CVE-2021-41773," the risk level and scope of impact are evaluated in detail.

[0654] The evaluation results are generated as a report and saved in formats such as PDF and HTML. Users are also notified in real time. Email and dedicated applications are used as notification methods. For example, an alert stating "A critical vulnerability (CVE-2021-41773) has been discovered" might be sent.

[0655] Users can review reports generated through their devices to gain detailed information about system vulnerabilities. This allows them to take appropriate measures and report issues to higher management. Specifically, they can create meeting materials based on the report content and explain the current security risks to management.

[0656] Hardware and software to be used

[0657] Hardware: Smartphones, smart glasses, head-mounted displays, robots

[0658] Software: Python 3.x, requests (web crawler), JSON (data processing), smtplib (email sending)

[0659] Specific example

[0660] As a concrete example, a user launches an application and enters "Apache 2.4.48" and "OpenSSL 1.1.1k". The application generates an SBOM from this information. A web crawler collects vulnerability data from sites such as "https: / / examplevulnerabilities.com / data1". The SBOM is compared with the collected vulnerability data to detect relevant vulnerabilities and perform a risk assessment. A risk report is sent to the user via email to notify them that a critical vulnerability has been found.

[0661] Example of a prompt:

[0662] "My system has Apache 2.4.48 and OpenSSL 1.1.1k installed. Please check for vulnerabilities in these versions and generate a risk report."

[0663] This makes it possible to quickly and efficiently collect and analyze vulnerability information and notify users in real time.

[0664] The flow of a specific process in Application Example 1 will be explained using Figure 12.

[0665] Step 1:

[0666] Users install a dedicated application and log in to the system from their device. They access the system login screen on their device and enter their authentication information to authenticate access to the system. This generates a user ID and a token for accessing the system information input screen.

[0667] Input: User authentication information

[0668] Output: User ID, Access Token

[0669] Step 2:

[0670] The user enters system information through a dedicated application. They enter the software name and version information and send it to the server. This information may include details such as "Apache 2.4.48" or "OpenSSL 1.1.1k". This information is sent to the server in JSON format.

[0671] Input: Software name, version information

[0672] Output: System information in JSON format

[0673] Step 3:

[0674] The server generates Software Base of Management (SBOM) information based on the received system information. The server parses the received JSON data and extracts the name and version information of each software. This is then saved as an SBOM in a structured data format (JSON or XML).

[0675] Input: System information in JSON format

[0676] Output: SBOM (Structured Data)

[0677] Step 4:

[0678] The server periodically activates a web crawler to collect vulnerability-related information. Target sites include security information sites and vulnerability databases (e.g., "https: / / examplevulnerabilities.com / data1"). The crawler visits each site and retrieves vulnerability information.

[0679] Input: URL of the security information site

[0680] Output: List of vulnerability information

[0681] Step 5:

[0682] The collected vulnerability information is stored in an AI training database. The server analyzes the vulnerability information list and saves it as training data for the AI ​​model. This ensures that the AI ​​model is trained based on the latest vulnerability information.

[0683] Input: List of vulnerability information

[0684] Output: AI learning database

[0685] Step 6:

[0686] The server compares the collected vulnerability information with the SBOM and performs a risk assessment. It matches the version information of each software component in the SBOM with the vulnerability information. If a relevant vulnerability is found, it evaluates the degree of risk and the scope of impact.

[0687] Input: SBOM, vulnerability information

[0688] Output: Risk assessment results

[0689] Step 7:

[0690] The evaluation results are generated as a report and provided to the user. The server creates the report based on the risk assessment results and saves it in formats such as PDF or HTML. The report is sent to the user via email.

[0691] Input: Risk assessment results

[0692] Output: Reports (PDF or HTML), email notifications

[0693] Step 8:

[0694] If a critical vulnerability is detected, users will be notified in real time. Based on the risk assessment results, the server generates alert notifications according to the severity of the vulnerability. Email and push notifications via a dedicated application are used as notification methods.

[0695] Input: Risk assessment results

[0696] Output: Alert notifications (email, push notifications)

[0697] This allows users to receive vulnerability information in real time and respond quickly. As a concrete example, if a user enters "Apache 2.4.48" and "OpenSSL 1.1.1k", the system will collect and analyze vulnerability information related to them, perform a risk assessment, and immediately notify the user.

[0698] Furthermore, an emotion engine that estimates the user's emotions may be incorporated. That is, the identification processing unit 290 may use the emotion identification model 59 to estimate the user's emotions and perform identification processing using the user's emotions.

[0699] This invention aims to further improve a system that collects customer system information and efficiently manages, analyzes, and reports vulnerability information by combining it with an emotion engine that recognizes user emotions. The main components of this system include means for inputting customer system information, means for generating software configuration information (SBOM), means for collecting vulnerability-related information using a web crawler, means for storing and analyzing the collected information in an AI learning database, means for performing risk assessment, means for generating and providing the assessment results as a report to the user, and an emotion engine that recognizes user emotions.

[0700] Enter customer system information and generate SBOM

[0701] User

[0702] The user logs into the system from their terminal using a web browser or a dedicated application. Next, they enter the name and version information of the software installed on the system. For example, they might enter information such as "Apache 2.4.48" or "OpenSSL 1.1.1k".

[0703] server

[0704] The server generates a Software Configuration Map (SBOM) based on system information provided by the user. This SBOM is stored in a structured data format such as JSON or XML and includes the names, versions, and dependencies of each software within the system.

[0705] Collection of vulnerability information

[0706] server

[0707] The server periodically runs a web crawler to collect vulnerability-related information from security information sites and vulnerability databases (such as JVN and NVD) on the internet. The collected information is stored in the server's vulnerability information database. This database includes information such as CVE numbers, scope of impact, mitigation methods, and release dates.

[0708] Learning and analysis of vulnerability information

[0709] server

[0710] The server retrieves the latest data from the vulnerability information database and feeds it to an AI learning model. The AI ​​model learns from the retrieved vulnerability information and analyzes the characteristics and patterns of vulnerabilities. The analysis includes factors such as impact, similar past cases, and characteristics of affected software.

[0711] Matching SBOM with vulnerability data and risk assessment

[0712] server

[0713] The server analyzes the generated SBOM and extracts version information for each software component. The server then compares the extracted version information with learned vulnerability data to detect the corresponding vulnerabilities. It assesses the risk of the detected vulnerabilities and performs a detailed evaluation based on the scope of impact and the degree of risk. For example, if "Apache 2.4.48" corresponds to "CVE-2021-41773", the server will perform a detailed evaluation of its risk level and scope of impact.

[0714] Emotion recognition and report generation / delivery

[0715] server

[0716] The server is equipped with an emotion engine that recognizes user emotions. This emotion engine determines user emotions in real time through facial recognition and voice analysis. The results of this emotion recognition are reflected in how reports are displayed, the timing of alert notifications, and their content.

[0717] For example, if a user is experiencing stress, the report display will be simplified and focused on the most urgent information. Additionally, if it's determined that the user is not in a state to calmly receive information, the alert notification will be softened and resent later.

[0718] Provision of evaluation results and alert notifications

[0719] server

[0720] The server generates a report based on the evaluation results and saves it in the specified format (such as PDF or HTML). If necessary, an alert notification is sent to the user. Based on the emotion engine, alerts are sent at a timing and in a manner appropriate to the user's emotional state. For example, an immediate notification is sent in an emergency, but the notification is delayed if the user is feeling stressed.

[0721] User

[0722] Users review reports generated through their devices to gain detailed information about system vulnerabilities. Based on the report, users consider appropriate countermeasures and report to higher management. For example, they might use the report to create meeting materials or presentations to explain the current security risks to management.

[0723] Thus, the system of the present invention can manage and provide vulnerability information more appropriately and effectively by recognizing and considering the user's emotions.

[0724] The following describes the processing flow.

[0725] Step 1:

[0726] User

[0727] Users log in to the system from their terminal using a web browser or a dedicated application.

[0728] Step 2:

[0729] User

[0730] After logging in, the user enters the name and version information of the software installed on the system.

[0731] For example, enter information such as "Apache 2.4.48" or "OpenSSL 1.1.1k".

[0732] Step 3:

[0733] server

[0734] The server receives system information entered by the user and generates Software Bill of Materials (SBOM). The SBOM is stored in structured data format such as JSON or XML.

[0735] Step 4:

[0736] server

[0737] The server periodically activates a web crawler to collect vulnerability-related information. Target sites include security information sites and vulnerability databases (e.g., JVN and NVD).

[0738] Step 5:

[0739] server

[0740] The collected vulnerability information is stored in a vulnerability database on the server. The database includes information such as the CVE number, scope of impact, mitigation methods, and release date.

[0741] Step 6:

[0742] server

[0743] The server retrieves the latest data from the vulnerability information database and feeds it to the AI ​​learning model.

[0744] Step 7:

[0745] server

[0746] The AI ​​model learns from the acquired vulnerability information and analyzes the characteristics and patterns of vulnerabilities. Specifically, it analyzes the impact, similar past cases, and the characteristics of the affected software.

[0747] Step 8:

[0748] server

[0749] The server analyzes the generated SBOM and extracts version information for each software component.

[0750] Step 9:

[0751] server

[0752] The server compares the extracted version information with the learned vulnerability data to detect the corresponding vulnerabilities.

[0753] Step 10:

[0754] server

[0755] The detected vulnerabilities are assessed for their risk, and a detailed evaluation is conducted based on the scope of impact and the degree of risk. For example, if "Apache 2.4.48" corresponds to "CVE-2021-41773", the degree of risk and the scope of impact are evaluated in detail.

[0756] Step 11:

[0757] server

[0758] The server activates an emotion engine that recognizes the user's emotions and determines the user's emotional state in real time. The emotion engine analyzes emotions through the user's facial recognition and voice analysis.

[0759] Step 12:

[0760] server

[0761] Based on the emotion engine, the report generation process takes the user's emotional state into account when generating reports based on evaluation results. For example, if the user is stressed, the report display will be simplified and focus on more urgent information.

[0762] Step 13:

[0763] server

[0764] The server saves the generated report in a specified format (such as PDF or HTML) and sends alert notifications at a time appropriate to the user's emotional state based on the emotion engine. For example, it can send an immediate notification in an emergency, or postpone notifications if the user is feeling stressed.

[0765] Step 14:

[0766] User

[0767] Users can review reports generated through their devices to gain detailed information about system vulnerabilities.

[0768] Step 15:

[0769] User

[0770] Users consider appropriate countermeasures based on the report and report to higher management. For example, they might create meeting materials or presentations based on the report to explain the current security risks to management.

[0771] (Example 2)

[0772] Next, we will describe Example 2. In the following description, the data processing device 12 will be referred to as the "server" and the smart glasses 214 will be referred to as the "terminal".

[0773] In conventional systems, vulnerability management based on customer system information was insufficient, making it difficult to collect vulnerability information, assess risks, and propose appropriate countermeasures. Furthermore, responses did not take into account the user's feelings, making it challenging to provide appropriate information when users were experiencing stress or anxiety.

[0774] The identification processing performed by the identification processing unit 290 of the data processing device 12 in Example 2 is realized by the following means. In this invention, the server includes means for inputting customer system information, means for generating software configuration information based on the input system information, means for collecting vulnerability-related information using a web crawler, means for storing and analyzing the collected vulnerability information in a learning database, means for comparing the software configuration information and vulnerability data and evaluating the risk, means for recognizing the user's emotions, and means for generating the evaluation results as a report and providing it while taking the user's emotions into consideration. This enables efficient management of vulnerability information, risk assessment, and appropriate information provision while taking the user's emotions into consideration.

[0775] "Customer system information" refers to the software and hardware configuration information related to the systems used by the customer.

[0776] "Software configuration information" refers to detailed information including the names, versions, and dependencies of the software installed on the customer's system.

[0777] A "web crawler" refers to a program that automatically visits websites on the internet to collect information.

[0778] "Vulnerability-related information" refers to information about security flaws and vulnerabilities present in software and systems.

[0779] A "training database" refers to a database where AI learning models store vulnerability information for analysis and learning purposes.

[0780] "Risk assessment" refers to the process of evaluating the impact and risks that a particular vulnerability may have on a system.

[0781] "Means of recognizing emotions" refers to technologies that analyze a user's facial expressions and voice in real time to determine their emotional state.

[0782] "Means of providing information as a report" refers to functions that provide users with easily understandable information such as risk assessment results and vulnerability information.

[0783] This invention relates to a system that efficiently manages customer system information, collects, analyzes, and assesses vulnerability information, and provides information while considering user sentiment. This system is implemented using multiple hardware and software components to achieve both user convenience and information accuracy.

[0784] First, the user accesses the system from their terminal using a web browser or a dedicated application. They enter their user ID and password on the login screen, and upon successful authentication, they are redirected to the dashboard. On the dashboard, they enter the name and version information of the installed software (e.g., "Apache 2.4.48") into a dedicated form and click the "Submit" button. This information is then sent to the server.

[0785] The server receives software information sent by the user and generates Software Base of Memory (SBOM) based on it. Specifically, it converts the received software name and version information into JSON format and saves it, including dependency information. For example, the information is saved in a JSON format like the following:

[0786] json

[0787] {

[0788] "components": [

[0789] {

[0790] "name": "Apache",

[0791] "version": "2.4.48",

[0792] "dependencies": ["mod_ssl"]

[0793] },

[0794] {

[0795] "name": "OpenSSL",

[0796] "version": "1.1.1k",

[0797] "dependencies": []

[0798] }

[0799] ]

[0800] }

[0801] Next, the server periodically starts a web crawler based on a pre-configured schedule. The web crawler collects the latest vulnerability information from security information sites and vulnerability databases on the internet (e.g., JVN and NVD). The collected information is stored in the vulnerability information database and includes information such as the CVE number, scope of impact, mitigation methods, and release date. For example, new CVE information is stored as follows:

[0802] json

[0803] {

[0804] "CVE-2021-41773": {

[0805] "impact": "High",

[0806] "description": "Path traversal vulnerability in Apache 2.4.48.",

[0807] "fix": "Upgrade to Apache 2.4.49 or later."

[0808] }

[0809] }

[0810] Subsequently, the server retrieves the latest data from the vulnerability information database and feeds it into a pre-built generative AI model. The generative AI model learns the characteristics and patterns of vulnerabilities using past vulnerability data and newly acquired data. As a result of the learning, the impact and similar past cases are analyzed. For example, it is clearly indicated which past cases "CVE-2021-41773" is similar to and what the degree of impact is.

[0811] The server analyzes the generated SBOM and extracts version information for each software component. It then compares the extracted version information with the analyzed vulnerability data to detect any vulnerabilities. For example, if "Apache 2.4.48" corresponds to "CVE-2021-41773," the server performs a detailed assessment of its impact and risk level. This assessment result is saved as detailed risk analysis data.

[0812] Furthermore, the server is equipped with an emotion engine that recognizes the user's emotions. The emotion engine determines the user's emotional state in real time through facial expression recognition and voice analysis as the user interacts with the system. For example, if the camera identifies the user's face and determines that they are experiencing stress, the content and display method of the report will be adjusted accordingly.

[0813] The server generates a report based on the risk assessment results and saves it in the specified format (such as PDF or HTML). If necessary, it sends alert notifications at a time appropriate to the user's emotional state. For example, if the user is feeling stressed, the notification will be delayed and alerts will be sent at an appropriate time.

[0814] Users review reports generated through their devices to gain detailed information about system vulnerabilities. Based on the report, they consider appropriate countermeasures and report to higher management. For example, they might create meeting materials or presentations to explain the current security risks to management.

[0815] In this way, this system achieves more effective security measures by managing and providing vulnerability information while taking user emotions into consideration.

[0816] The flow of the specific processing in Example 2 will be explained using Figure 13.

[0817] Step 1: Log in to the system and enter system information.

[0818] The user accesses the system by launching a web browser or dedicated application using their terminal. They enter their user ID and password on the login screen (input). Upon successful authentication, they are redirected to the dashboard. On the dashboard, the user enters the name and version information of the installed software into a dedicated form and clicks the "Submit" button (input). This information is sent to the server (output).

[0819] Step 2: Generate Software Configuration Information (SBOM)

[0820] The server receives software information sent by the user (input). Based on the received software information, it generates software configuration information (SBOM) (data processing). Specifically, it converts the input software name and version information into JSON format and saves it, including dependencies (output). As an example, the following JSON structure is generated.

[0821] json

[0822] {

[0823] "components": [

[0824] {

[0825] "name": "Apache",

[0826] "version": "2.4.48",

[0827] "dependencies": ["mod_ssl"]

[0828] },

[0829] {

[0830] "name": "OpenSSL",

[0831] "version": "1.1.1k",

[0832] "dependencies": []

[0833] }

[0834] ]

[0835] }

[0836] Step 3: Gather vulnerability information

[0837] The server periodically starts the web crawler based on a pre-configured schedule (startup). The web crawler collects the latest vulnerability information from security information sites and vulnerability databases on the internet (e.g., JVN and NVD) (input). The collected information is stored in the vulnerability information database on the server (output).

[0838] Step 4: Learning and analyzing vulnerability information

[0839] The server retrieves the latest data from a vulnerability information database (input). It feeds the retrieved data into a pre-built generative AI model, which learns the characteristics and patterns of vulnerabilities (data computation). Specifically, it analyzes factors such as impact and similar past cases, and generates new vulnerability information as a result of the analysis (output).

[0840] Step 5: Matching SBOM with vulnerability data and risk assessment

[0841] The server analyzes the generated SBOM and extracts version information for each software component (input). It then compares the extracted version information with the analyzed vulnerability data (data calculation). For example, if "Apache 2.4.48" corresponds to "CVE-2021-41773", the degree of risk and the scope of impact are evaluated (output).

[0842] Step 6: Emotion recognition and report generation / delivery

[0843] The server is equipped with an emotion engine that recognizes the user's emotions. The emotion engine analyzes the user's facial expressions and voice in real time as they operate the system and recognizes their emotional state (input). Based on this information, a report including risk assessment results is generated, but the content and display method of the report are adjusted according to the user's emotional state (data processing and output).

[0844] Step 7: Provision of evaluation results and alert notifications

[0845] The server generates a report based on the risk assessment results and saves it in a format (such as PDF or HTML) (output). It also adjusts the timing of alert notifications according to the user's emotional state. For example, if the user is stressed, less urgent notifications are delayed (data processing and output). The user reviews the generated report through their terminal to understand detailed information about system vulnerabilities. Based on the report content, they consider appropriate countermeasures and report to higher levels (output).

[0846] (Application Example 2)

[0847] Next, we will explain application example 2. In the following explanation, the data processing device 12 will be referred to as the "server," and the smart glasses 214 will be referred to as the "terminal."

[0848] Traditional vulnerability management systems often caused stress and burden on users because, when collecting customer system information, analyzing vulnerability data, and providing reports, they did not consider the user's emotional state when displaying notifications or reports. Furthermore, even in situations requiring urgent security measures, notifications were not provided at an appropriate time based on the user's situation, potentially delaying countermeasures. There is a need to address these issues and provide a more user-friendly vulnerability management system.

[0849] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means.

[0850] In this invention, the server includes means for inputting customer computer system information, means for generating software configuration information based on the input computer system information, means for collecting vulnerability-related information using a web crawler, means for storing and analyzing the collected vulnerability information in an AI learning database, means for comparing the software configuration information with the vulnerability data and evaluating the risk, means for generating the evaluation results as a report and providing it to the terminal user, and an emotion engine that recognizes the terminal user's emotions and adjusts the method of displaying reports and providing alert notifications. This enables flexible report display and alert notifications according to the terminal user's emotional state.

[0851] "Customer computer system information" refers to software and hardware information related to the computer system used by the customer.

[0852] "Software configuration information" refers to information that includes the names, versions, and dependencies of software installed on a computer system.

[0853] A "web crawler" is software that automatically collects information from the internet.

[0854] "Vulnerability-related information" refers to information about security flaws and risks present in software and systems.

[0855] An "AI training database" is a database that stores data used to train artificial intelligence models.

[0856] An "emotion engine" is a technology that determines a user's emotional state in real time through facial recognition and voice analysis.

[0857] "Risk assessment" is the process of evaluating the impact and risks to a computer system based on collected vulnerability information.

[0858] A "report" is a collection of documents and information that summarizes the results of a risk assessment and provides them to terminal users.

[0859] An "alert notification" is a notification that alerts or warns the device user when certain conditions are met.

[0860] A "terminal user" refers to an individual or organizational representative who uses this system.

[0861] As an example of this invention's application, consider a vulnerability management application called "Secure Guardian." This application collects customer computer system information, analyzes vulnerability information, and provides a risk assessment report. It is installed and used on smartphones.

[0862] Hardware and software usage

[0863] The server uses a high-performance cloud server (for example, AWS EC2), and the user's terminal is a smartphone (iPhone or Android device).

[0864] On the server side, the following software and technologies are used:

[0865] 1. Web crawler: Use BeautifulSoup or Scrapy to collect vulnerability information.

[0866] 2. AI Learning Model: Analyze vulnerability data using TensorFlow or PyTorch.

[0867] 3. Emotion Engine: OpenCV or DeepFace is used for face recognition, and Google Cloud Speech-to-Text is used for speech recognition.

[0868] Application features and operation

[0869] 1. Input of computer system information and generation of SBOM

[0870] Terminal users enter the name and version information of the software they are using through a smartphone application. Based on this information, the server automatically generates Software Base of Memory (SBOM) in JSON or XML format.

[0871] 2. Collection of vulnerability information

[0872] The server periodically runs a web crawler to collect the latest vulnerability-related information from internet vulnerability databases (such as JVN and NVD). The collected information is stored in the vulnerability information database.

[0873] 3. Learning and analyzing vulnerability information

[0874] The server-side AI learning model obtains the latest data from a vulnerability information database and performs training. This allows it to analyze the characteristics and impact of vulnerabilities and generate prediction results.

[0875] 4. Matching SBOM with vulnerability data and risk assessment

[0876] The server analyzes the generated SBOM and compares the version information of each software component with vulnerability data. This allows it to detect relevant vulnerabilities and perform a risk assessment.

[0877] 5. Emotion recognition and reporting

[0878] The system uses the smartphone's camera and microphone to recognize the user's emotions in real time. OpenCV and DeepFace are used for facial recognition, and Google Cloud Speech-to-Text is used for speech analysis. The display of reports and the timing of alert notifications are adjusted according to the user's emotional state.

[0879] 6. Provision of evaluation results and alert notifications

[0880] Based on the risk assessment results, the server generates a report and provides it to the terminal user in PDF or HTML format. Using an emotion engine, alert notifications are sent at the appropriate time according to the user's emotional state.

[0881] Examples of specific cases and prompt statements

[0882] As a concrete example, a company's security officer installs "Secure Guardian" and uses the application to input a list of software used within the company. Then, based on the SBOM generated by the server, the system collects the latest vulnerability information and automatically performs a risk assessment. Furthermore, if an officer is experiencing high stress levels, the system is configured to notify them later, allowing them to view a detailed report once they have calmed down.

[0883] Example of a prompt:

[0884] "Use SecureGuardian to input system vulnerability information for Apache 2.4.48 and OpenSSL 1.1.1k. Collect the latest vulnerability information and generate a risk assessment report. Utilize sentiment recognition to delay notifications if stress levels are high, allowing users to calmly review the detailed report."

[0885] The flow of a specific process in Application Example 2 will be explained using Figure 14.

[0886] Step 1:

[0887] Users log in using a smartphone application. They enter the name and version information of the software they are using. This data is sent to the server and becomes the source data for generating Software Configuration Information (SBOM).

[0888] Step 2:

[0889] The server generates Software Base of Memory (SBOM) in JSON or XML format based on the received software information. Data processing involves organizing software names and version information, and constructing dependencies between software components. This SBOM is then used to verify vulnerability information later on.

[0890] Step 3:

[0891] The server periodically activates a web crawler to collect the latest vulnerability information from internet vulnerability databases (e.g., JVN and NVD). The collected vulnerability information is stored in an internal database. Data processing involves parsing and saving the collected information.

[0892] Step 4:

[0893] The server retrieves the latest vulnerability information from a vulnerability database and feeds it to an AI learning model. The generated AI learning model is used to analyze the characteristics and impact of vulnerabilities. It receives vulnerability data as input and generates vulnerability risk assessment information as output.

[0894] Step 5:

[0895] The server compares the generated SBOM with vulnerability data to detect matching vulnerabilities. It then performs a risk assessment of the matched vulnerabilities and outputs information on their impact and mitigation methods. Data processing includes version information matching and risk level calculation.

[0896] Step 6:

[0897] The server analyzes user emotion information obtained from smartphones. It uses the device's camera and microphone for facial recognition and voice analysis to recognize emotions in real time. The results of emotion recognition are reflected in subsequent reports and alert notifications.

[0898] Step 7:

[0899] The server generates a report based on the risk assessment results and provides it to the user in PDF or HTML format. The report's display method is adjusted based on the emotion engine's results. For example, if the user is stressed, the report is displayed concisely; if they are calm, detailed information is provided.

[0900] Step 8:

[0901] The server will send alert notifications at the appropriate time based on the user's emotional state. In urgent cases, notifications will be sent immediately, while notifications will be delayed if the user is experiencing stress. For example, even if an urgent vulnerability is discovered, if the user is stressed, the notification will be sent only after they have calmed down.

[0902] The specific processing unit 290 transmits the result of the specific processing to the smart glasses 214. In the smart glasses 214, the control unit 46A causes the speaker 240 to output the result of the specific processing. The microphone 238 acquires audio indicating user input for the result of the specific processing. The control unit 46A transmits the audio data indicating user input acquired by the microphone 238 to the data processing unit 12. In the data processing unit 12, the specific processing unit 290 acquires the audio data.

[0903] Data generation model 58 is a type of so-called generative AI (Artificial Intelligence). One example of data generation model 58 is ChatGPT (Internet search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search) <url: https: gemini.google.com ?hl="ja">Examples of generative AI include the following. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 is input with prompts containing instructions, and with inference data such as audio data representing speech, text data representing text, and image data representing images. The data generation model 58 infers from the input inference data according to the instructions indicated by the prompts, and outputs the inference results in data formats such as audio data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0904] In the above embodiment, an example was given in which specific processing is performed by the data processing device 12, but the technology of this disclosure is not limited thereto, and the specific processing may also be performed by the smart glasses 214.

[0905] [Third Embodiment]

[0906] Figure 5 shows an example of the configuration of the data processing system 310 according to the third embodiment.

[0907] As shown in Figure 5, the data processing system 310 includes a data processing device 12 and a headset terminal 314. An example of the data processing device 12 is a server.

[0908] The data processing device 12 comprises a computer 22, a database 24, and a communication interface 26. The computer 22 is an example of a "computer" related to the technology of this disclosure. The computer 22 comprises a processor 28, RAM 30, and storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication interface 26 are also connected to the bus 34. The communication interface 26 is connected to a network 54. An example of the network 54 is a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0909] The headset terminal 314 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication interface 44, and a display 343. The computer 36 includes a processor 46, RAM 48, and storage 50. The processor 46, RAM 48, and storage 50 are connected to a bus 52. The microphone 238, speaker 240, camera 42, and display 343 are also connected to the bus 52.

[0910] The microphone 238 receives voice signals from the user 20 and receives instructions from the user 20. The microphone 238 captures the voice signals from the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to the instructions from the processor 46.

[0911] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an image sensor such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the area around the user 20 (for example, an imaging range defined by a field of view equivalent to the width of a typical healthy person's field of vision).

[0912] Communication interface 44 is connected to network 54. Communication interfaces 44 and 26 are responsible for the exchange of various information between processor 46 and processor 28 via network 54. The exchange of various information between processor 46 and processor 28 using communication interfaces 44 and 26 is performed in a secure manner.

[0913] Figure 6 shows an example of the main functions of the data processing device 12 and the headset terminal 314. As shown in Figure 6, the data processing device 12 performs specific processing using the processor 28. The storage 32 stores the specific processing program 56.

[0914] The specific processing program 56 is an example of a "program" relating to the technology of this disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0915] The storage 32 stores the data generation model 58 and the emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0916] In the headset terminal 314, the processor 46 performs the reception output processing. The storage 50 stores the reception output program 60. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output processing is realized by the processor 46 operating as a control unit 46A according to the reception output program 60 executed on the RAM 48.

[0917] Next, the specific processing performed by the specific processing unit 290 of the data processing device 12 will be described. In the following description, the data processing device 12 will be referred to as the "server" and the headset terminal 314 will be referred to as the "terminal".

[0918] This invention provides a system for efficiently collecting, analyzing, and reporting vulnerability information of information systems. The main components of this system are means for inputting customer system information, means for generating software configuration information (SBOM), means for collecting vulnerability-related information using a web crawler, means for storing and analyzing the information in an AI learning database, means for evaluating the risks, and means for generating the evaluation results as a report and providing it to the user.

[0919] Enter customer system information and generate SBOM

[0920] User

[0921] The first step a user should take is to enter system information. After logging into the system using a web browser or dedicated application from a terminal, they should enter the names and version information of the installed software. For example, they should enter information such as "Apache 2.4.48" or "OpenSSL 1.1.1k".

[0922] server

[0923] The server generates Software Bill of Materials (SBOM) based on information provided by the user. This SBOM is stored in a structured data format (such as JSON or XML) and includes the names, versions, and dependencies of each software within the system.

[0924] Collection of vulnerability information

[0925] server

[0926] Next, the server periodically runs a web crawler to collect vulnerability-related information from the internet. Target sites include security information sites and vulnerability databases (e.g., JVN and NVD). The collected data is stored in a vulnerability information database. This database includes information such as CVE numbers, scope of impact, mitigation methods, and release dates.

[0927] Learning and analysis of vulnerability information

[0928] server

[0929] The collected vulnerability information is stored in an AI training database, and the server uses this data to train an AI learning model. The AI ​​model learns and analyzes the characteristics and patterns of vulnerabilities. Specifically, it analyzes the impact, similar past cases, and the characteristics of affected software, and updates the model accordingly.

[0930] Matching SBOM with vulnerability data and risk assessment

[0931] server

[0932] The server analyzes the generated SBOM and extracts version information for each software component. It then compares this information with vulnerability data learned by the AI ​​to detect any matching vulnerabilities. For any matching vulnerabilities, an evaluation is conducted based on the degree of risk and past incidents. For example, if "Apache 2.4.48" corresponds to "CVE-2021-41773," the degree of risk and the scope of impact are evaluated in detail.

[0933] Provision of evaluation results and alert notifications

[0934] server

[0935] The server generates a report based on the evaluation results and saves it in the specified format (such as PDF or HTML). If necessary, alert notifications are sent to the user. Email or a dedicated application are used as notification methods. For example, an alert might be sent stating, "A critical vulnerability (CVE-2021-41773) has been discovered."

[0936] User

[0937] Users can review reports generated through their devices to gain detailed information about system vulnerabilities. This allows them to take appropriate measures or report to higher management. For example, they can use the report content to create meeting materials and explain the current security risks to management.

[0938] Thus, the system of the present invention starts by inputting customer system information and generating software configuration information, and through a series of processes including vulnerability information collection, learning, analysis, risk assessment, and provision of assessment results, it is possible to efficiently and quickly manage vulnerability information and take appropriate countermeasures.

[0939] The following describes the processing flow.

[0940] Step 1:

[0941] User

[0942] Users log in to the system from their terminal using a web browser or a dedicated application.

[0943] Step 2:

[0944] User

[0945] The user enters the name and version information of the software installed on the system.

[0946] For example, enter information such as "Apache 2.4.48" or "OpenSSL 1.1.1k".

[0947] Step 3:

[0948] server

[0949] The server receives system information entered by the user and generates a Software Configuration Map (SBOM). The SBOM is stored in a structured data format such as JSON or XML and includes the name, version, and dependencies of each software.

[0950] Step 4:

[0951] server

[0952] The server periodically activates a web crawler to collect vulnerability-related information from security information sites and vulnerability databases (such as JVN and NVD).

[0953] Step 5:

[0954] server

[0955] The collected vulnerability information is stored in a vulnerability database on the server. This database includes information such as the CVE number, scope of impact, mitigation methods, and release date.

[0956] Step 6:

[0957] server

[0958] The server retrieves the latest data from the vulnerability information database and feeds it to the AI ​​learning model.

[0959] Step 7:

[0960] server

[0961] The AI ​​model learns from acquired vulnerability information and analyzes the characteristics and patterns of vulnerabilities. This analysis includes factors such as impact, similar past cases, and characteristics of affected software.

[0962] Step 8:

[0963] server

[0964] The server analyzes the generated SBOM and extracts version information for each software component.

[0965] Step 9:

[0966] server

[0967] The server compares the extracted version information with the learned vulnerability data to detect the corresponding vulnerabilities.

[0968] Step 10:

[0969] server

[0970] We assess the risks associated with the detected vulnerabilities and conduct a detailed evaluation based on the scope of impact and the degree of risk.

[0971] Step 11:

[0972] server

[0973] The server generates a report based on the evaluation results. This report is saved in formats such as PDF or HTML.

[0974] Step 12:

[0975] server

[0976] If necessary, alert notifications will be sent to the user. Notification methods include email and dedicated applications.

[0977] For example, an alert might be sent stating, "A critical vulnerability (CVE-2021-41773) has been discovered."

[0978] Step 13:

[0979] User

[0980] Users can review reports generated through their devices to gain detailed information about system vulnerabilities.

[0981] Step 14:

[0982] User

[0983] Users consider appropriate measures based on the report content and report to higher management. For example, they might create meeting materials or presentations based on the report.

[0984] (Example 1)

[0985] Next, we will describe Example 1. In the following description, the data processing device 12 will be referred to as the "server," and the headset-type terminal 314 will be referred to as the "terminal."

[0986] Modern information systems utilize numerous software components, each potentially containing vulnerabilities. However, manually collecting and analyzing this vulnerability information and taking appropriate countermeasures is extremely difficult. Furthermore, a lack of vulnerability risk assessment and prompt notification to users significantly compromises system security. Therefore, there is a need for a system that efficiently collects and analyzes vulnerability information and provides appropriate countermeasures.

[0987] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 1 is realized by the following means.

[0988] In this invention, the server includes means for inputting customer information, means for generating configuration information based on the input information, means for collecting vulnerability-related information using a web crawler, means for storing and analyzing the collected vulnerability information in a machine learning database, means for comparing the configuration information with vulnerability data and evaluating the risk, means for generating the evaluation results as a report and providing it to the user, means for the user to input detailed system information using a terminal, means for saving the evaluation results in a specific format, and means for sending alerts using email or a dedicated application as a notification means. This enables the rapid and efficient management of vulnerability information and the presentation of appropriate risk assessments and countermeasures.

[0989] "Customer" refers to the person who receives a service or product.

[0990] "Information" refers to a collection of data, knowledge, reports, or other forms of facts or insights.

[0991] "Configuration information" refers to data that details the names, versions, and dependencies of each software component within a system.

[0992] A "web crawler" refers to a software program that automatically visits websites on the internet and collects information.

[0993] "Vulnerability-related information" refers to information about vulnerabilities in software and system security, countermeasures against them, and the scope of their impact.

[0994] A "machine learning database" refers to a database used by AI and machine learning models to learn from collected data.

[0995] "Vulnerability data" refers to a dataset containing detailed information about each vulnerability that has been collected.

[0996] "Risk" refers to vulnerabilities or other dangerous elements that could potentially affect a system.

[0997] A "report" refers to a document that organizes specific information and provides it in a standardized format.

[0998] A "terminal" refers to a computer or other electronic device that a user uses to access a system.

[0999] "Format" refers to the rules or protocols that define the arrangement and structure of information and data.

[1000] An "alert" refers to a notification that immediately informs users of urgent or important information.

[1001] This invention provides a system for efficiently collecting, analyzing, and reporting vulnerability information of information systems. The main components of this system are means for inputting customer information, means for generating configuration information, means for collecting vulnerability-related information using a web crawler, means for storing and analyzing the information in a machine learning database, means for evaluating the risks, and means for generating the evaluation results as a report and providing it to the user.

[1002] Customers input information and generate configuration information.

[1003] User

[1004] The first step a user should take is to enter system information. After logging into the system using a dedicated application or web browser from a terminal, the user enters the names and version information of the installed software. For example, the user might enter "Apache 2.4.48" or "OpenSSL 1.1.1k" into the text box, then confirm the entered information and press the submit button.

[1005] server

[1006] The server receives information provided by the user and generates a Software Bill of Materials (SBOM) based on it. The SBOM is stored in JSON or XML format and contains the name, version, and dependencies of each software program. For example, the generated JSON file might include data such as:

[1007] json

[1008] {

[1009] "software_components": [

[1010] {

[1011] "name": "Apache",

[1012] "version": "2.4.48",

[1013] "dependencies": []

[1014] },

[1015] {

[1016] "name": "OpenSSL",

[1017] "version": "1.1.1k",

[1018] "dependencies": []

[1019] }

[1020] ]

[1021] }

[1022] Collection of vulnerability information

[1023] server

[1024] The server periodically launches a web crawler to collect vulnerability-related information from the internet. The crawler visits security information sites and vulnerability databases (e.g., JVN and NVD). The collected information is stored in the vulnerability information database, recording information such as the CVE number, scope of impact, mitigation methods, and release date for each vulnerability.

[1025] Learning and analysis of vulnerability information

[1026] server

[1027] The collected vulnerability information is stored in a machine learning database, and the server uses this data to train an AI learning model. Specifically, a neural network model is used to analyze the data and integrate the characteristics and patterns of vulnerabilities into the model. For example, the model is periodically updated by learning about impact, similar past cases, and the characteristics of affected software.

[1028] Matching configuration information with vulnerability data and risk assessment

[1029] server

[1030] The server analyzes the generated SBOM and extracts version information for each software component. Based on this information, the AI ​​model compares it with learned vulnerability data to identify the corresponding vulnerabilities. For example, it compares "Apache 2.4.48" with "CVE-2021-41773" and performs a risk assessment. Past cases and the scope of impact are also considered in the risk assessment.

[1031] Provision of evaluation results and alert notifications

[1032] server

[1033] The server generates a report of the risk assessment results and saves it in a specified format (such as PDF or HTML). If a critical vulnerability is found, an alert notification is sent to the user. The notification is sent via email or a dedicated application. For example, an alert stating "A critical vulnerability (CVE-2021-41773) has been discovered" might be sent.

[1034] User

[1035] Users can use their terminals to review reports provided by the server and understand detailed system vulnerability information. This allows them to take appropriate countermeasures quickly. For example, it is possible to create meeting materials based on the report content and explain the current security risks to management.

[1036] Example of a prompt

[1037] For example, possible prompts for a generative AI model include the following:

[1038] Please provide the latest vulnerability information regarding "Apache 2.4.48".

[1039] Thus, the system of the present invention can efficiently and quickly manage vulnerability information and provide users with information to take appropriate countermeasures.

[1040] The flow of the specific processing in Example 1 will be explained using Figure 11.

[1041] Step 1:

[1042] The user enters system information.

[1043] Users log in to the system from their terminal using a dedicated application or web browser. After logging in, they enter the names and version information of the installed software. For example, they might enter "Apache 2.4.48" or "OpenSSL 1.1.1k" and send that information to the server. This input is performed manually by the user.

[1044] Input: User-entered software name and version information

[1045] Output: Software information sent to the server

[1046] Step 2:

[1047] The server generates Software Configuration Information (SBOM).

[1048] The server receives software name and version information sent by the user and generates Software Bill of Materials (SBOM) based on this information. The SBOM is stored in a structured data format (such as JSON or XML) that details the name, version, and dependencies of each software. For example, it generates corresponding JSON data based on the information for "Apache 2.4.48".

[1049] Input: Software information submitted by the user

[1050] Output: Generated SBOM (JSON or XML file)

[1051] Step 3:

[1052] The server collects vulnerability information.

[1053] The server periodically activates a web crawler to collect vulnerability-related information from the internet. The crawler visits security information sites and vulnerability databases (e.g., JVN and NVD), extracts the latest vulnerability information, and stores it in the vulnerability information database. The collected information includes the CVE number, scope of impact, mitigation methods, and release date for each vulnerability.

[1054] Input: None (It is launched periodically)

[1055] Output: Latest vulnerability information stored in the vulnerability information database

[1056] Step 4:

[1057] The server learns and analyzes vulnerability information.

[1058] The server stores the collected vulnerability information in a machine learning database and uses this to train an AI learning model. The learning process uses a neural network model to analyze factors such as impact, past occurrences, and the characteristics of affected software. For example, the AI ​​model learns vulnerability occurrence patterns to improve prediction accuracy.

[1059] Input: Data stored in the vulnerability information database

[1060] Output: Trained AI learning model

[1061] Step 5:

[1062] The server performs matching of SBOM and vulnerability data and risk assessment.

[1063] The server analyzes the generated SBOM and extracts version information for each software component. Based on this information, the AI ​​model compares it with learned vulnerability data to detect relevant vulnerabilities. For example, it might compare "Apache 2.4.48" with "CVE-2021-41773" and perform a risk assessment. The risk assessment also takes into account the impact and similar past cases.

[1064] Input: Generated SBOM, trained AI learning model

[1065] Output: Risk assessment results

[1066] Step 6:

[1067] The server provides evaluation results and sends alert notifications.

[1068] The server generates a report based on the risk assessment results and saves it in a specified format (such as PDF or HTML). If a critical vulnerability is found as a result of the assessment, an alert notification is sent to the user. The notification is sent via email or a dedicated application. For example, an alert might be sent stating, "A critical vulnerability (CVE-2021-41773) has been discovered."

[1069] Input: Risk assessment results

[1070] Output: Generated reports, sent alert notifications

[1071] Step 7:

[1072] Users can view the evaluation results.

[1073] Users can use their terminals to review reports provided by the server and understand detailed system vulnerability information. This allows them to take appropriate countermeasures quickly. For example, they can use the report content to create meeting materials and explain the current security risks to management.

[1074] Input: Provided report

[1075] Output: Implementation of countermeasures, creation of meeting materials

[1076] Through this series of processing steps, it is possible to efficiently and quickly manage vulnerability information and provide users with information to take appropriate countermeasures.

[1077] (Application Example 1)

[1078] Next, we will explain Application Example 1. In the following explanation, the data processing device 12 will be referred to as the "server," and the headset-type terminal 314 will be referred to as the "terminal."

[1079] Modern information systems are complex, making it difficult to quickly and efficiently grasp information about software vulnerabilities. This can lead to delays in discovering vulnerabilities and implementing appropriate countermeasures. Furthermore, there is a lack of means to notify users of assessment results in real time and encourage prompt action.

[1080] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 1 is realized by the following means.

[1081] In this invention, the server includes means for inputting customer system information, means for generating software configuration information based on the input system information, means for collecting vulnerability-related information using a web crawler, means for storing and analyzing the collected vulnerability information in an AI learning database, means for comparing the software configuration information and vulnerability data to evaluate the risk, means for generating the evaluation results as a report and providing it to the user, and means for notifying the user of the evaluation results in real time. This makes it possible to quickly and efficiently collect, analyze, and notify the user of vulnerability information in real time.

[1082] "Customer system information" refers to configuration and setting information related to the information systems used by the user, including software names and version information.

[1083] "Software configuration information" refers to information that represents the name, version, and dependencies of each installed software in a structured data format.

[1084] A "web crawler" is a program that automatically collects information from the internet and is used to obtain data from vulnerability information sites and vulnerability databases.

[1085] "Vulnerability-related information" refers to information about security holes and flaws in systems and software, including CVE numbers, scope of impact, and countermeasures.

[1086] An "AI learning database" is a database that stores collected vulnerability information and is used for training and analyzing AI models.

[1087] "Assessing risk" is the process of analyzing the degree of risk and scope of impact that a particular vulnerability poses to a user's system, based on vulnerability information matched with software configuration information.

[1088] "Generating and providing a report to the user" means creating the evaluation results in a document format (e.g., PDF or HTML) and providing it to the user.

[1089] "Notifying users in real time" refers to a means of immediately communicating information to users when a vulnerability is discovered, and includes notifications made via email or dedicated applications, for example.

[1090] This invention is a vulnerability management system specifically designed for security services. This system takes customer system information as input, analyzes the collected vulnerability-related information using AI, and provides it to the user in real time.

[1091] First, the user installs a dedicated application and logs into the system from their device. Next, the user enters their system information. For example, they enter the software name and version information, such as "Apache 2.4.48" or "OpenSSL 1.1.1k".

[1092] The entered information is sent to the server and generated as Software Bill of Materials (SBOM). The SBOM is stored as structured data such as JSON or XML. The SBOM contains detailed information such as the name, version, and dependencies of each software.

[1093] Next, the server periodically runs a web crawler to collect vulnerability-related information from the internet. The target sites are security information sites and vulnerability databases. The collected data is stored in the vulnerability information database and includes CVE numbers, scope of impact, mitigation methods, and release dates.

[1094] The collected vulnerability information is stored in an AI training database. The server uses this data to train an AI learning model, analyzing the characteristics and patterns of vulnerabilities. The AI ​​model analyzes the impact, similar past cases, and the characteristics of the affected software, and updates the model accordingly.

[1095] The server analyzes the generated SBOM and extracts version information for each software component. It then compares this information with vulnerability data learned by the AI ​​to detect matching vulnerabilities. For matched vulnerabilities, an evaluation is conducted based on risk level and past incidents. For example, if "Apache 2.4.48" corresponds to "CVE-2021-41773," the risk level and scope of impact are evaluated in detail.

[1096] The evaluation results are generated as a report and saved in formats such as PDF and HTML. Users are also notified in real time. Email and dedicated applications are used as notification methods. For example, an alert stating "A critical vulnerability (CVE-2021-41773) has been discovered" might be sent.

[1097] Users can review reports generated through their devices to gain detailed information about system vulnerabilities. This allows them to take appropriate measures and report issues to higher management. Specifically, they can create meeting materials based on the report content and explain the current security risks to management.

[1098] Hardware and software to be used

[1099] Hardware: Smartphones, smart glasses, head-mounted displays, robots

[1100] Software: Python 3.x, requests (web crawler), JSON (data processing), smtplib (email sending)

[1101] Specific example

[1102] As a concrete example, a user launches an application and enters "Apache 2.4.48" and "OpenSSL 1.1.1k". The application generates an SBOM from this information. A web crawler collects vulnerability data from sites such as "https: / / examplevulnerabilities.com / data1". The SBOM is compared with the collected vulnerability data to detect relevant vulnerabilities and perform a risk assessment. A risk report is sent to the user via email to notify them that a critical vulnerability has been found.

[1103] Example of a prompt:

[1104] "My system has Apache 2.4.48 and OpenSSL 1.1.1k installed. Please check for vulnerabilities in these versions and generate a risk report."

[1105] This makes it possible to quickly and efficiently collect and analyze vulnerability information and notify users in real time.

[1106] The flow of a specific process in Application Example 1 will be explained using Figure 12.

[1107] Step 1:

[1108] Users install a dedicated application and log in to the system from their device. They access the system login screen on their device and enter their authentication information to authenticate access to the system. This generates a user ID and a token for accessing the system information input screen.

[1109] Input: User authentication information

[1110] Output: User ID, Access Token

[1111] Step 2:

[1112] The user enters system information through a dedicated application. They enter the software name and version information and send it to the server. This information may include details such as "Apache 2.4.48" or "OpenSSL 1.1.1k". This information is sent to the server in JSON format.

[1113] Input: Software name, version information

[1114] Output: System information in JSON format

[1115] Step 3:

[1116] The server generates Software Base of Management (SBOM) information based on the received system information. The server parses the received JSON data and extracts the name and version information of each software. This is then saved as an SBOM in a structured data format (JSON or XML).

[1117] Input: System information in JSON format

[1118] Output: SBOM (Structured Data)

[1119] Step 4:

[1120] The server periodically activates a web crawler to collect vulnerability-related information. Target sites include security information sites and vulnerability databases (e.g., "https: / / examplevulnerabilities.com / data1"). The crawler visits each site and retrieves vulnerability information.

[1121] Input: URL of the security information site

[1122] Output: List of vulnerability information

[1123] Step 5:

[1124] The collected vulnerability information is stored in an AI training database. The server analyzes the vulnerability information list and saves it as training data for the AI ​​model. This ensures that the AI ​​model is trained based on the latest vulnerability information.

[1125] Input: List of vulnerability information

[1126] Output: AI learning database

[1127] Step 6:

[1128] The server compares the collected vulnerability information with the SBOM and performs a risk assessment. It matches the version information of each software component in the SBOM with the vulnerability information. If a relevant vulnerability is found, it evaluates the degree of risk and the scope of impact.

[1129] Input: SBOM, vulnerability information

[1130] Output: Risk assessment results

[1131] Step 7:

[1132] The evaluation results are generated as a report and provided to the user. The server creates the report based on the risk assessment results and saves it in formats such as PDF or HTML. The report is sent to the user via email.

[1133] Input: Risk assessment results

[1134] Output: Reports (PDF or HTML), email notifications

[1135] Step 8:

[1136] If a critical vulnerability is detected, users will be notified in real time. Based on the risk assessment results, the server generates alert notifications according to the severity of the vulnerability. Email and push notifications via a dedicated application are used as notification methods.

[1137] Input: Risk assessment results

[1138] Output: Alert notifications (email, push notifications)

[1139] This allows users to receive vulnerability information in real time and respond quickly. As a concrete example, if a user enters "Apache 2.4.48" and "OpenSSL 1.1.1k", the system will collect and analyze vulnerability information related to them, perform a risk assessment, and immediately notify the user.

[1140] Furthermore, an emotion engine that estimates the user's emotions may be incorporated. That is, the identification processing unit 290 may use the emotion identification model 59 to estimate the user's emotions and perform identification processing using the user's emotions.

[1141] This invention aims to further improve a system that collects customer system information and efficiently manages, analyzes, and reports vulnerability information by combining it with an emotion engine that recognizes user emotions. The main components of this system include means for inputting customer system information, means for generating software configuration information (SBOM), means for collecting vulnerability-related information using a web crawler, means for storing and analyzing the collected information in an AI learning database, means for performing risk assessment, means for generating and providing the assessment results as a report to the user, and an emotion engine that recognizes user emotions.

[1142] Enter customer system information and generate SBOM

[1143] User

[1144] The user logs into the system from their terminal using a web browser or a dedicated application. Next, they enter the name and version information of the software installed on the system. For example, they might enter information such as "Apache 2.4.48" or "OpenSSL 1.1.1k".

[1145] server

[1146] The server generates a Software Configuration Map (SBOM) based on system information provided by the user. This SBOM is stored in a structured data format such as JSON or XML and includes the names, versions, and dependencies of each software within the system.

[1147] Collection of vulnerability information

[1148] server

[1149] The server periodically runs a web crawler to collect vulnerability-related information from security information sites and vulnerability databases (such as JVN and NVD) on the internet. The collected information is stored in the server's vulnerability information database. This database includes information such as CVE numbers, scope of impact, mitigation methods, and release dates.

[1150] Learning and analysis of vulnerability information

[1151] server

[1152] The server retrieves the latest data from the vulnerability information database and feeds it to an AI learning model. The AI ​​model learns from the retrieved vulnerability information and analyzes the characteristics and patterns of vulnerabilities. The analysis includes factors such as impact, similar past cases, and characteristics of affected software.

[1153] Matching SBOM with vulnerability data and risk assessment

[1154] server

[1155] The server analyzes the generated SBOM and extracts version information for each software component. The server then compares the extracted version information with learned vulnerability data to detect the corresponding vulnerabilities. It assesses the risk of the detected vulnerabilities and performs a detailed evaluation based on the scope of impact and the degree of risk. For example, if "Apache 2.4.48" corresponds to "CVE-2021-41773", the server will perform a detailed evaluation of its risk level and scope of impact.

[1156] Emotion recognition and report generation / delivery

[1157] server

[1158] The server is equipped with an emotion engine that recognizes user emotions. This emotion engine determines user emotions in real time through facial recognition and voice analysis. The results of this emotion recognition are reflected in how reports are displayed, the timing of alert notifications, and their content.

[1159] For example, if a user is experiencing stress, the report display will be simplified and focused on the most urgent information. Additionally, if it's determined that the user is not in a state to calmly receive information, the alert notification will be softened and resent later.

[1160] Provision of evaluation results and alert notifications

[1161] server

[1162] The server generates a report based on the evaluation results and saves it in the specified format (such as PDF or HTML). If necessary, an alert notification is sent to the user. Based on the emotion engine, alerts are sent at a timing and in a manner appropriate to the user's emotional state. For example, an immediate notification is sent in an emergency, but the notification is delayed if the user is feeling stressed.

[1163] User

[1164] Users review reports generated through their devices to gain detailed information about system vulnerabilities. Based on the report, users consider appropriate countermeasures and report to higher management. For example, they might use the report to create meeting materials or presentations to explain the current security risks to management.

[1165] Thus, the system of the present invention can manage and provide vulnerability information more appropriately and effectively by recognizing and considering the user's emotions.

[1166] The following describes the processing flow.

[1167] Step 1:

[1168] User

[1169] Users log in to the system from their terminal using a web browser or a dedicated application.

[1170] Step 2:

[1171] User

[1172] After logging in, the user enters the name and version information of the software installed on the system.

[1173] For example, enter information such as "Apache 2.4.48" or "OpenSSL 1.1.1k".

[1174] Step 3:

[1175] server

[1176] The server receives system information entered by the user and generates Software Bill of Materials (SBOM). The SBOM is stored in structured data format such as JSON or XML.

[1177] Step 4:

[1178] server

[1179] The server periodically activates a web crawler to collect vulnerability-related information. Target sites include security information sites and vulnerability databases (e.g., JVN and NVD).

[1180] Step 5:

[1181] server

[1182] The collected vulnerability information is stored in a vulnerability database on the server. The database includes information such as the CVE number, scope of impact, mitigation methods, and release date.

[1183] Step 6:

[1184] server

[1185] The server retrieves the latest data from the vulnerability information database and feeds it to the AI ​​learning model.

[1186] Step 7:

[1187] server

[1188] The AI ​​model learns from the acquired vulnerability information and analyzes the characteristics and patterns of vulnerabilities. Specifically, it analyzes the impact, similar past cases, and the characteristics of the affected software.

[1189] Step 8:

[1190] server

[1191] The server analyzes the generated SBOM and extracts version information for each software component.

[1192] Step 9:

[1193] server

[1194] The server compares the extracted version information with the learned vulnerability data to detect the corresponding vulnerabilities.

[1195] Step 10:

[1196] server

[1197] The detected vulnerabilities are assessed for their risk, and a detailed evaluation is conducted based on the scope of impact and the degree of risk. For example, if "Apache 2.4.48" corresponds to "CVE-2021-41773", the degree of risk and the scope of impact are evaluated in detail.

[1198] Step 11:

[1199] server

[1200] The server activates an emotion engine that recognizes the user's emotions and determines the user's emotional state in real time. The emotion engine analyzes emotions through the user's facial recognition and voice analysis.

[1201] Step 12:

[1202] server

[1203] Based on the emotion engine, the report generation process takes the user's emotional state into account when generating reports based on evaluation results. For example, if the user is stressed, the report display will be simplified and focus on more urgent information.

[1204] Step 13:

[1205] server

[1206] The server saves the generated report in a specified format (such as PDF or HTML) and sends alert notifications at a time appropriate to the user's emotional state based on the emotion engine. For example, it can send an immediate notification in an emergency, or postpone notifications if the user is feeling stressed.

[1207] Step 14:

[1208] User

[1209] Users can review reports generated through their devices to gain detailed information about system vulnerabilities.

[1210] Step 15:

[1211] User

[1212] Users consider appropriate countermeasures based on the report and report to higher management. For example, they might create meeting materials or presentations based on the report to explain the current security risks to management.

[1213] (Example 2)

[1214] Next, we will describe Example 2. In the following description, the data processing device 12 will be referred to as the "server," and the headset-type terminal 314 will be referred to as the "terminal."

[1215] In conventional systems, vulnerability management based on customer system information was insufficient, making it difficult to collect vulnerability information, assess risks, and propose appropriate countermeasures. Furthermore, responses did not take into account the user's feelings, making it challenging to provide appropriate information when users were experiencing stress or anxiety.

[1216] The identification processing performed by the identification processing unit 290 of the data processing device 12 in Example 2 is realized by the following means. In this invention, the server includes means for inputting customer system information, means for generating software configuration information based on the input system information, means for collecting vulnerability-related information using a web crawler, means for storing and analyzing the collected vulnerability information in a learning database, means for comparing the software configuration information and vulnerability data and evaluating the risk, means for recognizing the user's emotions, and means for generating the evaluation results as a report and providing it while taking the user's emotions into consideration. This enables efficient management of vulnerability information, risk assessment, and appropriate information provision while taking the user's emotions into consideration.

[1217] "Customer system information" refers to the software and hardware configuration information related to the systems used by the customer.

[1218] "Software configuration information" refers to detailed information including the names, versions, and dependencies of the software installed on the customer's system.

[1219] A "web crawler" refers to a program that automatically visits websites on the internet to collect information.

[1220] "Vulnerability-related information" refers to information about security flaws and vulnerabilities present in software and systems.

[1221] A "training database" refers to a database where AI learning models store vulnerability information for analysis and learning purposes.

[1222] "Risk assessment" refers to the process of evaluating the impact and risks that a particular vulnerability may have on a system.

[1223] "Means of recognizing emotions" refers to technologies that analyze a user's facial expressions and voice in real time to determine their emotional state.

[1224] "Means of providing information as a report" refers to functions that provide users with easily understandable information such as risk assessment results and vulnerability information.

[1225] This invention relates to a system that efficiently manages customer system information, collects, analyzes, and assesses vulnerability information, and provides information while considering user sentiment. This system is implemented using multiple hardware and software components to achieve both user convenience and information accuracy.

[1226] First, the user accesses the system from their terminal using a web browser or a dedicated application. They enter their user ID and password on the login screen, and upon successful authentication, they are redirected to the dashboard. On the dashboard, they enter the name and version information of the installed software (e.g., "Apache 2.4.48") into a dedicated form and click the "Submit" button. This information is then sent to the server.

[1227] The server receives software information sent by the user and generates Software Base of Memory (SBOM) based on it. Specifically, it converts the received software name and version information into JSON format and saves it, including dependency information. For example, the information is saved in a JSON format like the following:

[1228] json

[1229] {

[1230] "components": [

[1231] {

[1232] "name": "Apache",

[1233] "version": "2.4.48",

[1234] "dependencies": ["mod_ssl"]

[1235] },

[1236] {

[1237] "name": "OpenSSL",

[1238] "version": "1.1.1k",

[1239] "dependencies": []

[1240] }

[1241] ]

[1242] }

[1243] Next, the server periodically starts a web crawler based on a pre-configured schedule. The web crawler collects the latest vulnerability information from security information sites and vulnerability databases on the internet (e.g., JVN and NVD). The collected information is stored in the vulnerability information database and includes information such as the CVE number, scope of impact, mitigation methods, and release date. For example, new CVE information is stored as follows:

[1244] json

[1245] {

[1246] "CVE-2021-41773": {

[1247] "impact": "High",

[1248] "description": "Path traversal vulnerability in Apache 2.4.48.",

[1249] "fix": "Upgrade to Apache 2.4.49 or later."

[1250] }

[1251] }

[1252] Subsequently, the server retrieves the latest data from the vulnerability information database and feeds it into a pre-built generative AI model. The generative AI model learns the characteristics and patterns of vulnerabilities using past vulnerability data and newly acquired data. As a result of the learning, the impact and similar past cases are analyzed. For example, it is clearly indicated which past cases "CVE-2021-41773" is similar to and what the degree of impact is.

[1253] The server analyzes the generated SBOM and extracts version information for each software component. It then compares the extracted version information with the analyzed vulnerability data to detect any vulnerabilities. For example, if "Apache 2.4.48" corresponds to "CVE-2021-41773," the server performs a detailed assessment of its impact and risk level. This assessment result is saved as detailed risk analysis data.

[1254] Furthermore, the server is equipped with an emotion engine that recognizes the user's emotions. The emotion engine determines the user's emotional state in real time through facial expression recognition and voice analysis as the user interacts with the system. For example, if the camera identifies the user's face and determines that they are experiencing stress, the content and display method of the report will be adjusted accordingly.

[1255] The server generates a report based on the risk assessment results and saves it in the specified format (such as PDF or HTML). If necessary, it sends alert notifications at a time appropriate to the user's emotional state. For example, if the user is feeling stressed, the notification will be delayed and alerts will be sent at an appropriate time.

[1256] Users review reports generated through their devices to gain detailed information about system vulnerabilities. Based on the report, they consider appropriate countermeasures and report to higher management. For example, they might create meeting materials or presentations to explain the current security risks to management.

[1257] In this way, this system achieves more effective security measures by managing and providing vulnerability information while taking user emotions into consideration.

[1258] The flow of the specific processing in Example 2 will be explained using Figure 13.

[1259] Step 1: Log in to the system and enter system information.

[1260] The user accesses the system by launching a web browser or dedicated application using their terminal. They enter their user ID and password on the login screen (input). Upon successful authentication, they are redirected to the dashboard. On the dashboard, the user enters the name and version information of the installed software into a dedicated form and clicks the "Submit" button (input). This information is sent to the server (output).

[1261] Step 2: Generate Software Configuration Information (SBOM)

[1262] The server receives software information sent by the user (input). Based on the received software information, it generates software configuration information (SBOM) (data processing). Specifically, it converts the input software name and version information into JSON format and saves it, including dependencies (output). As an example, the following JSON structure is generated.

[1263] json

[1264] {

[1265] "components": [

[1266] {

[1267] "name": "Apache",

[1268] "version": "2.4.48",

[1269] "dependencies": ["mod_ssl"]

[1270] },

[1271] {

[1272] "name": "OpenSSL",

[1273] "version": "1.1.1k",

[1274] "dependencies": []

[1275] }

[1276] ]

[1277] }

[1278] Step 3: Gather vulnerability information

[1279] The server periodically starts the web crawler based on a pre-configured schedule (startup). The web crawler collects the latest vulnerability information from security information sites and vulnerability databases on the internet (e.g., JVN and NVD) (input). The collected information is stored in the vulnerability information database on the server (output).

[1280] Step 4: Learning and analyzing vulnerability information

[1281] The server retrieves the latest data from a vulnerability information database (input). It feeds the retrieved data into a pre-built generative AI model, which learns the characteristics and patterns of vulnerabilities (data computation). Specifically, it analyzes factors such as impact and similar past cases, and generates new vulnerability information as a result of the analysis (output).

[1282] Step 5: Matching SBOM with vulnerability data and risk assessment

[1283] The server analyzes the generated SBOM and extracts version information for each software component (input). It then compares the extracted version information with the analyzed vulnerability data (data calculation). For example, if "Apache 2.4.48" corresponds to "CVE-2021-41773", the degree of risk and the scope of impact are evaluated (output).

[1284] Step 6: Emotion recognition and report generation / delivery

[1285] The server is equipped with an emotion engine that recognizes the user's emotions. The emotion engine analyzes the user's facial expressions and voice in real time as they operate the system and recognizes their emotional state (input). Based on this information, a report including risk assessment results is generated, but the content and display method of the report are adjusted according to the user's emotional state (data processing and output).

[1286] Step 7: Provision of evaluation results and alert notifications

[1287] The server generates a report based on the risk assessment results and saves it in a format (such as PDF or HTML) (output). It also adjusts the timing of alert notifications according to the user's emotional state. For example, if the user is stressed, less urgent notifications are delayed (data processing and output). The user reviews the generated report through their terminal to understand detailed information about system vulnerabilities. Based on the report content, they consider appropriate countermeasures and report to higher levels (output).

[1288] (Application Example 2)

[1289] Next, we will explain application example 2. In the following explanation, the data processing device 12 will be referred to as the "server," and the headset-type terminal 314 will be referred to as the "terminal."

[1290] Traditional vulnerability management systems often caused stress and burden on users because, when collecting customer system information, analyzing vulnerability data, and providing reports, they did not consider the user's emotional state when displaying notifications or reports. Furthermore, even in situations requiring urgent security measures, notifications were not provided at an appropriate time based on the user's situation, potentially delaying countermeasures. There is a need to address these issues and provide a more user-friendly vulnerability management system.

[1291] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means.

[1292] In this invention, the server includes means for inputting customer computer system information, means for generating software configuration information based on the input computer system information, means for collecting vulnerability-related information using a web crawler, means for storing and analyzing the collected vulnerability information in an AI learning database, means for comparing the software configuration information with the vulnerability data and evaluating the risk, means for generating the evaluation results as a report and providing it to the terminal user, and an emotion engine that recognizes the terminal user's emotions and adjusts the method of displaying reports and providing alert notifications. This enables flexible report display and alert notifications according to the terminal user's emotional state.

[1293] "Customer computer system information" refers to software and hardware information related to the computer system used by the customer.

[1294] "Software configuration information" refers to information that includes the names, versions, and dependencies of software installed on a computer system.

[1295] A "web crawler" is software that automatically collects information from the internet.

[1296] "Vulnerability-related information" refers to information about security flaws and risks present in software and systems.

[1297] An "AI training database" is a database that stores data used to train artificial intelligence models.

[1298] An "emotion engine" is a technology that determines a user's emotional state in real time through facial recognition and voice analysis.

[1299] "Risk assessment" is the process of evaluating the impact and risks to a computer system based on collected vulnerability information.

[1300] A "report" is a collection of documents and information that summarizes the results of a risk assessment and provides them to terminal users.

[1301] An "alert notification" is a notification that alerts or warns the device user when certain conditions are met.

[1302] A "terminal user" refers to an individual or organizational representative who uses this system.

[1303] As an example of this invention's application, consider a vulnerability management application called "Secure Guardian." This application collects customer computer system information, analyzes vulnerability information, and provides a risk assessment report. It is installed and used on smartphones.

[1304] Hardware and software usage

[1305] The server uses a high-performance cloud server (for example, AWS EC2), and the user's terminal is a smartphone (iPhone or Android device).

[1306] On the server side, the following software and technologies are used:

[1307] 1. Web crawler: Use BeautifulSoup or Scrapy to collect vulnerability information.

[1308] 2. AI Learning Model: Analyze vulnerability data using TensorFlow or PyTorch.

[1309] 3. Emotion Engine: OpenCV or DeepFace is used for face recognition, and Google Cloud Speech-to-Text is used for speech recognition.

[1310] Application features and operation

[1311] 1. Input of computer system information and generation of SBOM

[1312] Terminal users enter the name and version information of the software they are using through a smartphone application. Based on this information, the server automatically generates Software Base of Memory (SBOM) in JSON or XML format.

[1313] 2. Collection of vulnerability information

[1314] The server periodically runs a web crawler to collect the latest vulnerability-related information from internet vulnerability databases (such as JVN and NVD). The collected information is stored in the vulnerability information database.

[1315] 3. Learning and analyzing vulnerability information

[1316] The server-side AI learning model obtains the latest data from a vulnerability information database and performs training. This allows it to analyze the characteristics and impact of vulnerabilities and generate prediction results.

[1317] 4. Matching SBOM with vulnerability data and risk assessment

[1318] The server analyzes the generated SBOM and compares the version information of each software component with vulnerability data. This allows it to detect relevant vulnerabilities and perform a risk assessment.

[1319] 5. Emotion recognition and reporting

[1320] The system uses the smartphone's camera and microphone to recognize the user's emotions in real time. OpenCV and DeepFace are used for facial recognition, and Google Cloud Speech-to-Text is used for speech analysis. The display of reports and the timing of alert notifications are adjusted according to the user's emotional state.

[1321] 6. Provision of evaluation results and alert notifications

[1322] Based on the risk assessment results, the server generates a report and provides it to the terminal user in PDF or HTML format. Using an emotion engine, alert notifications are sent at the appropriate time according to the user's emotional state.

[1323] Examples of specific cases and prompt statements

[1324] As a concrete example, a company's security officer installs "Secure Guardian" and uses the application to input a list of software used within the company. Then, based on the SBOM generated by the server, the system collects the latest vulnerability information and automatically performs a risk assessment. Furthermore, if an officer is experiencing high stress levels, the system is configured to notify them later, allowing them to view a detailed report once they have calmed down.

[1325] Example of a prompt:

[1326] "Use SecureGuardian to input system vulnerability information for Apache 2.4.48 and OpenSSL 1.1.1k. Collect the latest vulnerability information and generate a risk assessment report. Utilize sentiment recognition to delay notifications if stress levels are high, allowing users to calmly review the detailed report."

[1327] The flow of a specific process in Application Example 2 will be explained using Figure 14.

[1328] Step 1:

[1329] Users log in using a smartphone application. They enter the name and version information of the software they are using. This data is sent to the server and becomes the source data for generating Software Configuration Information (SBOM).

[1330] Step 2:

[1331] The server generates Software Base of Memory (SBOM) in JSON or XML format based on the received software information. Data processing involves organizing software names and version information, and constructing dependencies between software components. This SBOM is then used to verify vulnerability information later on.

[1332] Step 3:

[1333] The server periodically activates a web crawler to collect the latest vulnerability information from internet vulnerability databases (e.g., JVN and NVD). The collected vulnerability information is stored in an internal database. Data processing involves parsing and saving the collected information.

[1334] Step 4:

[1335] The server retrieves the latest vulnerability information from a vulnerability database and feeds it to an AI learning model. The generated AI learning model is used to analyze the characteristics and impact of vulnerabilities. It receives vulnerability data as input and generates vulnerability risk assessment information as output.

[1336] Step 5:

[1337] The server compares the generated SBOM with vulnerability data to detect matching vulnerabilities. It then performs a risk assessment of the matched vulnerabilities and outputs information on their impact and mitigation methods. Data processing includes version information matching and risk level calculation.

[1338] Step 6:

[1339] The server analyzes user emotion information obtained from smartphones. It uses the device's camera and microphone for facial recognition and voice analysis to recognize emotions in real time. The results of emotion recognition are reflected in subsequent reports and alert notifications.

[1340] Step 7:

[1341] The server generates a report based on the risk assessment results and provides it to the user in PDF or HTML format. The report's display method is adjusted based on the emotion engine's results. For example, if the user is stressed, the report is displayed concisely; if they are calm, detailed information is provided.

[1342] Step 8:

[1343] The server will send alert notifications at the appropriate time based on the user's emotional state. In urgent cases, notifications will be sent immediately, while notifications will be delayed if the user is experiencing stress. For example, even if an urgent vulnerability is discovered, if the user is stressed, the notification will be sent only after they have calmed down.

[1344] The specific processing unit 290 transmits the result of the specific processing to the headset terminal 314. In the headset terminal 314, the control unit 46A causes the speaker 240 and display 343 to output the result of the specific processing. The microphone 238 acquires audio indicating user input for the result of the specific processing. The control unit 46A transmits the audio data indicating user input acquired by the microphone 238 to the data processing unit 12. In the data processing unit 12, the specific processing unit 290 acquires the audio data.

[1345] Data generation model 58 is a type of so-called generative AI (Artificial Intelligence). One example of data generation model 58 is ChatGPT (Internet search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search) <url: https: gemini.google.com ?hl="ja">Examples of generative AI include the following. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 is input with prompts containing instructions, and with inference data such as audio data representing speech, text data representing text, and image data representing images. The data generation model 58 infers from the input inference data according to the instructions indicated by the prompts, and outputs the inference results in data formats such as audio data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[1346] In the above embodiment, an example was given in which specific processing is performed by the data processing device 12, but the technology of this disclosure is not limited thereto, and specific processing may also be performed by the headset terminal 314.

[1347] [Fourth Embodiment]

[1348] Figure 7 shows an example of the configuration of the data processing system 410 according to the fourth embodiment.

[1349] As shown in Figure 7, the data processing system 410 includes a data processing device 12 and a robot 414. An example of the data processing device 12 is a server.

[1350] The data processing device 12 comprises a computer 22, a database 24, and a communication interface 26. The computer 22 is an example of a "computer" related to the technology of this disclosure. The computer 22 comprises a processor 28, RAM 30, and storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication interface 26 are also connected to the bus 34. The communication interface 26 is connected to a network 54. An example of the network 54 is a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[1351] The robot 414 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication interface 44, and a controlled object 443. The computer 36 includes a processor 46, RAM 48, and storage 50. The processor 46, RAM 48, and storage 50 are connected to a bus 52. The microphone 238, speaker 240, camera 42, and controlled object 443 are also connected to the bus 52.

[1352] The microphone 238 receives voice signals from the user 20 and receives instructions from the user 20. The microphone 238 captures the voice signals from the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to the instructions from the processor 46.

[1353] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an image sensor such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the area around the user 20 (for example, an imaging range defined by a field of view equivalent to the width of a typical healthy person's field of vision).

[1354] Communication interface 44 is connected to network 54. Communication interfaces 44 and 26 are responsible for the exchange of various information between processor 46 and processor 28 via network 54. The exchange of various information between processor 46 and processor 28 using communication interfaces 44 and 26 is performed in a secure manner.

[1355] The controlled object 443 includes a display device, LEDs in the eyes, and motors that drive the arms, hands, and feet. The posture and gestures of the robot 414 are controlled by controlling the motors of the arms, hands, and feet. Some of the robot 414's emotions can be expressed by controlling these motors. Furthermore, the robot 414's facial expressions can also be expressed by controlling the illumination state of the LEDs in its eyes.

[1356] Figure 8 shows an example of the main functions of the data processing device 12 and the robot 414. As shown in Figure 8, the data processing device 12 performs specific processing using the processor 28. The storage 32 stores the specific processing program 56.

[1357] The specific processing program 56 is an example of a "program" relating to the technology of this disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[1358] The storage 32 stores the data generation model 58 and the emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[1359] In robot 414, the processor 46 performs the reception output processing. The storage 50 stores the reception output program 60. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output processing is realized by the processor 46 operating as a control unit 46A according to the reception output program 60 executed on the RAM 48.

[1360] Next, the specific processing performed by the specific processing unit 290 of the data processing device 12 will be described. In the following description, the data processing device 12 will be referred to as the "server" and the robot 414 as the "terminal".

[1361] This invention provides a system for efficiently collecting, analyzing, and reporting vulnerability information of information systems. The main components of this system are means for inputting customer system information, means for generating software configuration information (SBOM), means for collecting vulnerability-related information using a web crawler, means for storing and analyzing the information in an AI learning database, means for evaluating the risks, and means for generating the evaluation results as a report and providing it to the user.

[1362] Enter customer system information and generate SBOM

[1363] User

[1364] The first step a user should take is to enter system information. After logging into the system using a web browser or dedicated application from a terminal, they should enter the names and version information of the installed software. For example, they should enter information such as "Apache 2.4.48" or "OpenSSL 1.1.1k".

[1365] server

[1366] The server generates Software Bill of Materials (SBOM) based on information provided by the user. This SBOM is stored in a structured data format (such as JSON or XML) and includes the names, versions, and dependencies of each software within the system.

[1367] Collection of vulnerability information

[1368] server

[1369] Next, the server periodically runs a web crawler to collect vulnerability-related information from the internet. Target sites include security information sites and vulnerability databases (e.g., JVN and NVD). The collected data is stored in a vulnerability information database. This database includes information such as CVE numbers, scope of impact, mitigation methods, and release dates.

[1370] Learning and analysis of vulnerability information

[1371] server

[1372] The collected vulnerability information is stored in an AI training database, and the server uses this data to train an AI learning model. The AI ​​model learns and analyzes the characteristics and patterns of vulnerabilities. Specifically, it analyzes the impact, similar past cases, and the characteristics of affected software, and updates the model accordingly.

[1373] Matching SBOM with vulnerability data and risk assessment

[1374] server

[1375] The server analyzes the generated SBOM and extracts version information for each software component. It then compares this information with vulnerability data learned by the AI ​​to detect any matching vulnerabilities. For any matching vulnerabilities, an evaluation is conducted based on the degree of risk and past incidents. For example, if "Apache 2.4.48" corresponds to "CVE-2021-41773," the degree of risk and the scope of impact are evaluated in detail.

[1376] Provision of evaluation results and alert notifications

[1377] server

[1378] The server generates a report based on the evaluation results and saves it in the specified format (such as PDF or HTML). If necessary, alert notifications are sent to the user. Email or a dedicated application are used as notification methods. For example, an alert might be sent stating, "A critical vulnerability (CVE-2021-41773) has been discovered."

[1379] User

[1380] Users can review reports generated through their devices to gain detailed information about system vulnerabilities. This allows them to take appropriate measures or report to higher management. For example, they can use the report content to create meeting materials and explain the current security risks to management.

[1381] Thus, the system of the present invention starts by inputting customer system information and generating software configuration information, and through a series of processes including vulnerability information collection, learning, analysis, risk assessment, and provision of assessment results, it is possible to efficiently and quickly manage vulnerability information and take appropriate countermeasures.

[1382] The following describes the processing flow.

[1383] Step 1:

[1384] User

[1385] Users log in to the system from their terminal using a web browser or a dedicated application.

[1386] Step 2:

[1387] User

[1388] The user enters the name and version information of the software installed on the system.

[1389] For example, enter information such as "Apache 2.4.48" or "OpenSSL 1.1.1k".

[1390] Step 3:

[1391] server

[1392] The server receives system information entered by the user and generates a Software Configuration Map (SBOM). The SBOM is stored in a structured data format such as JSON or XML and includes the name, version, and dependencies of each software.

[1393] Step 4:

[1394] server

[1395] The server periodically activates a web crawler to collect vulnerability-related information from security information sites and vulnerability databases (such as JVN and NVD).

[1396] Step 5:

[1397] server

[1398] The collected vulnerability information is stored in a vulnerability database on the server. This database includes information such as the CVE number, scope of impact, mitigation methods, and release date.

[1399] Step 6:

[1400] server

[1401] The server retrieves the latest data from the vulnerability information database and feeds it to the AI ​​learning model.

[1402] Step 7:

[1403] server

[1404] The AI ​​model learns from acquired vulnerability information and analyzes the characteristics and patterns of vulnerabilities. This analysis includes factors such as impact, similar past cases, and characteristics of affected software.

[1405] Step 8:

[1406] server

[1407] The server analyzes the generated SBOM and extracts version information for each software component.

[1408] Step 9:

[1409] server

[1410] The server compares the extracted version information with the learned vulnerability data to detect the corresponding vulnerabilities.

[1411] Step 10:

[1412] server

[1413] We assess the risks associated with the detected vulnerabilities and conduct a detailed evaluation based on the scope of impact and the degree of risk.

[1414] Step 11:

[1415] server

[1416] The server generates a report based on the evaluation results. This report is saved in formats such as PDF or HTML.

[1417] Step 12:

[1418] server

[1419] If necessary, alert notifications will be sent to the user. Notification methods include email and dedicated applications.

[1420] For example, an alert might be sent stating, "A critical vulnerability (CVE-2021-41773) has been discovered."

[1421] Step 13:

[1422] User

[1423] Users can review reports generated through their devices to gain detailed information about system vulnerabilities.

[1424] Step 14:

[1425] User

[1426] Users consider appropriate measures based on the report content and report to higher management. For example, they might create meeting materials or presentations based on the report.

[1427] (Example 1)

[1428] Next, we will describe Example 1. In the following description, the data processing device 12 will be referred to as the "server" and the robot 414 as the "terminal".

[1429] Modern information systems utilize numerous software components, each potentially containing vulnerabilities. However, manually collecting and analyzing this vulnerability information and taking appropriate countermeasures is extremely difficult. Furthermore, a lack of vulnerability risk assessment and prompt notification to users significantly compromises system security. Therefore, there is a need for a system that efficiently collects and analyzes vulnerability information and provides appropriate countermeasures.

[1430] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 1 is realized by the following means.

[1431] In this invention, the server includes means for inputting customer information, means for generating configuration information based on the input information, means for collecting vulnerability-related information using a web crawler, means for storing and analyzing the collected vulnerability information in a machine learning database, means for comparing the configuration information with vulnerability data and evaluating the risk, means for generating the evaluation results as a report and providing it to the user, means for the user to input detailed system information using a terminal, means for saving the evaluation results in a specific format, and means for sending alerts using email or a dedicated application as a notification means. This enables the rapid and efficient management of vulnerability information and the presentation of appropriate risk assessments and countermeasures.

[1432] "Customer" refers to the person who receives a service or product.

[1433] "Information" refers to a collection of data, knowledge, reports, or other forms of facts or insights.

[1434] "Configuration information" refers to data that details the names, versions, and dependencies of each software component within a system.

[1435] A "web crawler" refers to a software program that automatically visits websites on the internet and collects information.

[1436] "Vulnerability-related information" refers to information about vulnerabilities in software and system security, countermeasures against them, and the scope of their impact.

[1437] A "machine learning database" refers to a database used by AI and machine learning models to learn from collected data.

[1438] "Vulnerability data" refers to a dataset containing detailed information about each vulnerability that has been collected.

[1439] "Risk" refers to vulnerabilities or other dangerous elements that could potentially affect a system.

[1440] A "report" refers to a document that organizes specific information and provides it in a standardized format.

[1441] A "terminal" refers to a computer or other electronic device that a user uses to access a system.

[1442] "Format" refers to the rules or protocols that define the arrangement and structure of information and data.

[1443] An "alert" refers to a notification that immediately informs users of urgent or important information.

[1444] This invention provides a system for efficiently collecting, analyzing, and reporting vulnerability information of information systems. The main components of this system are means for inputting customer information, means for generating configuration information, means for collecting vulnerability-related information using a web crawler, means for storing and analyzing the information in a machine learning database, means for evaluating the risks, and means for generating the evaluation results as a report and providing it to the user.

[1445] Customers input information and generate configuration information.

[1446] User

[1447] The first step a user should take is to enter system information. After logging into the system using a dedicated application or web browser from a terminal, the user enters the names and version information of the installed software. For example, the user might enter "Apache 2.4.48" or "OpenSSL 1.1.1k" into the text box, then confirm the entered information and press the submit button.

[1448] server

[1449] The server receives information provided by the user and generates a Software Bill of Materials (SBOM) based on it. The SBOM is stored in JSON or XML format and contains the name, version, and dependencies of each software program. For example, the generated JSON file might include data such as:

[1450] json

[1451] {

[1452] "software_components": [

[1453] {

[1454] "name": "Apache",

[1455] "version": "2.4.48",

[1456] "dependencies": []

[1457] },

[1458] {

[1459] "name": "OpenSSL",

[1460] "version": "1.1.1k",

[1461] "dependencies": []

[1462] }

[1463] ]

[1464] }

[1465] Collection of vulnerability information

[1466] server

[1467] The server periodically launches a web crawler to collect vulnerability-related information from the internet. The crawler visits security information sites and vulnerability databases (e.g., JVN and NVD). The collected information is stored in the vulnerability information database, recording information such as the CVE number, scope of impact, mitigation methods, and release date for each vulnerability.

[1468] Learning and analysis of vulnerability information

[1469] server

[1470] The collected vulnerability information is stored in a machine learning database, and the server uses this data to train an AI learning model. Specifically, a neural network model is used to analyze the data and integrate the characteristics and patterns of vulnerabilities into the model. For example, the model is periodically updated by learning about impact, similar past cases, and the characteristics of affected software.

[1471] Matching configuration information with vulnerability data and risk assessment

[1472] server

[1473] The server analyzes the generated SBOM and extracts version information for each software component. Based on this information, the AI ​​model compares it with learned vulnerability data to identify the corresponding vulnerabilities. For example, it compares "Apache 2.4.48" with "CVE-2021-41773" and performs a risk assessment. Past cases and the scope of impact are also considered in the risk assessment.

[1474] Provision of evaluation results and alert notifications

[1475] server

[1476] The server generates a report of the risk assessment results and saves it in a specified format (such as PDF or HTML). If a critical vulnerability is found, an alert notification is sent to the user. The notification is sent via email or a dedicated application. For example, an alert stating "A critical vulnerability (CVE-2021-41773) has been discovered" might be sent.

[1477] User

[1478] Users can use their terminals to review reports provided by the server and understand detailed system vulnerability information. This allows them to take appropriate countermeasures quickly. For example, it is possible to create meeting materials based on the report content and explain the current security risks to management.

[1479] Example of a prompt

[1480] For example, possible prompts for a generative AI model include the following:

[1481] Please provide the latest vulnerability information regarding "Apache 2.4.48".

[1482] Thus, the system of the present invention can efficiently and quickly manage vulnerability information and provide users with information to take appropriate countermeasures.

[1483] The flow of the specific processing in Example 1 will be explained using Figure 11.

[1484] Step 1:

[1485] The user enters system information.

[1486] Users log in to the system from their terminal using a dedicated application or web browser. After logging in, they enter the names and version information of the installed software. For example, they might enter "Apache 2.4.48" or "OpenSSL 1.1.1k" and send that information to the server. This input is performed manually by the user.

[1487] Input: User-entered software name and version information

[1488] Output: Software information sent to the server

[1489] Step 2:

[1490] The server generates Software Configuration Information (SBOM).

[1491] The server receives software name and version information sent by the user and generates Software Bill of Materials (SBOM) based on this information. The SBOM is stored in a structured data format (such as JSON or XML) that details the name, version, and dependencies of each software. For example, it generates corresponding JSON data based on the information for "Apache 2.4.48".

[1492] Input: Software information submitted by the user

[1493] Output: Generated SBOM (JSON or XML file)

[1494] Step 3:

[1495] The server collects vulnerability information.

[1496] The server periodically activates a web crawler to collect vulnerability-related information from the internet. The crawler visits security information sites and vulnerability databases (e.g., JVN and NVD), extracts the latest vulnerability information, and stores it in the vulnerability information database. The collected information includes the CVE number, scope of impact, mitigation methods, and release date for each vulnerability.

[1497] Input: None (It is launched periodically)

[1498] Output: Latest vulnerability information stored in the vulnerability information database

[1499] Step 4:

[1500] The server learns and analyzes vulnerability information.

[1501] The server stores the collected vulnerability information in a machine learning database and uses this to train an AI learning model. The learning process uses a neural network model to analyze factors such as impact, past occurrences, and the characteristics of affected software. For example, the AI ​​model learns vulnerability occurrence patterns to improve prediction accuracy.

[1502] Input: Data stored in the vulnerability information database

[1503] Output: Trained AI learning model

[1504] Step 5:

[1505] The server performs matching of SBOM and vulnerability data and risk assessment.

[1506] The server analyzes the generated SBOM and extracts version information for each software component. Based on this information, the AI ​​model compares it with learned vulnerability data to detect relevant vulnerabilities. For example, it might compare "Apache 2.4.48" with "CVE-2021-41773" and perform a risk assessment. The risk assessment also takes into account the impact and similar past cases.

[1507] Input: Generated SBOM, trained AI learning model

[1508] Output: Risk assessment results

[1509] Step 6:

[1510] The server provides evaluation results and sends alert notifications.

[1511] The server generates a report based on the risk assessment results and saves it in a specified format (such as PDF or HTML). If a critical vulnerability is found as a result of the assessment, an alert notification is sent to the user. The notification is sent via email or a dedicated application. For example, an alert might be sent stating, "A critical vulnerability (CVE-2021-41773) has been discovered."

[1512] Input: Risk assessment results

[1513] Output: Generated reports, sent alert notifications

[1514] Step 7:

[1515] Users can view the evaluation results.

[1516] Users can use their terminals to review reports provided by the server and understand detailed system vulnerability information. This allows them to take appropriate countermeasures quickly. For example, they can use the report content to create meeting materials and explain the current security risks to management.

[1517] Input: Provided report

[1518] Output: Implementation of countermeasures, creation of meeting materials

[1519] Through this series of processing steps, it is possible to efficiently and quickly manage vulnerability information and provide users with information to take appropriate countermeasures.

[1520] (Application Example 1)

[1521] Next, we will explain Application Example 1. In the following explanation, the data processing device 12 will be referred to as the "server" and the robot 414 as the "terminal".

[1522] Modern information systems are complex, making it difficult to quickly and efficiently grasp information about software vulnerabilities. This can lead to delays in discovering vulnerabilities and implementing appropriate countermeasures. Furthermore, there is a lack of means to notify users of assessment results in real time and encourage prompt action.

[1523] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 1 is realized by the following means.

[1524] In this invention, the server includes means for inputting customer system information, means for generating software configuration information based on the input system information, means for collecting vulnerability-related information using a web crawler, means for storing and analyzing the collected vulnerability information in an AI learning database, means for comparing the software configuration information and vulnerability data to evaluate the risk, means for generating the evaluation results as a report and providing it to the user, and means for notifying the user of the evaluation results in real time. This makes it possible to quickly and efficiently collect, analyze, and notify the user of vulnerability information in real time.

[1525] "Customer system information" refers to configuration and setting information related to the information systems used by the user, including software names and version information.

[1526] "Software configuration information" refers to information that represents the name, version, and dependencies of each installed software in a structured data format.

[1527] A "web crawler" is a program that automatically collects information from the internet and is used to obtain data from vulnerability information sites and vulnerability databases.

[1528] "Vulnerability-related information" refers to information about security holes and flaws in systems and software, including CVE numbers, scope of impact, and countermeasures.

[1529] An "AI learning database" is a database that stores collected vulnerability information and is used for training and analyzing AI models.

[1530] "Assessing risk" is the process of analyzing the degree of risk and scope of impact that a particular vulnerability poses to a user's system, based on vulnerability information matched with software configuration information.

[1531] "Generating and providing a report to the user" means creating the evaluation results in a document format (e.g., PDF or HTML) and providing it to the user.

[1532] "Notifying users in real time" refers to a means of immediately communicating information to users when a vulnerability is discovered, and includes notifications made via email or dedicated applications, for example.

[1533] This invention is a vulnerability management system specifically designed for security services. This system takes customer system information as input, analyzes the collected vulnerability-related information using AI, and provides it to the user in real time.

[1534] First, the user installs a dedicated application and logs into the system from their device. Next, the user enters their system information. For example, they enter the software name and version information, such as "Apache 2.4.48" or "OpenSSL 1.1.1k".

[1535] The entered information is sent to the server and generated as Software Bill of Materials (SBOM). The SBOM is stored as structured data such as JSON or XML. The SBOM contains detailed information such as the name, version, and dependencies of each software.

[1536] Next, the server periodically runs a web crawler to collect vulnerability-related information from the internet. The target sites are security information sites and vulnerability databases. The collected data is stored in the vulnerability information database and includes CVE numbers, scope of impact, mitigation methods, and release dates.

[1537] The collected vulnerability information is stored in an AI training database. The server uses this data to train an AI learning model, analyzing the characteristics and patterns of vulnerabilities. The AI ​​model analyzes the impact, similar past cases, and the characteristics of the affected software, and updates the model accordingly.

[1538] The server analyzes the generated SBOM and extracts version information for each software component. It then compares this information with vulnerability data learned by the AI ​​to detect matching vulnerabilities. For matched vulnerabilities, an evaluation is conducted based on risk level and past incidents. For example, if "Apache 2.4.48" corresponds to "CVE-2021-41773," the risk level and scope of impact are evaluated in detail.

[1539] The evaluation results are generated as a report and saved in formats such as PDF and HTML. Users are also notified in real time. Email and dedicated applications are used as notification methods. For example, an alert stating "A critical vulnerability (CVE-2021-41773) has been discovered" might be sent.

[1540] Users can review reports generated through their devices to gain detailed information about system vulnerabilities. This allows them to take appropriate measures and report issues to higher management. Specifically, they can create meeting materials based on the report content and explain the current security risks to management.

[1541] Hardware and software to be used

[1542] Hardware: Smartphones, smart glasses, head-mounted displays, robots

[1543] Software: Python 3.x, requests (web crawler), JSON (data processing), smtplib (email sending)

[1544] Specific example

[1545] As a concrete example, a user launches an application and enters "Apache 2.4.48" and "OpenSSL 1.1.1k". The application generates an SBOM from this information. A web crawler collects vulnerability data from sites such as "https: / / examplevulnerabilities.com / data1". The SBOM is compared with the collected vulnerability data to detect relevant vulnerabilities and perform a risk assessment. A risk report is sent to the user via email to notify them that a critical vulnerability has been found.

[1546] Example of a prompt:

[1547] "My system has Apache 2.4.48 and OpenSSL 1.1.1k installed. Please check for vulnerabilities in these versions and generate a risk report."

[1548] This makes it possible to quickly and efficiently collect and analyze vulnerability information and notify users in real time.

[1549] The flow of a specific process in Application Example 1 will be explained using Figure 12.

[1550] Step 1:

[1551] Users install a dedicated application and log in to the system from their device. They access the system login screen on their device and enter their authentication information to authenticate access to the system. This generates a user ID and a token for accessing the system information input screen.

[1552] Input: User authentication information

[1553] Output: User ID, Access Token

[1554] Step 2:

[1555] The user enters system information through a dedicated application. They enter the software name and version information and send it to the server. This information may include details such as "Apache 2.4.48" or "OpenSSL 1.1.1k". This information is sent to the server in JSON format.

[1556] Input: Software name, version information

[1557] Output: System information in JSON format

[1558] Step 3:

[1559] The server generates Software Base of Management (SBOM) information based on the received system information. The server parses the received JSON data and extracts the name and version information of each software. This is then saved as an SBOM in a structured data format (JSON or XML).

[1560] Input: System information in JSON format

[1561] Output: SBOM (Structured Data)

[1562] Step 4:

[1563] The server periodically activates a web crawler to collect vulnerability-related information. Target sites include security information sites and vulnerability databases (e.g., "https: / / examplevulnerabilities.com / data1"). The crawler visits each site and retrieves vulnerability information.

[1564] Input: URL of the security information site

[1565] Output: List of vulnerability information

[1566] Step 5:

[1567] The collected vulnerability information is stored in an AI training database. The server analyzes the vulnerability information list and saves it as training data for the AI ​​model. This ensures that the AI ​​model is trained based on the latest vulnerability information.

[1568] Input: List of vulnerability information

[1569] Output: AI learning database

[1570] Step 6:

[1571] The server compares the collected vulnerability information with the SBOM and performs a risk assessment. It matches the version information of each software component in the SBOM with the vulnerability information. If a relevant vulnerability is found, it evaluates the degree of risk and the scope of impact.

[1572] Input: SBOM, vulnerability information

[1573] Output: Risk assessment results

[1574] Step 7:

[1575] The evaluation results are generated as a report and provided to the user. The server creates the report based on the risk assessment results and saves it in formats such as PDF or HTML. The report is sent to the user via email.

[1576] Input: Risk assessment results

[1577] Output: Reports (PDF or HTML), email notifications

[1578] Step 8:

[1579] If a critical vulnerability is detected, users will be notified in real time. Based on the risk assessment results, the server generates alert notifications according to the severity of the vulnerability. Email and push notifications via a dedicated application are used as notification methods.

[1580] Input: Risk assessment results

[1581] Output: Alert notifications (email, push notifications)

[1582] This allows users to receive vulnerability information in real time and respond quickly. As a concrete example, if a user enters "Apache 2.4.48" and "OpenSSL 1.1.1k", the system will collect and analyze vulnerability information related to them, perform a risk assessment, and immediately notify the user.

[1583] Furthermore, an emotion engine that estimates the user's emotions may be incorporated. That is, the identification processing unit 290 may use the emotion identification model 59 to estimate the user's emotions and perform identification processing using the user's emotions.

[1584] This invention aims to further improve a system that collects customer system information and efficiently manages, analyzes, and reports vulnerability information by combining it with an emotion engine that recognizes user emotions. The main components of this system include means for inputting customer system information, means for generating software configuration information (SBOM), means for collecting vulnerability-related information using a web crawler, means for storing and analyzing the collected information in an AI learning database, means for performing risk assessment, means for generating and providing the assessment results as a report to the user, and an emotion engine that recognizes user emotions.

[1585] Enter customer system information and generate SBOM

[1586] User

[1587] The user logs into the system from their terminal using a web browser or a dedicated application. Next, they enter the name and version information of the software installed on the system. For example, they might enter information such as "Apache 2.4.48" or "OpenSSL 1.1.1k".

[1588] server

[1589] The server generates a Software Configuration Map (SBOM) based on system information provided by the user. This SBOM is stored in a structured data format such as JSON or XML and includes the names, versions, and dependencies of each software within the system.

[1590] Collection of vulnerability information

[1591] server

[1592] The server periodically runs a web crawler to collect vulnerability-related information from security information sites and vulnerability databases (such as JVN and NVD) on the internet. The collected information is stored in the server's vulnerability information database. This database includes information such as CVE numbers, scope of impact, mitigation methods, and release dates.

[1593] Learning and analysis of vulnerability information

[1594] server

[1595] The server retrieves the latest data from the vulnerability information database and feeds it to an AI learning model. The AI ​​model learns from the retrieved vulnerability information and analyzes the characteristics and patterns of vulnerabilities. The analysis includes factors such as impact, similar past cases, and characteristics of affected software.

[1596] Matching SBOM with vulnerability data and risk assessment

[1597] server

[1598] The server analyzes the generated SBOM and extracts version information for each software component. The server then compares the extracted version information with learned vulnerability data to detect the corresponding vulnerabilities. It assesses the risk of the detected vulnerabilities and performs a detailed evaluation based on the scope of impact and the degree of risk. For example, if "Apache 2.4.48" corresponds to "CVE-2021-41773", the server will perform a detailed evaluation of its risk level and scope of impact.

[1599] Emotion recognition and report generation / delivery

[1600] server

[1601] The server is equipped with an emotion engine that recognizes user emotions. This emotion engine determines user emotions in real time through facial recognition and voice analysis. The results of this emotion recognition are reflected in how reports are displayed, the timing of alert notifications, and their content.

[1602] For example, if a user is experiencing stress, the report display will be simplified and focused on the most urgent information. Additionally, if it's determined that the user is not in a state to calmly receive information, the alert notification will be softened and resent later.

[1603] Provision of evaluation results and alert notifications

[1604] server

[1605] The server generates a report based on the evaluation results and saves it in the specified format (such as PDF or HTML). If necessary, an alert notification is sent to the user. Based on the emotion engine, alerts are sent at a timing and in a manner appropriate to the user's emotional state. For example, an immediate notification is sent in an emergency, but the notification is delayed if the user is feeling stressed.

[1606] User

[1607] Users review reports generated through their devices to gain detailed information about system vulnerabilities. Based on the report, users consider appropriate countermeasures and report to higher management. For example, they might use the report to create meeting materials or presentations to explain the current security risks to management.

[1608] Thus, the system of the present invention can manage and provide vulnerability information more appropriately and effectively by recognizing and considering the user's emotions.

[1609] The following describes the processing flow.

[1610] Step 1:

[1611] User

[1612] Users log in to the system from their terminal using a web browser or a dedicated application.

[1613] Step 2:

[1614] User

[1615] After logging in, the user enters the name and version information of the software installed on the system.

[1616] For example, enter information such as "Apache 2.4.48" or "OpenSSL 1.1.1k".

[1617] Step 3:

[1618] server

[1619] The server receives system information entered by the user and generates Software Bill of Materials (SBOM). The SBOM is stored in structured data format such as JSON or XML.

[1620] Step 4:

[1621] server

[1622] The server periodically activates a web crawler to collect vulnerability-related information. Target sites include security information sites and vulnerability databases (e.g., JVN and NVD).

[1623] Step 5:

[1624] server

[1625] The collected vulnerability information is stored in a vulnerability database on the server. The database includes information such as the CVE number, scope of impact, mitigation methods, and release date.

[1626] Step 6:

[1627] server

[1628] The server retrieves the latest data from the vulnerability information database and feeds it to the AI ​​learning model.

[1629] Step 7:

[1630] server

[1631] The AI ​​model learns from the acquired vulnerability information and analyzes the characteristics and patterns of vulnerabilities. Specifically, it analyzes the impact, similar past cases, and the characteristics of the affected software.

[1632] Step 8:

[1633] server

[1634] The server analyzes the generated SBOM and extracts version information for each software component.

[1635] Step 9:

[1636] server

[1637] The server compares the extracted version information with the learned vulnerability data to detect the corresponding vulnerabilities.

[1638] Step 10:

[1639] server

[1640] The detected vulnerabilities are assessed for their risk, and a detailed evaluation is conducted based on the scope of impact and the degree of risk. For example, if "Apache 2.4.48" corresponds to "CVE-2021-41773", the degree of risk and the scope of impact are evaluated in detail.

[1641] Step 11:

[1642] server

[1643] The server activates an emotion engine that recognizes the user's emotions and determines the user's emotional state in real time. The emotion engine analyzes emotions through the user's facial recognition and voice analysis.

[1644] Step 12:

[1645] server

[1646] Based on the emotion engine, the report generation process takes the user's emotional state into account when generating reports based on evaluation results. For example, if the user is stressed, the report display will be simplified and focus on more urgent information.

[1647] Step 13:

[1648] server

[1649] The server saves the generated report in a specified format (such as PDF or HTML) and sends alert notifications at a time appropriate to the user's emotional state based on the emotion engine. For example, it can send an immediate notification in an emergency, or postpone notifications if the user is feeling stressed.

[1650] Step 14:

[1651] User

[1652] Users can review reports generated through their devices to gain detailed information about system vulnerabilities.

[1653] Step 15:

[1654] User

[1655] Users consider appropriate countermeasures based on the report and report to higher management. For example, they might create meeting materials or presentations based on the report to explain the current security risks to management.

[1656] (Example 2)

[1657] Next, we will describe Example 2. In the following description, the data processing device 12 will be referred to as the "server" and the robot 414 as the "terminal".

[1658] In conventional systems, vulnerability management based on customer system information was insufficient, making it difficult to collect vulnerability information, assess risks, and propose appropriate countermeasures. Furthermore, responses did not take into account the user's feelings, making it challenging to provide appropriate information when users were experiencing stress or anxiety.

[1659] The identification processing performed by the identification processing unit 290 of the data processing device 12 in Example 2 is realized by the following means. In this invention, the server includes means for inputting customer system information, means for generating software configuration information based on the input system information, means for collecting vulnerability-related information using a web crawler, means for storing and analyzing the collected vulnerability information in a learning database, means for comparing the software configuration information and vulnerability data and evaluating the risk, means for recognizing the user's emotions, and means for generating the evaluation results as a report and providing it while taking the user's emotions into consideration. This enables efficient management of vulnerability information, risk assessment, and appropriate information provision while taking the user's emotions into consideration.

[1660] "Customer system information" refers to the software and hardware configuration information related to the systems used by the customer.

[1661] "Software configuration information" refers to detailed information including the names, versions, and dependencies of the software installed on the customer's system.

[1662] A "web crawler" refers to a program that automatically visits websites on the internet to collect information.

[1663] "Vulnerability-related information" refers to information about security flaws and vulnerabilities present in software and systems.

[1664] A "training database" refers to a database where AI learning models store vulnerability information for analysis and learning purposes.

[1665] "Risk assessment" refers to the process of evaluating the impact and risks that a particular vulnerability may have on a system.

[1666] "Means of recognizing emotions" refers to technologies that analyze a user's facial expressions and voice in real time to determine their emotional state.

[1667] "Means of providing information as a report" refers to functions that provide users with easily understandable information such as risk assessment results and vulnerability information.

[1668] This invention relates to a system that efficiently manages customer system information, collects, analyzes, and assesses vulnerability information, and provides information while considering user sentiment. This system is implemented using multiple hardware and software components to achieve both user convenience and information accuracy.

[1669] First, the user accesses the system from their terminal using a web browser or a dedicated application. They enter their user ID and password on the login screen, and upon successful authentication, they are redirected to the dashboard. On the dashboard, they enter the name and version information of the installed software (e.g., "Apache 2.4.48") into a dedicated form and click the "Submit" button. This information is then sent to the server.

[1670] The server receives software information sent by the user and generates Software Base of Memory (SBOM) based on it. Specifically, it converts the received software name and version information into JSON format and saves it, including dependency information. For example, the information is saved in a JSON format like the following:

[1671] json

[1672] {

[1673] "components": [

[1674] {

[1675] "name": "Apache",

[1676] "version": "2.4.48",

[1677] "dependencies": ["mod_ssl"]

[1678] },

[1679] {

[1680] "name": "OpenSSL",

[1681] "version": "1.1.1k",

[1682] "dependencies": []

[1683] }

[1684] ]

[1685] }

[1686] Next, the server periodically starts a web crawler based on a pre-configured schedule. The web crawler collects the latest vulnerability information from security information sites and vulnerability databases on the internet (e.g., JVN and NVD). The collected information is stored in the vulnerability information database and includes information such as the CVE number, scope of impact, mitigation methods, and release date. For example, new CVE information is stored as follows:

[1687] json

[1688] {

[1689] "CVE-2021-41773": {

[1690] "impact": "High",

[1691] "description": "Path traversal vulnerability in Apache 2.4.48.",

[1692] "fix": "Upgrade to Apache 2.4.49 or later."

[1693] }

[1694] }

[1695] Subsequently, the server retrieves the latest data from the vulnerability information database and feeds it into a pre-built generative AI model. The generative AI model learns the characteristics and patterns of vulnerabilities using past vulnerability data and newly acquired data. As a result of the learning, the impact and similar past cases are analyzed. For example, it is clearly indicated which past cases "CVE-2021-41773" is similar to and what the degree of impact is.

[1696] The server analyzes the generated SBOM and extracts version information for each software component. It then compares the extracted version information with the analyzed vulnerability data to detect any vulnerabilities. For example, if "Apache 2.4.48" corresponds to "CVE-2021-41773," the server performs a detailed assessment of its impact and risk level. This assessment result is saved as detailed risk analysis data.

[1697] Furthermore, the server is equipped with an emotion engine that recognizes the user's emotions. The emotion engine determines the user's emotional state in real time through facial expression recognition and voice analysis as the user interacts with the system. For example, if the camera identifies the user's face and determines that they are experiencing stress, the content and display method of the report will be adjusted accordingly.

[1698] The server generates a report based on the risk assessment results and saves it in the specified format (such as PDF or HTML). If necessary, it sends alert notifications at a time appropriate to the user's emotional state. For example, if the user is feeling stressed, the notification will be delayed and alerts will be sent at an appropriate time.

[1699] Users review reports generated through their devices to gain detailed information about system vulnerabilities. Based on the report, they consider appropriate countermeasures and report to higher management. For example, they might create meeting materials or presentations to explain the current security risks to management.

[1700] In this way, this system achieves more effective security measures by managing and providing vulnerability information while taking user emotions into consideration.

[1701] The flow of the specific processing in Example 2 will be explained using Figure 13.

[1702] Step 1: Log in to the system and enter system information.

[1703] The user accesses the system by launching a web browser or dedicated application using their terminal. They enter their user ID and password on the login screen (input). Upon successful authentication, they are redirected to the dashboard. On the dashboard, the user enters the name and version information of the installed software into a dedicated form and clicks the "Submit" button (input). This information is sent to the server (output).

[1704] Step 2: Generate Software Configuration Information (SBOM)

[1705] The server receives software information sent by the user (input). Based on the received software information, it generates software configuration information (SBOM) (data processing). Specifically, it converts the input software name and version information into JSON format and saves it, including dependencies (output). As an example, the following JSON structure is generated.

[1706] json

[1707] {

[1708] "components": [

[1709] {

[1710] "name": "Apache",

[1711] "version": "2.4.48",

[1712] "dependencies": ["mod_ssl"]

[1713] },

[1714] {

[1715] "name": "OpenSSL",

[1716] "version": "1.1.1k",

[1717] "dependencies": []

[1718] }

[1719] ]

[1720] }

[1721] Step 3: Gather vulnerability information

[1722] The server periodically starts the web crawler based on a pre-configured schedule (startup). The web crawler collects the latest vulnerability information from security information sites and vulnerability databases on the internet (e.g., JVN and NVD) (input). The collected information is stored in the vulnerability information database on the server (output).

[1723] Step 4: Learning and analyzing vulnerability information

[1724] The server retrieves the latest data from a vulnerability information database (input). It feeds the retrieved data into a pre-built generative AI model, which learns the characteristics and patterns of vulnerabilities (data computation). Specifically, it analyzes factors such as impact and similar past cases, and generates new vulnerability information as a result of the analysis (output).

[1725] Step 5: Matching SBOM with vulnerability data and risk assessment

[1726] The server analyzes the generated SBOM and extracts version information for each software component (input). It then compares the extracted version information with the analyzed vulnerability data (data calculation). For example, if "Apache 2.4.48" corresponds to "CVE-2021-41773", the degree of risk and the scope of impact are evaluated (output).

[1727] Step 6: Emotion recognition and report generation / delivery

[1728] The server is equipped with an emotion engine that recognizes the user's emotions. The emotion engine analyzes the user's facial expressions and voice in real time as they operate the system and recognizes their emotional state (input). Based on this information, a report including risk assessment results is generated, but the content and display method of the report are adjusted according to the user's emotional state (data processing and output).

[1729] Step 7: Provision of evaluation results and alert notifications

[1730] The server generates a report based on the risk assessment results and saves it in a format (such as PDF or HTML) (output). It also adjusts the timing of alert notifications according to the user's emotional state. For example, if the user is stressed, less urgent notifications are delayed (data processing and output). The user reviews the generated report through their terminal to understand detailed information about system vulnerabilities. Based on the report content, they consider appropriate countermeasures and report to higher levels (output).

[1731] (Application Example 2)

[1732] Next, we will explain application example 2. In the following explanation, the data processing device 12 will be referred to as the "server" and the robot 414 as the "terminal".

[1733] Traditional vulnerability management systems often caused stress and burden on users because, when collecting customer system information, analyzing vulnerability data, and providing reports, they did not consider the user's emotional state when displaying notifications or reports. Furthermore, even in situations requiring urgent security measures, notifications were not provided at an appropriate time based on the user's situation, potentially delaying countermeasures. There is a need to address these issues and provide a more user-friendly vulnerability management system.

[1734] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means.

[1735] In this invention, the server includes means for inputting customer computer system information, means for generating software configuration information based on the input computer system information, means for collecting vulnerability-related information using a web crawler, means for storing and analyzing the collected vulnerability information in an AI learning database, means for comparing the software configuration information with the vulnerability data and evaluating the risk, means for generating the evaluation results as a report and providing it to the terminal user, and an emotion engine that recognizes the terminal user's emotions and adjusts the method of displaying reports and providing alert notifications. This enables flexible report display and alert notifications according to the terminal user's emotional state.

[1736] "Customer computer system information" refers to software and hardware information related to the computer system used by the customer.

[1737] "Software configuration information" refers to information that includes the names, versions, and dependencies of software installed on a computer system.

[1738] A "web crawler" is software that automatically collects information from the internet.

[1739] "Vulnerability-related information" refers to information about security flaws and risks present in software and systems.

[1740] An "AI training database" is a database that stores data used to train artificial intelligence models.

[1741] An "emotion engine" is a technology that determines a user's emotional state in real time through facial recognition and voice analysis.

[1742] "Risk assessment" is the process of evaluating the impact and risks to a computer system based on collected vulnerability information.

[1743] A "report" is a collection of documents and information that summarizes the results of a risk assessment and provides them to terminal users.

[1744] An "alert notification" is a notification that alerts or warns the device user when certain conditions are met.

[1745] A "terminal user" refers to an individual or organizational representative who uses this system.

[1746] As an example of this invention's application, consider a vulnerability management application called "Secure Guardian." This application collects customer computer system information, analyzes vulnerability information, and provides a risk assessment report. It is installed and used on smartphones.

[1747] Hardware and software usage

[1748] The server uses a high-performance cloud server (for example, AWS EC2), and the user's terminal is a smartphone (iPhone or Android device).

[1749] On the server side, the following software and technologies are used:

[1750] 1. Web crawler: Use BeautifulSoup or Scrapy to collect vulnerability information.

[1751] 2. AI Learning Model: Analyze vulnerability data using TensorFlow or PyTorch.

[1752] 3. Emotion Engine: OpenCV or DeepFace is used for face recognition, and Google Cloud Speech-to-Text is used for speech recognition.

[1753] Application features and operation

[1754] 1. Input of computer system information and generation of SBOM

[1755] Terminal users enter the name and version information of the software they are using through a smartphone application. Based on this information, the server automatically generates Software Base of Memory (SBOM) in JSON or XML format.

[1756] 2. Collection of vulnerability information

[1757] The server periodically runs a web crawler to collect the latest vulnerability-related information from internet vulnerability databases (such as JVN and NVD). The collected information is stored in the vulnerability information database.

[1758] 3. Learning and analyzing vulnerability information

[1759] The server-side AI learning model obtains the latest data from a vulnerability information database and performs training. This allows it to analyze the characteristics and impact of vulnerabilities and generate prediction results.

[1760] 4. Matching SBOM with vulnerability data and risk assessment

[1761] The server analyzes the generated SBOM and compares the version information of each software component with vulnerability data. This allows it to detect relevant vulnerabilities and perform a risk assessment.

[1762] 5. Emotion recognition and reporting

[1763] The system uses the smartphone's camera and microphone to recognize the user's emotions in real time. OpenCV and DeepFace are used for facial recognition, and Google Cloud Speech-to-Text is used for speech analysis. The display of reports and the timing of alert notifications are adjusted according to the user's emotional state.

[1764] 6. Provision of evaluation results and alert notifications

[1765] Based on the risk assessment results, the server generates a report and provides it to the terminal user in PDF or HTML format. Using an emotion engine, alert notifications are sent at the appropriate time according to the user's emotional state.

[1766] Examples of specific cases and prompt statements

[1767] As a concrete example, a company's security officer installs "Secure Guardian" and uses the application to input a list of software used within the company. Then, based on the SBOM generated by the server, the system collects the latest vulnerability information and automatically performs a risk assessment. Furthermore, if an officer is experiencing high stress levels, the system is configured to notify them later, allowing them to view a detailed report once they have calmed down.

[1768] Example of a prompt:

[1769] "Use SecureGuardian to input system vulnerability information for Apache 2.4.48 and OpenSSL 1.1.1k. Collect the latest vulnerability information and generate a risk assessment report. Utilize sentiment recognition to delay notifications if stress levels are high, allowing users to calmly review the detailed report."

[1770] The flow of a specific process in Application Example 2 will be explained using Figure 14.

[1771] Step 1:

[1772] Users log in using a smartphone application. They enter the name and version information of the software they are using. This data is sent to the server and becomes the source data for generating Software Configuration Information (SBOM).

[1773] Step 2:

[1774] The server generates Software Base of Memory (SBOM) in JSON or XML format based on the received software information. Data processing involves organizing software names and version information, and constructing dependencies between software components. This SBOM is then used to verify vulnerability information later on.

[1775] Step 3:

[1776] The server periodically activates a web crawler to collect the latest vulnerability information from internet vulnerability databases (e.g., JVN and NVD). The collected vulnerability information is stored in an internal database. Data processing involves parsing and saving the collected information.

[1777] Step 4:

[1778] The server retrieves the latest vulnerability information from a vulnerability database and feeds it to an AI learning model. The generated AI learning model is used to analyze the characteristics and impact of vulnerabilities. It receives vulnerability data as input and generates vulnerability risk assessment information as output.

[1779] Step 5:

[1780] The server compares the generated SBOM with vulnerability data to detect matching vulnerabilities. It then performs a risk assessment of the matched vulnerabilities and outputs information on their impact and mitigation methods. Data processing includes version information matching and risk level calculation.

[1781] Step 6:

[1782] The server analyzes user emotion information obtained from smartphones. It uses the device's camera and microphone for facial recognition and voice analysis to recognize emotions in real time. The results of emotion recognition are reflected in subsequent reports and alert notifications.

[1783] Step 7:

[1784] The server generates a report based on the risk assessment results and provides it to the user in PDF or HTML format. The report's display method is adjusted based on the emotion engine's results. For example, if the user is stressed, the report is displayed concisely; if they are calm, detailed information is provided.

[1785] Step 8:

[1786] The server will send alert notifications at the appropriate time based on the user's emotional state. In urgent cases, notifications will be sent immediately, while notifications will be delayed if the user is experiencing stress. For example, even if an urgent vulnerability is discovered, if the user is stressed, the notification will be sent only after they have calmed down.

[1787] The specific processing unit 290 transmits the result of the specific processing to the robot 414. In the robot 414, the control unit 46A causes the speaker 240 and the controlled object 443 to output the result of the specific processing. The microphone 238 acquires audio indicating user input for the result of the specific processing. The control unit 46A transmits the audio data indicating user input acquired by the microphone 238 to the data processing unit 12. In the data processing unit 12, the specific processing unit 290 acquires the audio data.

[1788] Data generation model 58 is a type of so-called generative AI (Artificial Intelligence). One example of data generation model 58 is ChatGPT (Internet search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search) <url: https: gemini.google.com ?hl="ja">Examples of generative AI include the following. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 is input with prompts containing instructions, and with inference data such as audio data representing speech, text data representing text, and image data representing images. The data generation model 58 infers from the input inference data according to the instructions indicated by the prompts, and outputs the inference results in data formats such as audio data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[1789] In the above embodiment, an example was given in which specific processing is performed by the data processing device 12, but the technology of this disclosure is not limited thereto, and the specific processing may also be performed by the robot 414.

[1790] Furthermore, the emotion identification model 59, acting as an emotion engine, may determine the user's emotion according to a specific mapping. Specifically, the emotion identification model 59 may determine the user's emotion according to a specific mapping, which is an emotion map (see Figure 9). Similarly, the emotion identification model 59 may also determine the robot's emotion, and the identification processing unit 290 may perform identification processing using the robot's emotion.

[1791] Figure 9 shows an emotion map 400 in which multiple emotions are mapped. In the emotion map 400, emotions are arranged in concentric circles radiating from the center. The closer to the center of the concentric circles, the more primitive the emotions are located. Further out of the concentric circles, emotions representing states and actions arising from mental states are located. Emotion is a concept that includes feelings and mental states. On the left side of the concentric circles, emotions that are generally generated from reactions occurring in the brain are located. On the right side of the concentric circles, emotions that are generally induced by situational judgment are located. Above and below the concentric circles, emotions that are generally generated from reactions occurring in the brain and induced by situational judgment are located. In addition, the emotion of "pleasure" is located on the upper side of the concentric circles, and the emotion of "displeasure" is located on the lower side. Thus, in the emotion map 400, multiple emotions are mapped based on the structure in which emotions arise, and emotions that are likely to occur simultaneously are mapped close together.

[1792] These emotions are distributed at the 3 o'clock position on the Emotion Map 400, and usually fluctuate between feelings of security and anxiety. In the right half of the Emotion Map 400, situational awareness takes precedence over internal feelings, resulting in a calm impression.

[1793] The inside of the Emotion Map 400 represents inner thoughts, while the outside represents actions. Therefore, the further you go from the outside of the Emotion Map 400, the more visible (expressed in actions) your emotions become.

[1794] Here, human emotions are based on various balances, such as posture and blood sugar levels. When these balances deviate from the ideal, it results in discomfort, and when they approach the ideal, it results in pleasure. Similarly, in robots, cars, motorcycles, etc., emotions can be created based on various balances, such as posture and battery level. When these balances deviate from the ideal, it results in discomfort, and when they approach the ideal, it results in pleasure. The emotion map can be generated, for example, based on Dr. Mitsuyoshi's emotion map (Research on a system for analyzing brain physiological signals of speech emotion recognition and emotion, Tokushima University, doctoral dissertation: https: / / ci.nii.ac.jp / naid / 500000375379). The left half of the emotion map contains emotions belonging to a region called "response," where sensation is dominant. The right half of the emotion map contains emotions belonging to a region called "situation," where situational awareness is dominant.

[1795] The emotion map defines two emotions that promote learning. One is the emotion around the middle of the negative "repentance" and "reflection" on the situation side. In other words, it is when the robot experiences negative emotions such as "I never want to feel this way again" or "I don't want to be scolded again." The other is the emotion around the positive "desire" on the reaction side. In other words, it is when the robot has positive feelings such as "I want more" or "I want to know more."

[1796] The emotion identification model 59 inputs user input into a pre-trained neural network, obtains emotion values ​​representing each emotion shown in the emotion map 400, and determines the user's emotion. This neural network is pre-trained based on multiple training data sets, which are combinations of user input and emotion values ​​representing each emotion shown in the emotion map 400. Furthermore, this neural network is trained so that emotions located close together have similar values, as shown in the emotion map 900 in Figure 10. Figure 10 shows an example where multiple emotions such as "reassured," "calm," and "confident" have similar emotion values.

[1797] The above description primarily focuses on the functions of the data processing device 12 in relation to this disclosure. However, the system related to this disclosure is not necessarily implemented on a server. The system related to this disclosure may be implemented as a general information processing system. This disclosure may be implemented, for example, as a software program that runs on a personal computer or as an application that runs on a smartphone. The method related to this disclosure may be provided to users in SaaS (Software as a Service) format.

[1798] In the above embodiment, an example was given in which a specific process is performed by a single computer 22. However, the technology of this disclosure is not limited thereto, and a distributed processing of the specific process may be performed by multiple computers, including computer 22. For example, a data generation model 58 may be provided in an external device of the data processing device 12, and the external device may generate data according to the input data.

[1799] In the above embodiment, an example was given in which the specific processing program 56 is stored in the storage 32, but the technology of this disclosure is not limited thereto. For example, the specific processing program 56 may be stored in a portable, computer-readable, non-temporary storage medium such as a USB (Universal Serial Bus) memory. The specific processing program 56 stored in the non-temporary storage medium is installed in the computer 22 of the data processing device 12. The processor 28 executes specific processing according to the specific processing program 56.

[1800] Alternatively, the specific processing program 56 may be stored in a storage device such as a server connected to the data processing device 12 via the network 54, and the specific processing program 56 may be downloaded and installed on the computer 22 in response to a request from the data processing device 12.

[1801] Furthermore, it is not necessary to store the entirety of the specific processing program 56 in a storage device such as a server connected to the data processing device 12 via the network 54, or to store the entirety of the specific processing program 56 in the storage 32; it is acceptable to store only a portion of the specific processing program 56.

[1802] The following types of processors can be used as hardware resources to perform specific processing. Examples of processors include a CPU, a general-purpose processor that functions as a hardware resource to perform specific processing by executing software, i.e., a program. Other examples of processors include dedicated electrical circuits, such as FPGAs (Field-Programmable Gate Arrays), PLDs (Programmable Logic Devices), or ASICs (Application Specific Integrated Circuits), which have circuit configurations specifically designed to perform specific processing. All of these processors have built-in or connected memory, and all of them perform specific processing by using memory.

[1803] The hardware resource that performs a specific process may consist of one of these various processors, or it may consist of a combination of two or more processors of the same or different types (for example, a combination of multiple FPGAs, or a combination of a CPU and an FPGA). Alternatively, the hardware resource that performs a specific process may consist of a single processor.

[1804] Examples of configurations using a single processor include, firstly, a configuration in which one or more CPUs and software are combined to form a single processor, and this processor functions as a hardware resource that performs a specific process. Secondly, there is a configuration using a processor that realizes the functions of the entire system, including multiple hardware resources that perform a specific process, on a single IC chip, as exemplified by SoCs (System-on-a-chip). In this way, a specific process is realized using one or more of the above types of processors as hardware resources.

[1805] Furthermore, the hardware structure of these various processors can more specifically utilize electrical circuits that combine circuit elements such as semiconductor devices. Also, the specific processing described above is merely an example. Therefore, it goes without saying that unnecessary steps can be deleted, new steps added, or the processing order rearranged, as long as it does not deviate from the main purpose.

[1806] The descriptions and illustrations presented above are detailed explanations of the technical aspects of this disclosure and are merely examples of the technical aspects. For example, the above descriptions of the structure, function, operation, and effect are examples of the structure, function, operation, and effect of the technical aspects of this disclosure. Therefore, it goes without saying that you may delete unnecessary parts, add new elements, or replace elements in the descriptions and illustrations presented above, as long as you do not deviate from the essence of the technical aspects of this disclosure. Furthermore, in order to avoid confusion and facilitate understanding of the technical aspects of this disclosure, explanations of common technical knowledge and the like that do not require special explanation to enable the implementation of the technical aspects of this disclosure have been omitted from the descriptions and illustrations presented above.

[1807] All documents, patent applications, and technical standards described herein are incorporated by reference to the same extent as if each individual document, patent application, and technical standard were specifically and individually noted to be incorporated by reference.

[1808] The following is further disclosed regarding the embodiments described above.

[1809] (Claim 1)

[1810] A means of entering customer system information,

[1811] A means for generating software configuration information based on input system information,

[1812] A method for collecting vulnerability-related information using a web crawler,

[1813] A means of storing and analyzing collected vulnerability information in an AI learning database,

[1814] A means of comparing software configuration information with vulnerability data to assess risk,

[1815] A system that includes means for generating evaluation results as a report and providing it to the user.

[1816] (Claim 2)

[1817] The system according to claim 1, comprising an AI learning model for analyzing collected vulnerability data.

[1818] (Claim 3)

[1819] The system according to claim 1, comprising means for providing alert notifications based on evaluation results.

[1820] "Example 1"

[1821] (Claim 1)

[1822] Means of entering customer information,

[1823] A means for generating configuration information based on input information,

[1824] A method for collecting vulnerability-related information using a web crawler,

[1825] A means of storing and analyzing collected vulnerability information in a machine learning database,

[1826] A means of comparing configuration information and vulnerability data to assess risk,

[1827] A means of generating evaluation results as a report and providing it to the user,

[1828] A means for the user to use a terminal to input detailed system information,

[1829] A means of saving evaluation results in a specific format,

[1830] As a means of notification, there are methods for sending alerts using email or a dedicated application,

[1831] A system that includes this.

[1832] (Claim 2)

[1833] The system according to claim 1, comprising a machine learning model for analyzing collected vulnerability data.

[1834] (Claim 3)

[1835] The system according to claim 1, comprising means for providing alert notifications based on evaluation results.

[1836] "Application Example 1"

[1837] (Claim 1)

[1838] A means of entering customer system information,

[1839] A means for generating software configuration information based on input system information,

[1840] A method for collecting vulnerability-related information using a web crawler,

[1841] A means of storing and analyzing collected vulnerability information in an AI learning database,

[1842] A means of comparing software configuration information with vulnerability data to assess risk,

[1843] A means of generating evaluation results as a report and providing it to the user,

[1844] A system that includes a means of notifying users of evaluation results in real time.

[1845] (Claim 2)

[1846] The system according to claim 1, comprising an AI learning model for analyzing collected vulnerability data.

[1847] (Claim 3)

[1848] The system according to claim 1, comprising means for sending alert notifications via email based on evaluation results.

[1849] "Example 2 of combining an emotion engine"

[1850] (Claim 1)

[1851] A means of entering customer system information,

[1852] A means for generating software configuration information based on input system information,

[1853] A method for collecting vulnerability-related information using a web crawler,

[1854] A means of storing and analyzing collected vulnerability information in a learning database,

[1855] A means of comparing software configuration information with vulnerability data to assess risk,

[1856] Means of recognizing user emotions,

[1857] A system that generates evaluation results as a report and includes means of providing it while taking user sentiment into consideration.

[1858] (Claim 2)

[1859] The system according to claim 1, comprising a learning model for analyzing collected vulnerability data.

[1860] (Claim 3)

[1861] The system according to claim 1, comprising means for providing alert notifications based on evaluation results.

[1862] "Application example 2 when combining with an emotional engine"

[1863] (Claim 1)

[1864] A means of inputting customer computer system information,

[1865] A means for generating software configuration information based on input computer system information,

[1866] A method for collecting vulnerability-related information using a web crawler,

[1867] A means of storing and analyzing collected vulnerability information in an AI learning database,

[1868] A means of comparing software configuration information with vulnerability data to assess risk,

[1869] A means of generating evaluation results as a report and providing it to the terminal user,

[1870] A system that includes an emotion engine that recognizes the emotions of the device user and adjusts the way reports are displayed and alert notifications are sent.

[1871] (Claim 2)

[1872] The system according to claim 1, comprising a generative AI model for analyzing collected vulnerability data.

[1873] (Claim 3)

[1874] The system according to claim 1, comprising means for an emotion engine to provide alert notifications according to the emotional state of the terminal user based on evaluation results. [Explanation of Symbols]

[1875] 10, 210, 310, 410 Data Processing Systems 12 Data Processing Devices 14 Smart Devices 214 Smart Glasses 314 Headset-type terminal 414 Robots< / url:> < / url:> < / url:> < / url:>

Claims

1. A means of entering customer system information, A means for generating software configuration information based on input system information, A method for collecting vulnerability-related information using a web crawler, A means of storing and analyzing collected vulnerability information in an AI learning database, A means of comparing software configuration information with vulnerability data to assess risk, A system that includes means for generating evaluation results as a report and providing it to the user.

2. The system according to claim 1, comprising an AI learning model for analyzing collected vulnerability data.

3. The system according to claim 1, comprising means for providing alert notifications based on evaluation results.

Images