system

Abstract

We provide the system. [Solution] Means for monitoring the operation of an employee's information processing device, A means for analyzing conversational data collected using a voice input device, Means for detecting abnormalities in the aforementioned operations or conversation data and notifying the administrator, Means for restricting the operation of the information processing device in response to detected anomalies, A system that includes this.

Description

Technical Field

[0001] The technology of the present disclosure relates to a system.

Background Art

[0002] Patent Document 1 discloses a method for controlling a persona chatbot, which is performed by at least one processor, and includes steps of receiving a user utterance, adding the user utterance to a prompt including an instruction sentence related to an explanation of a character of the chatbot, encoding the prompt, and inputting the encoded prompt into a language model to generate a chatbot utterance in response to the user utterance.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] In enterprises, information leakage and harassment by employees have become serious problems. In particular, in small and medium-sized enterprises, it is difficult to introduce expensive security systems, and means for managing these risks in a simple and effective way are required. Also, since there is a shortage of systems that can detect these problems early and respond quickly, it is necessary to improve the safety and productivity in corporate activities.

Means for Solving the Problems

[0005] This invention solves these problems by monitoring the operation of employee information processing devices and conversations using voice input devices, and continuously collecting data. Furthermore, by analyzing the collected data with a cloud computing device, it provides a mechanism to detect abnormal operations and inappropriate conversations and notify administrators in real time. In addition, since the operation of employee information processing devices can be restricted based on the detected abnormalities, it realizes a system that is both secure and flexible.

[0006] An "employee" refers to an individual who belongs to a company or organization and whose purpose is to perform duties.

[0007] "Information processing equipment" refers to any mechanical device that performs data input, processing, and output, and includes computers, smartphones, and other similar devices.

[0008] "Means for monitoring operations" refers to a system that records and analyzes user operations performed on an information processing device.

[0009] "Voice input device" refers to a device for inputting voice data in digital format, and includes microphones, etc.

[0010] "Conversation data" refers to oral communication collected through voice input devices.

[0011] "Means for detecting anomalies and notifying administrators" refers to a system that identifies fraudulent or inappropriate operations or conversations based on pre-set criteria and reports that information to administrators.

[0012] "Means of restricting operation" refers to a mechanism that implements measures to restrict the use of information processing equipment, such as temporarily disabling specific functions or operations.

[0013] A "cloud computing device" refers to a network system that includes remote servers for providing data storage and computing services via the internet.

[0014] "Means of sending warnings in real time" refers to communication methods that send warnings without delay immediately after detecting an anomaly, thereby promptly notifying of the problem. [Brief explanation of the drawing]

[0015] [Figure 1] This is a conceptual diagram showing an example of the configuration of a data processing system according to the first embodiment. [Figure 2] This is a conceptual diagram showing an example of the essential functions of a data processing device and a smart device according to the first embodiment. [Figure 3] This is a conceptual diagram showing an example of the configuration of a data processing system according to the second embodiment. [Figure 4] This is a conceptual diagram showing an example of the main functions of a data processing device and smart glasses according to the second embodiment. [Figure 5] This is a conceptual diagram showing an example of the configuration of a data processing system according to the third embodiment. [Figure 6] This is a conceptual diagram showing an example of the main functions of a data processing device and a headset-type terminal according to the third embodiment. [Figure 7] This is a conceptual diagram showing an example of the configuration of a data processing system according to the fourth embodiment. [Figure 8] This is a conceptual diagram showing an example of the main functions of a data processing device and a robot according to the fourth embodiment. [Figure 9] This shows an emotion map where multiple emotions are mapped. [Figure 10] This shows an emotion map where multiple emotions are mapped. [Figure 11] This is a sequence diagram showing the processing flow of the data processing system in Example 1. [Figure 12] This is a sequence diagram showing the processing flow of the data processing system in Application Example 1. [Figure 13] This is a sequence diagram showing the processing flow of the data processing system in Example 2, which incorporates an emotion engine. [Figure 14]It is a sequence diagram showing the processing flow of a data processing system in Application Example 2 when a sentiment engine is combined.

Embodiments for Carrying Out the Invention

[0016] Hereinafter, an example of an embodiment of a system according to the technology of the present disclosure will be described with reference to the accompanying drawings.

[0017] First, the terms used in the following description will be explained.

[0018] In the following embodiments, a numbered processor (hereinafter simply referred to as "processor") may be a single arithmetic unit or a combination of multiple arithmetic units. Also, the processor may be a single type of arithmetic unit or a combination of multiple types of arithmetic units. Examples of arithmetic units include a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), a GPGPU (General-Purpose computing on Graphics Processing Units), an APU (Accelerated Processing Unit), and the like.

[0019] In the following embodiments, a numbered RAM (Random Access Memory) is a memory in which information is temporarily stored and is used as a work memory by the processor.

[0020] In the following embodiments, a numbered storage is one or more non-volatile storage devices that store various programs and various parameters, etc. Examples of non-volatile storage devices include flash memory (SSD (Solid State Drive)), magnetic disks (e.g., hard disks), or magnetic tapes, etc.

[0021] In the following embodiments, the signed communication interface (I / F) is an interface that includes a communication processor and an antenna, etc. The communication interface manages communication between multiple computers. Examples of communication standards applicable to the communication interface include wireless communication standards such as 5G (5th Generation Mobile Communication System), Wi-Fi (registered trademark), or Bluetooth (registered trademark).

[0022] In the following embodiments, "A and / or B" is synonymous with "at least one of A and B." That is, "A and / or B" means that it may be A alone, or B alone, or a combination of A and B. Furthermore, in this specification, the same concept as "A and / or B" applies when expressing three or more things linked by "and / or."

[0023] [First Embodiment]

[0024] Figure 1 shows an example of the configuration of the data processing system 10 according to the first embodiment.

[0025] As shown in Figure 1, the data processing system 10 includes a data processing device 12 and a smart device 14. An example of the data processing device 12 is a server.

[0026] The data processing device 12 comprises a computer 22, a database 24, and a communication interface 26. The computer 22 is an example of a "computer" related to the technology of this disclosure. The computer 22 comprises a processor 28, RAM 30, and storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication interface 26 are also connected to the bus 34. The communication interface 26 is connected to a network 54. An example of the network 54 is a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0027] The smart device 14 comprises a computer 36, a reception device 38, an output device 40, a camera 42, and a communication interface 44. The computer 36 comprises a processor 46, RAM 48, and storage 50. The processor 46, RAM 48, and storage 50 are connected to a bus 52. The reception device 38, output device 40, and camera 42 are also connected to the bus 52.

[0028] The reception device 38 is equipped with a touch panel 38A and a microphone 38B, etc., and receives user input. The touch panel 38A receives user input by detecting contact with an object (e.g., a pen or finger). The microphone 38B receives user input by detecting the user's voice. The control unit 46A transmits data indicating the user input received by the touch panel 38A and microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the data indicating the user input.

[0029] The output device 40 includes a display 40A and a speaker 40B, and presents data to the user 20 by outputting the data in a form perceptible to the user 20 (e.g., audio and / or text). The display 40A displays visible information such as text and images according to instructions from the processor 46. The speaker 40B outputs audio according to instructions from the processor 46. The camera 42 is a small digital camera equipped with an optical system such as a lens, aperture, and shutter, and an image sensor such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor.

[0030] Communication interface 44 is connected to network 54. Communication interfaces 44 and 26 are responsible for the exchange of various types of information between processor 46 and processor 28 via network 54.

[0031] Figure 2 shows an example of the main functions of the data processing device 12 and the smart device 14.

[0032] As shown in Figure 2, in the data processing device 12, a specific processing is performed by the processor 28. A specific processing program 56 is stored in the storage 32. The specific processing program 56 is an example of a "program" related to the technology of this disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 according to the specific processing program 56 executed on the RAM 30.

[0033] The storage 32 stores the data generation model 58 and the emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0034] In the smart device 14, the processor 46 performs the reception output processing. The storage 50 stores the reception output program 60. The reception output program 60 is used in conjunction with a specific processing program 56 by the data processing system 10. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output processing is realized by the processor 46 operating as a control unit 46A according to the reception output program 60 executed on the RAM 48.

[0035] Next, the specific processing performed by the specific processing unit 290 of the data processing device 12 will be described. In the following description, the data processing device 12 will be referred to as the "server" and the smart device 14 as the "terminal".

[0036] This invention is a system designed to reduce the risk of information leaks and harassment within a company. It aims to monitor employees' operations and conversations on information processing devices and to detect fraudulent or inappropriate behavior at an early stage. The system consists of an information processing device, a server, and an administrator terminal connected to it.

[0037] The terminal records keystrokes, mouse operations, and application usage to monitor user activity in real time. In addition, it collects targeted audio from workplace conversations via a voice input device. This system is designed to record audio data only when specific keywords or phrases are used.

[0038] The server receives operation logs and voice data sent from the terminal and performs analysis using AI technology. Machine learning models are used for the analysis, which improves the accuracy of detecting abnormal behavior based on past cases.

[0039] For example, if a user repeatedly attempts to access a confidential folder that they would not normally access, the server will determine this behavior is abnormal based on the operation logs and immediately send a warning to the administrator's terminal. Similarly, if aggressive remarks or mentions of confidential information are detected in the conversation data, an alert will be sent to the administrator.

[0040] On the other hand, the server will, in response to any detected anomalies, temporarily restrict the terminal's network access or the use of specific functions if necessary. This allows for the immediate suppression of serious data breaches.

[0041] Users receive feedback from administrators and have the opportunity to modify their actions as needed. This can also be used to address issues that stem from misunderstandings and to improve business processes.

[0042] The introduction of this system will enable small and medium-sized businesses to efficiently manage information security and harassment while keeping costs down, which is expected to improve overall corporate safety and productivity.

[0043] The following describes the processing flow.

[0044] Step 1:

[0045] The terminal monitors user activity in real time. This includes keyboard input, mouse movements, and application launch history, and logs any suspicious activity.

[0046] Step 2:

[0047] The device records specific conversations through a voice input device. Based on user permission, the microphone is activated, and if a set keyword appears in the conversation, the audio data is converted to text and recorded.

[0048] Step 3:

[0049] The terminal encrypts and sends operation logs and conversation data to the server. This transmission occurs at regular intervals, but can also be performed immediately if an anomaly occurs.

[0050] Step 4:

[0051] The server analyzes the received data using an AI algorithm. The analysis is performed to identify patterns of abnormal behavior based on a machine learning model using historical datasets.

[0052] Step 5:

[0053] The server detects anomalies based on the analysis results. Upon detection of anomalies, it immediately generates a notification for the administrator and sends an alert via email or dashboard.

[0054] Step 6:

[0055] The server will implement automatic measures, such as restricting the device's internet access, as needed. These restrictions will remain in place until the problem is deemed resolved.

[0056] Step 7:

[0057] Based on the alerts received, administrators conduct interviews with users to confirm the details of the problem and provide feedback. This feedback serves as important guidance for users to correct their behavior.

[0058] (Example 1)

[0059] Next, we will describe Example 1. In the following description, the data processing device 12 will be referred to as the "server," and the smart device 14 will be referred to as the "terminal."

[0060] Information leaks and workplace harassment within companies can significantly undermine organizational safety and a healthy work environment. While early detection and effective countermeasures are crucial, traditional methods have limitations in real-time monitoring and anomaly detection. Therefore, a more accurate and responsive approach is needed.

[0061] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 1 is realized by the following means.

[0062] In this invention, the server includes means for monitoring operations on a user's computing device, means for recording voice data collected using a voice input device based on specific words, and means for detecting anomalies in the operations or voice data and sending warnings to an administrator's computing device. This makes it possible to effectively monitor and respond quickly to risks such as information leaks and harassment.

[0063] "User computing device" refers to an electronic device used by a user to process information and operate.

[0064] A "voice input device" refers to a device used to input voice data into a computer.

[0065] "Audio data" refers to sound information collected through an audio input device.

[0066] "Specific terms" refers to keywords or phrases that have been pre-set as targets for monitoring.

[0067] "Generative AI technology" refers to the technology of analyzing data using machine learning algorithms.

[0068] "Administrative computing equipment" refers to information processing equipment used by system administrators.

[0069] "Abnormal" refers to actions or behaviors that deviate from normal operations or speech patterns.

[0070] "Communication access" refers to the function of exchanging data with the outside world via a network.

[0071] "Immediate notification" refers to the process of sending a warning without delay when an anomaly is detected.

[0072] A "data processing device" refers to a device used to analyze and process data through a computer system.

[0073] This system is designed to reduce the risk of information leaks and harassment, and is intended for implementation within companies. Servers, terminals, and users each play their respective roles in operating the system.

[0074] The terminal functions as the user's computing device. Dedicated monitoring software runs on the terminal, recording the user's keystrokes, mouse operations, and application usage in real time. Through this monitoring, suspicious operations that could potentially lead to information leaks are immediately detected. In addition, the terminal is connected to a voice input device and has the function of collecting workplace conversations based on specific keywords. For example, certain words such as "secret" or "password" can be pre-set, and voice data will be recorded when these words are used in a conversation.

[0075] The server collects operation logs and voice data transmitted from terminals and analyzes them using generative AI technology. This analysis process utilizes machine learning models to detect abnormal behavior based on past cases. When an anomaly is detected, it immediately notifies the administrator's computing device and restricts communication access to the affected terminal as necessary. This function plays a crucial role in ensuring the information security of the company.

[0076] For example, if a user attempts to access many confidential files during non-working hours, the server will detect this as an anomaly and send a warning to the administrator using the following prompt: "Please propose countermeasures for when a user attempts to access a confidential folder more than three times within the specified time frame." Implementing such a system can be expected to improve information security and the work environment.

[0077] This system requires computing and voice input devices as hardware, and utilizes analysis tools powered by generative AI technology as software. Immediate notifications to administrators via prompt messages enhance system responsiveness and support rapid response. This is expected to improve security awareness and operational efficiency throughout the company.

[0078] The flow of the specific processing in Example 1 will be explained using Figure 11.

[0079] Step 1:

[0080] The terminal monitors user activity in real time. Specifically, it records keyboard input, mouse operations, and application usage. All user actions are recorded as input and saved as an operation log. The operation log is initially processed within the terminal for a basic check for any signs of abnormality, and then sent to the server.

[0081] Step 2:

[0082] The terminal collects workplace conversations using a voice input device. Specific keywords and phrases are detected as input. The input audio is recorded as digital audio data and saved only if it matches the specified criteria. Specifically, conversations containing pre-configured keywords such as "secret" or "password" are recorded. This data is also later sent to the server.

[0083] Step 3:

[0084] The server receives operation logs and audio data transmitted from the terminal. This entire received data becomes input to the server. The server analyzes the data using a generative AI model to determine if there is any abnormal behavior. The analysis results highlight operations and conversations that deviate from normal patterns.

[0085] Step 4:

[0086] When the server detects an anomaly, it issues a warning to the administrator's computing device based on the analysis results. The input is the analyzed data, and the output is alert information sent to the administrator. For example, if a user attempts to access confidential files multiple times outside of business hours, the administrator is immediately notified.

[0087] Step 5:

[0088] The server takes necessary actions in response to abnormal behavior. Specifically, it temporarily restricts network access and the use of certain functions on the user's terminal. The input is analytical data indicating abnormal behavior, and the output is the restrictive measures taken.

[0089] Step 6:

[0090] Users receive feedback from administrators and have the opportunity to adjust their behavior. This includes details of problems that occurred and hints to resolve misunderstandings. User input is a review of their own actions, and the expected output is improved work processes.

[0091] Through this series of processing steps, the system can manage the risks of information leakage and harassment with high accuracy and speed.

[0092] (Application Example 1)

[0093] Next, we will explain Application Example 1. In the following explanation, the data processing device 12 will be referred to as the "server," and the smart device 14 will be referred to as the "terminal."

[0094] In recent years, information leaks and harassment within companies have become serious problems, and there is a need to prevent them from occurring in the first place. However, there are limited ways to reduce these risks efficiently and practically without placing an excessive burden on employees' work. Furthermore, there is the challenge of implementing a system that can quickly identify multiple signs of abnormality and allow managers to respond immediately.

[0095] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 1 is realized by the following means.

[0096] In this invention, the server includes means for monitoring procedures on an employee's electronic device, means for analyzing conversational information collected using voice input volume, and means for notifying an administrator's mobile terminal via a communication device. This enables the identification of inappropriate behavior or conversations in real time, allowing administrators to take prompt action.

[0097] "Employee" refers to an individual employed by a company or organization who uses electronic devices to perform their duties.

[0098] "Electronic devices" are devices designed for information processing, and include personal computers, smartphones, and other similar devices.

[0099] A "procedure" refers to a series of operations or actions performed on an electronic device, and is important for tracking user behavior.

[0100] "Voice input volume" refers to the devices and metrics used to collect voice data, and is used to record conversations within the workplace.

[0101] "Conversational information" refers to audio data collected using speech input and analyzed based on specific keywords and phrases.

[0102] "Analysis" is the process of processing collected data and extracting meaningful information from it, and is used for detecting anomalies.

[0103] A "communication device" is a device that has the function of sending and receiving information, and is used to notify administrators of information via the internet or network.

[0104] "Administrator" refers to an individual or organization responsible for monitoring the system and responding to any anomalies.

[0105] A "mobile device" refers to a portable electronic device, such as a smartphone or tablet.

[0106] "Notification" refers to the communication of information that a system uses to inform an administrator of the occurrence of an anomaly.

[0107] "Real-time" means that information processing and notifications are performed with near-simultaneity, and is important in situations where immediacy is required.

[0108] "Inappropriate conduct" refers to operations or actions by employees that violate work-related norms.

[0109] "Responding quickly" refers to a state in which appropriate action can be taken immediately when an abnormality occurs.

[0110] The system that implements this invention consists of a program that monitors the operation and conversation information of employees on electronic devices and detects abnormalities. It mainly uses the following hardware and software.

[0111] The server utilizes cloud services for information processing and data analysis. Specifically, it uses generative AI models such as Amazon SageMaker and Google Cloud AI to analyze collected procedural and conversational information. When detecting data anomalies, it leverages machine learning algorithms based on past patterns, enabling real-time analysis.

[0112] The terminal is an electronic device used by employees that collects conversational information based on the amount of voice input. The collected information is transmitted to the server in real time. The terminal has a built-in communication device and is optimized for smooth communication with the server.

[0113] Administrators, who are also users, receive anomaly notifications from the server via mobile devices such as smartphones. These notifications are sent instantly via communication platforms like Twilio, enabling administrators to respond quickly. This allows for content review and responses from anywhere.

[0114] For example, if an employee attempts to access an inappropriate website multiple times, the server will detect this as an anomaly and send a warning to the administrator's mobile device. In this way, malicious activity can be prevented while simultaneously enhancing the company's information security.

[0115] An example of a prompt to input into a generative AI model is, "Explain how to monitor inappropriate network activity among employees." Using this prompt, the AI ​​can suggest appropriate methods for monitoring behavior.

[0116] The flow of a specific process in Application Example 1 will be explained using Figure 12.

[0117] Step 1:

[0118] The terminal collects operation logs and audio from employees' electronic devices. Input consists of conversational data collected based on each user action (keyboard input, mouse operation) and the amount of voice input. This data is temporarily stored within the terminal and prepared for transmission to the server.

[0119] Step 2:

[0120] The terminal sends the collected operation logs and audio data to the server. The input is the data temporarily stored in step 1, and the output is stored in a database on the cloud. In this process, the terminal performs the action of moving data to the server over the network.

[0121] Step 3:

[0122] The server analyzes the received data. The input consists of operation logs and audio data stored in a cloud database. Using generative AI models and machine learning algorithms, it produces output that detects abnormal behavior and inappropriate conversations. Specifically, this involves comparison with past data patterns and keyword detection.

[0123] Step 4:

[0124] The server sends an alert to the administrator based on the detected anomaly. The input is the anomaly data detected in step 3. The output is the notification message sent to the administrator's mobile device. This process uses a communication platform such as Twilio to provide real-time notifications.

[0125] Step 5:

[0126] The administrator, as a user, receives notifications to confirm anomalies and take action as necessary. The input is the warning message displayed on the administrator's mobile device. The output is the response action (anomaly confirmation and response to the warning). The administrator uses the information from this notification to decide what measures should be taken.

[0127] Furthermore, an emotion engine that estimates the user's emotions may be incorporated. That is, the identification processing unit 290 may use the emotion identification model 59 to estimate the user's emotions and perform identification processing using the user's emotions.

[0128] This invention enables more accurate management of risks such as information leaks and harassment by combining an emotion engine with a system that monitors employee activities. The system consists of terminals, a server, an administrator device, and an emotion engine.

[0129] The terminal monitors user actions and conversations in real time, collecting conversation data using a voice input device in addition to key input and application usage history. The emotion engine recognizes the user's emotions from this voice data and generates emotional information as data for analysis.

[0130] The server receives operation logs, conversation data, and emotion information sent from the terminal. The server analyzes the received data using AI and machine learning models and detects anomalies by comparing it with normal operation patterns. In addition, if the emotions recognized by the emotion engine deviate from the normal working state, this is also used as a factor in determining anomaly detection.

[0131] For example, if a user persistently accesses certain confidential information and the emotion engine simultaneously detects a high stress level, the server will determine this situation to be highly dangerous and immediately send an alert to the administrator. This allows the administrator to quickly understand the situation and take appropriate action.

[0132] Furthermore, the server automatically restricts network access to employee terminals as needed, preventing the risk of information leaks. It also includes features that use emotion-based feedback to help users enjoy a better work environment.

[0133] This system allows companies to improve information security and the quality of their work environment in an integrated manner, and provides the convenience of enabling even small and medium-sized enterprises to achieve this at a low cost.

[0134] The following describes the processing flow.

[0135] Step 1:

[0136] The terminal monitors user activity in real time. It collects information such as keystrokes, mouse operations, and accessed files, and logs any suspicious activity.

[0137] Step 2:

[0138] The device uses a voice input device to collect the user's conversation. If specific keywords are used in the conversation, the voice data is converted into text to generate conversation data.

[0139] Step 3:

[0140] The device uses an emotion engine to analyze the user's emotions from collected conversation data. It analyzes voice tone, speed, intonation, etc., to determine emotional states such as joy, anger, and stress.

[0141] Step 4:

[0142] The device sends operation logs, conversation data, and sentiment information to the server. This data is encrypted for security purposes.

[0143] Step 5:

[0144] The server analyzes the received data using an AI algorithm. It utilizes machine learning models to identify abnormal or risky behaviors by comparing them to normal operating patterns.

[0145] Step 6:

[0146] The server further improves the accuracy of anomaly detection based on user sentiment information. If the emotional state differs significantly from normal, it will be given priority in the risk assessment.

[0147] Step 7:

[0148] The server sends real-time alerts to administrators based on the detection of anomalies or risks. These alerts include specific details of the problem and recommended countermeasures.

[0149] Step 8:

[0150] The server will automatically implement measures such as restricting network access or limiting specific operations on terminals if necessary.

[0151] Step 9:

[0152] Users receive feedback from administrators and use it to improve their situation and adjust their work environment. Emotion-based feedback is utilized, enabling more sophisticated and personalized responses.

[0153] (Example 2)

[0154] Next, we will describe Example 2. In the following description, the data processing device 12 will be referred to as the "server" and the smart device 14 as the "terminal".

[0155] In today's work environment, concerns about risks such as information leaks and harassment necessitate more accurate monitoring of employee behavior and emotional states to prevent risks proactively. Furthermore, there is the challenge of improving the employee work environment to provide a more efficient and comfortable working environment.

[0156] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 2 is realized by the following means.

[0157] In this invention, the server includes means for monitoring the operation of an employee's information processing device, means for analyzing conversation data collected using a voice input device and recognizing emotions, means for detecting abnormalities in the operation or conversation data and recognized emotion information and notifying the administrator, means for restricting the operation of the information processing device in accordance with the detected abnormalities, and means for proposing improvements to the work environment to the employee based on the analysis results. This makes it possible to improve the employee's work environment while detecting and responding to risks such as information leakage and harassment at an early stage.

[0158] An "information processing device" is a device that collects, processes, and analyzes data for use as information.

[0159] "Means of monitoring" refers to a device or program that has a mechanism for observing and recording employee operations and activities in real time.

[0160] "Audio input device" refers to hardware such as microphones used to collect audio data, as well as software to process that data.

[0161] "Conversation data" refers to audio information collected via a voice input device, and represents data indicating the content of the user's statements.

[0162] "Means of analysis" refers to a program or device used to analyze collected data and extract meaning or patterns.

[0163] "Emotion recognition" is the process of estimating, quantifying, or classifying a user's emotional state from audio data.

[0164] "Means for detecting abnormalities" refers to a program or mechanism that identifies and notifies of behavior or conditions that deviate from normal operating patterns.

[0165] "Means of notifying administrators" refers to a system that transmits information about detected anomalies to those responsible for management.

[0166] "Means of limiting operation" refers to a mechanism that reduces or stops the functionality of a device or program when certain conditions are met.

[0167] "Means of proposing improvements to the work environment" refers to a program or system that provides changes or recommendations to improve employee work efficiency and comfort.

[0168] A "server" is a central device or system that manages and processes data in a centralized manner over a network.

[0169] This invention provides a system for monitoring employee activities and managing risks. Its main components include terminals, servers, and an emotion engine.

[0170] The terminal functions as a user information processing device, monitoring operations in real time. Specifically, it records key inputs and application usage history, and collects user conversation data using a voice input device. This voice data is then transferred to the emotion engine.

[0171] The emotion engine is software that analyzes voice data and implements algorithms to detect the user's emotional state. This engine uses voice signal processing technology to quantify emotions such as stress and anxiety, and provides data for analysis.

[0172] The server is a central device that aggregates and analyzes operation logs, conversation data, and sentiment information transmitted from terminals. Using AI models and machine learning algorithms, the server performs anomaly detection. Specifically, it compares the data against normal operation patterns and notifies the administrator if an anomaly is detected. It also determines that an anomaly occurs if the sentiment information deviates from the normal range.

[0173] For example, if a user repeatedly accesses confidential data in a short period of time, and the emotion engine detects a high stress level, the server will consider this situation abnormal and send an alert to the administrator. In this case, the server will restrict the user's network access as needed to reduce the risk of information leakage.

[0174] Furthermore, the server uses employee emotional data to provide feedback for improving the work environment. For example, if a user experiences prolonged periods of high stress, it may display a message suggesting a break, thereby promoting a better work environment.

[0175] By using a generative AI model, the server can quickly and efficiently detect anomalies and provide information to administrators. For example, by entering a prompt such as, "The user is attempting to access the same confidential file multiple times in a short period of time, and the emotion engine has detected high stress levels. Could you please provide a risk assessment for this situation?", the AI ​​will provide an appropriate decision.

[0176] The flow of the specific processing in Example 2 will be explained using Figure 13.

[0177] Step 1:

[0178] The terminal acts as a user information processing device, monitoring keystrokes and application usage history in real time. It receives physical keystrokes and application event logs as input. By collecting this data and storing it in a database, it generates a user operation log.

[0179] Step 2:

[0180] The terminal collects conversational data interactively from the user using a voice input device. It receives voice signals as input and saves them as audio files. This audio data is preprocessed to prepare it for transmission to the emotion engine as voice data.

[0181] Step 3:

[0182] The emotion engine receives audio data transmitted from the device and extracts emotional information using an audio signal analysis algorithm. By taking audio data as input and applying phoneme analysis and emotion recognition algorithms, it outputs stress and emotional states as numerical data. This enables real-time monitoring of the user's emotional state.

[0183] Step 4:

[0184] The server receives operation logs, conversation data, and sentiment information collected from terminals. To analyze this data, it uses AI models and machine learning algorithms to detect anomalies by comparing them to normal patterns. It receives operation logs and sentiment data as input and runs an anomaly detection model to output abnormal conditions.

[0185] Step 5:

[0186] The server notifies the administrator of any detected anomalies. Specifically, it not only displays alert messages on the management screen but also sends them to the administrator via email and SMS. It receives anomaly detection results as input and outputs alerts to the notification system.

[0187] Step 6:

[0188] The server generates feedback suggesting improvements to the user's work environment based on the analyzed emotional information. It receives emotional data and work history as input, and outputs appropriate change suggestions to the user through a feedback algorithm. For example, if prolonged high stress is detected, a message encouraging a break will be displayed on the user's screen.

[0189] (Application Example 2)

[0190] Next, we will explain application example 2. In the following explanation, the data processing device 12 will be referred to as a "server" and the smart device 14 as a "terminal".

[0191] Conventional employee activity monitoring systems lack sufficient means to reduce the risk of information leaks and harassment, particularly in their inadequate real-time anomaly detection and emotion analysis. Furthermore, they fail to provide adequate immediate notifications to managers and proper feedback for improving the work environment.

[0192] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means.

[0193] In this invention, the server includes means for monitoring the operation of an employee's information processing device, means for analyzing conversation data collected using a voice input device, and emotion processing means for analyzing the user's emotions from the operation and conversation data. This enables real-time anomaly detection, reduces the risk of information leakage and harassment through prompt notification to administrators, and contributes to improving the work environment.

[0194] An "employee" is a person who is employed by a company or organization and performs duties.

[0195] An "information processing device" is a general term for any device that can input, process, and output data, and includes computers and smart devices.

[0196] "Means for monitoring operations" refers to technologies and devices for recording and analyzing a series of operations and actions performed on an information processing device used by an employee.

[0197] A "voice input device" is a device used to collect human voice as digital data, and includes a microphone and a dedicated sensor.

[0198] "Conversation data" refers to text data and audio data generated based on human speech collected through voice input devices.

[0199] "Emotional processing means" refers to technologies and devices that analyze audio data and other inputs, recognize the emotions contained within them, and generate them as data.

[0200] "Means for detecting anomalies" refer to technologies and devices for identifying patterns or situations that deviate from normal operations or behaviors and recognizing them as risks.

[0201] "Means of notifying administrators" refers to technologies and devices that quickly transmit information to relevant parties when an anomaly is detected in the system.

[0202] "Means of restricting operation" refers to technologies or devices that restrict the functions of an information processing device or control access to it in order to prevent it from performing fraudulent or dangerous actions.

[0203] A "cloud computing device" is a server or network system that allows data processing and storage to be performed remotely via the internet.

[0204] "Means of sending warnings in real time" refers to technologies and devices that immediately send warning information to administrators when an anomaly occurs.

[0205] "Means of providing feedback" refer to technologies and devices that present areas for improvement and useful information based on the state of the user or system.

[0206] This system aims to detect anomalies and promptly notify administrators by monitoring employee operations on information processing devices and analyzing conversation data in real time. The system mainly consists of terminals, servers, voice input devices, emotion processing engines, and cloud computing devices.

[0207] The terminal is a device for monitoring user actions in real time, collecting conversational data using a voice input device in addition to key input and application usage history. This data is analyzed by an emotion processing engine to recognize the user's emotional state.

[0208] The server receives operation logs, conversation data, and sentiment data sent from the terminal. The received data is analyzed using AI and machine learning models, and anomalies are detected by comparing them to normal operation patterns. If an anomaly is detected, the server sends a warning to the administrator in real time and restricts the operation of the information processing device as necessary. This makes it possible to reduce the risk of information leakage and harassment.

[0209] As a concrete example, in an office environment, if an employee accesses confidential information during normal working hours while exhibiting a high stress level, the emotion processing engine identifies this as abnormal, and the server immediately notifies the administrator. Upon receiving the notification, the administrator can view the details through the system's dashboard and take necessary actions quickly. This enables rapid risk management.

[0210] As an example of a prompt for a generative AI model, you could use the text, "Generate code to detect risk when an employee exhibits typical non-work-related behavior and high levels of stress."

[0211] The flow of a specific process in Application Example 2 will be explained using Figure 14.

[0212] Step 1:

[0213] The terminal monitors user actions and collects input logs and voice input data. This data includes application usage history, keystrokes, and voice data captured from the microphone. This ensures that all monitorable actions and conversation data are entered.

[0214] Step 2:

[0215] The device sends the collected audio data to the emotion processing engine. The emotion processing engine analyzes the audio data and recognizes emotional information. Specifically, it extracts features from the audio data and identifies emotions such as stress and anger using a machine learning model. This results in the output of the emotion analysis results.

[0216] Step 3:

[0217] The server receives operation logs, conversation data, and sentiment information sent from the terminal. The server analyzes the data using AI and machine learning models and detects anomalies by comparing it to normal operation patterns. The input is operation and sentiment data, and the output is information about the presence or absence of anomalies.

[0218] Step 4:

[0219] If the server detects an anomaly, it will notify the administrator in real time. Specifically, the notification system will generate and send alerts via email and to a dedicated dashboard. This provides administrators with the information they need to take immediate action.

[0220] Step 5:

[0221] In response to any anomalies detected by the server, the operation of the information processing device will be restricted. This includes controlling network access and disabling specific functions. These restrictions are implemented to minimize the risk of information leakage and fraudulent activity.

[0222] Step 6:

[0223] Based on the information provided, administrators monitor user behavior and, if necessary, provide direct feedback and make environmental adjustments. At this stage, measures are taken to improve the user's work environment, taking into account the collected sentiment data.

[0224] The specific processing unit 290 transmits the result of the specific processing to the smart device 14. In the smart device 14, the control unit 46A causes the output device 40 to output the result of the specific processing. The microphone 38B acquires audio indicating user input for the result of the specific processing. The control unit 46A transmits the audio data indicating user input acquired by the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0225] Data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of data generation model 58 is ChatGPT (registered trademark) (Internet search).<URL: https: / / openai.com / blog / chatgpt> ), Gemini (registered trademark) (Internet search) <url: https: gemini.google.com ?hl="ja">Examples of generative AI include the following. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 is input with prompts containing instructions, and with inference data such as audio data representing speech, text data representing text, and image data representing images. The data generation model 58 infers from the input inference data according to the instructions indicated by the prompts, and outputs the inference results in data formats such as audio data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0226] In the above embodiment, an example was given in which specific processing is performed by the data processing device 12, but the technology of this disclosure is not limited thereto, and the specific processing may also be performed by the smart device 14.

[0227] [Second Embodiment]

[0228] Figure 3 shows an example of the configuration of the data processing system 210 according to the second embodiment.

[0229] As shown in Figure 3, the data processing system 210 includes a data processing device 12 and smart glasses 214. An example of the data processing device 12 is a server.

[0230] The data processing device 12 comprises a computer 22, a database 24, and a communication interface 26. The computer 22 is an example of a "computer" related to the technology of this disclosure. The computer 22 comprises a processor 28, RAM 30, and storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication interface 26 are also connected to the bus 34. The communication interface 26 is connected to a network 54. An example of the network 54 is a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0231] The smart glasses 214 include a computer 36, a microphone 238, a speaker 240, a camera 42, and a communication interface 44. The computer 36 includes a processor 46, RAM 48, and storage 50. The processor 46, RAM 48, and storage 50 are connected to a bus 52. The microphone 238, speaker 240, and camera 42 are also connected to the bus 52.

[0232] The microphone 238 receives voice signals from the user 20 and receives instructions from the user 20. The microphone 238 captures the voice signals from the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to the instructions from the processor 46.

[0233] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an image sensor such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the area around the user 20 (for example, an imaging range defined by a field of view equivalent to the width of a typical healthy person's field of vision).

[0234] Communication interface 44 is connected to network 54. Communication interfaces 44 and 26 are responsible for the exchange of various information between processor 46 and processor 28 via network 54. The exchange of various information between processor 46 and processor 28 using communication interfaces 44 and 26 is performed in a secure manner.

[0235] Figure 4 shows an example of the main functions of the data processing device 12 and the smart glasses 214. As shown in Figure 4, the data processing device 12 performs specific processing using the processor 28. The storage 32 stores the specific processing program 56.

[0236] The specific processing program 56 is an example of a "program" relating to the technology of this disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0237] The storage 32 stores the data generation model 58 and the emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0238] In the smart glasses 214, the processor 46 performs the reception output processing. The storage 50 stores the reception output program 60. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output processing is realized by the processor 46 operating as a control unit 46A according to the reception output program 60 executed on the RAM 48.

[0239] Next, the identification processing performed by the identification processing unit 290 of the data processing device 12 will be described. In the following description, the data processing device 12 will be referred to as the "server" and the smart glasses 214 will be referred to as the "terminal".

[0240] This invention is a system designed to reduce the risk of information leaks and harassment within a company. It aims to monitor employees' operations and conversations on information processing devices and to detect fraudulent or inappropriate behavior at an early stage. The system consists of an information processing device, a server, and an administrator terminal connected to it.

[0241] The terminal records keystrokes, mouse operations, and application usage to monitor user activity in real time. In addition, it collects targeted audio from workplace conversations via a voice input device. This system is designed to record audio data only when specific keywords or phrases are used.

[0242] The server receives operation logs and voice data sent from the terminal and performs analysis using AI technology. Machine learning models are used for the analysis, which improves the accuracy of detecting abnormal behavior based on past cases.

[0243] For example, if a user repeatedly attempts to access a confidential folder that they would not normally access, the server will determine this behavior is abnormal based on the operation logs and immediately send a warning to the administrator's terminal. Similarly, if aggressive remarks or mentions of confidential information are detected in the conversation data, an alert will be sent to the administrator.

[0244] On the other hand, the server will, in response to any detected anomalies, temporarily restrict the terminal's network access or the use of specific functions if necessary. This allows for the immediate suppression of serious data breaches.

[0245] Users receive feedback from administrators and have the opportunity to modify their actions as needed. This can also be used to address issues that stem from misunderstandings and to improve business processes.

[0246] The introduction of this system will enable small and medium-sized businesses to efficiently manage information security and harassment while keeping costs down, which is expected to improve overall corporate safety and productivity.

[0247] The following describes the processing flow.

[0248] Step 1:

[0249] The terminal monitors user activity in real time. This includes keyboard input, mouse movements, and application launch history, and logs any suspicious activity.

[0250] Step 2:

[0251] The device records specific conversations through a voice input device. Based on user permission, the microphone is activated, and if a set keyword appears in the conversation, the audio data is converted to text and recorded.

[0252] Step 3:

[0253] The terminal encrypts and sends operation logs and conversation data to the server. This transmission occurs at regular intervals, but can also be performed immediately if an anomaly occurs.

[0254] Step 4:

[0255] The server analyzes the received data using an AI algorithm. The analysis is performed to identify patterns of abnormal behavior based on a machine learning model using historical datasets.

[0256] Step 5:

[0257] The server detects anomalies based on the analysis results. Upon detection of anomalies, it immediately generates a notification for the administrator and sends an alert via email or dashboard.

[0258] Step 6:

[0259] The server will implement automatic measures, such as restricting the device's internet access, as needed. These restrictions will remain in place until the problem is deemed resolved.

[0260] Step 7:

[0261] Based on the alerts received, administrators conduct interviews with users to confirm the details of the problem and provide feedback. This feedback serves as important guidance for users to correct their behavior.

[0262] (Example 1)

[0263] Next, we will describe Example 1. In the following description, the data processing device 12 will be referred to as the "server," and the smart glasses 214 will be referred to as the "terminal."

[0264] Information leaks and workplace harassment within companies can significantly undermine organizational safety and a healthy work environment. While early detection and effective countermeasures are crucial, traditional methods have limitations in real-time monitoring and anomaly detection. Therefore, a more accurate and responsive approach is needed.

[0265] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 1 is realized by the following means.

[0266] In this invention, the server includes means for monitoring operations on a user's computing device, means for recording voice data collected using a voice input device based on specific words, and means for detecting anomalies in the operations or voice data and sending warnings to an administrator's computing device. This makes it possible to effectively monitor and respond quickly to risks such as information leaks and harassment.

[0267] "User computing device" refers to an electronic device used by a user to process information and operate.

[0268] A "voice input device" refers to a device used to input voice data into a computer.

[0269] "Audio data" refers to sound information collected through an audio input device.

[0270] "Specific terms" refers to keywords or phrases that have been pre-set as targets for monitoring.

[0271] "Generative AI technology" refers to the technology of analyzing data using machine learning algorithms.

[0272] "Administrative computing equipment" refers to information processing equipment used by system administrators.

[0273] "Abnormal" refers to actions or behaviors that deviate from normal operations or speech patterns.

[0274] "Communication access" refers to the function of exchanging data with the outside world via a network.

[0275] "Immediate notification" refers to the process of sending a warning without delay when an anomaly is detected.

[0276] A "data processing device" refers to a device used to analyze and process data through a computer system.

[0277] This system is designed to reduce the risk of information leaks and harassment, and is intended for implementation within companies. Servers, terminals, and users each play their respective roles in operating the system.

[0278] The terminal functions as the user's computing device. Dedicated monitoring software runs on the terminal, recording the user's keystrokes, mouse operations, and application usage in real time. Through this monitoring, suspicious operations that could potentially lead to information leaks are immediately detected. In addition, the terminal is connected to a voice input device and has the function of collecting workplace conversations based on specific keywords. For example, certain words such as "secret" or "password" can be pre-set, and voice data will be recorded when these words are used in a conversation.

[0279] The server collects the operation logs and voice data transmitted from the terminal and performs analysis using generative AI technology. In this analysis process, a machine learning model is used to detect abnormal behaviors based on past cases. When an abnormality is detected, an immediate notification is sent to the administrator's computer device, and the communication access of the corresponding terminal is restricted if necessary. This function plays an important role in ensuring the information security of the enterprise.

[0280] As a specific example, when a user attempts to access a large number of confidential files during non-business hours, the server determines it as abnormal and sends a warning to the administrator using the following prompt message: "Please propose a countermeasure when the user attempts to access the confidential folder three or more times within the specified time." By introducing such a system, improvement in information security and the workplace environment can be expected.

[0281] This system requires computer devices and voice input devices as hardware, and also uses an analysis tool that utilizes generative AI technology as software. The immediate notification to the administrator by the prompt message enhances the responsiveness of the system and supports prompt responses. As a result, improvement in the security awareness and business efficiency of the entire enterprise is expected.

[0282] The flow of the specific process in Example 1 will be described using FIG. 11.

[0283] Step 1:

[0284] The terminal monitors the user's operations in real time. Specifically, it records key inputs, mouse operations, and the usage status of applications. All operations performed by the user are included as inputs and saved as operation logs. The operation logs are initially processed within the terminal to briefly check for signs of abnormalities and then transmitted to the server.

[0285] Step 2:

[0286] The terminal collects conversations within the workplace using a voice input device. Here, specific keywords and phrases are the targets for input detection. The input voice is recorded as digital voice data and saved only if it meets the conditions. Specifically, conversations containing preset keywords such as "secret" and "password" are recorded. This data is also later sent to the server.

[0287] Step 3:

[0288] The server receives the operation logs and voice data sent from the terminal. The entire received data becomes the input to the server. The server analyzes the data using a generated AI model to determine if there is any abnormal behavior. In the analysis results, operations and conversations deviating from the normal pattern are highlighted.

[0289] Step 4:

[0290] When the server detects an abnormality, it issues a warning to the administrator's computer device based on the analysis results. The input is the analyzed data, and the output is the alert information sent to the administrator. As a specific example, if it is detected that a user attempts to access confidential files multiple times outside of working hours, the administrator is immediately notified.

[0291] Step 5:

[0292] The server takes necessary actions according to the abnormal behavior. Specifically, it temporarily imposes network access restrictions and usage restrictions on specific functions for the corresponding user's terminal. The input is the analysis data indicating the abnormality, and the output is the implementation of restriction measures.

[0293] Step 6:

[0294] The user receives feedback from the administrator and gets an opportunity to adjust their own behavior. This includes details of the problems that occurred and hints for resolving misunderstandings. The user's input is the review of their own behavior, and the output is expected to be an improvement in the business.

[0295] Through this series of processing steps, the system can manage the risks of information leakage and harassment with high accuracy and speed.

[0296] (Application Example 1)

[0297] Next, we will explain Application Example 1. In the following explanation, the data processing device 12 will be referred to as the "server," and the smart glasses 214 will be referred to as the "terminal."

[0298] In recent years, information leaks and harassment within companies have become serious problems, and there is a need to prevent them from occurring in the first place. However, there are limited ways to reduce these risks efficiently and practically without placing an excessive burden on employees' work. Furthermore, there is the challenge of implementing a system that can quickly identify multiple signs of abnormality and allow managers to respond immediately.

[0299] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 1 is realized by the following means.

[0300] In this invention, the server includes means for monitoring procedures on an employee's electronic device, means for analyzing conversational information collected using voice input volume, and means for notifying an administrator's mobile terminal via a communication device. This enables the identification of inappropriate behavior or conversations in real time, allowing administrators to take prompt action.

[0301] "Employee" refers to an individual employed by a company or organization who uses electronic devices to perform their duties.

[0302] "Electronic devices" are devices designed for information processing, and include personal computers, smartphones, and other similar devices.

[0303] A "procedure" refers to a series of operations or actions performed on an electronic device, and is important for tracking user behavior.

[0304] "Voice input volume" refers to the devices and metrics for collecting voice data and is used to record conversations within the workplace.

[0305] "Conversation information" refers to the voice data collected using the voice input volume and is analyzed based on specific keywords and phrases.

[0306] "Analysis" is the process of processing the collected data and extracting meaningful information from it, and is used for detecting abnormalities.

[0307] "Communication device" is a device that has the function of transmitting and receiving information and is used to notify the administrator of information via the Internet or a network.

[0308] "Administrator" refers to an individual or organization responsible for monitoring the system and handling abnormalities.

[0309] "Mobile terminal" is a portable electronic device, such as a smartphone or tablet terminal.

[0310] "Notification" is the information transmission that the system performs to inform the administrator of the occurrence of an abnormality.

[0311] "Real-time" means that information processing and notification are performed almost simultaneously and is important in situations where immediacy is required.

[0312] "Improper behavior" refers to the operations and actions of employees that violate business norms.

[0313] "Respond promptly" refers to a state where appropriate responses can be taken immediately when an abnormality occurs.

[0314] The system that realizes the application example of this invention is composed of a program for monitoring the operations and conversation information in the electronic devices of employees and detecting abnormalities. It mainly uses the following hardware and software.

[0315] The server utilizes cloud services for information processing and data analysis. Specifically, it uses generative AI models such as Amazon SageMaker and Google Cloud AI to analyze collected procedural and conversational information. When detecting data anomalies, it leverages machine learning algorithms based on past patterns, enabling real-time analysis.

[0316] The terminal is an electronic device used by employees that collects conversational information based on the amount of voice input. The collected information is transmitted to the server in real time. The terminal has a built-in communication device and is optimized for smooth communication with the server.

[0317] Administrators, who are also users, receive anomaly notifications from the server via mobile devices such as smartphones. These notifications are sent instantly via communication platforms like Twilio, enabling administrators to respond quickly. This allows for content review and responses from anywhere.

[0318] For example, if an employee attempts to access an inappropriate website multiple times, the server will detect this as an anomaly and send a warning to the administrator's mobile device. In this way, malicious activity can be prevented while simultaneously enhancing the company's information security.

[0319] An example of a prompt to input into a generative AI model is, "Explain how to monitor inappropriate network activity among employees." Using this prompt, the AI ​​can suggest appropriate methods for monitoring behavior.

[0320] The flow of a specific process in Application Example 1 will be explained using Figure 12.

[0321] Step 1:

[0322] The terminal collects operation logs and audio from employees' electronic devices. Input consists of conversational data collected based on each user action (keyboard input, mouse operation) and the amount of voice input. This data is temporarily stored within the terminal and prepared for transmission to the server.

[0323] Step 2:

[0324] The terminal sends the collected operation logs and audio data to the server. The input is the data temporarily stored in step 1, and the output is stored in a database on the cloud. In this process, the terminal performs the action of moving data to the server over the network.

[0325] Step 3:

[0326] The server analyzes the received data. The input consists of operation logs and audio data stored in a cloud database. Using generative AI models and machine learning algorithms, it produces output that detects abnormal behavior and inappropriate conversations. Specifically, this involves comparison with past data patterns and keyword detection.

[0327] Step 4:

[0328] The server sends an alert to the administrator based on the detected anomaly. The input is the anomaly data detected in step 3. The output is the notification message sent to the administrator's mobile device. This process uses a communication platform such as Twilio to provide real-time notifications.

[0329] Step 5:

[0330] The administrator, as a user, receives notifications to confirm anomalies and take action as necessary. The input is the warning message displayed on the administrator's mobile device. The output is the response action (anomaly confirmation and response to the warning). The administrator uses the information from this notification to decide what measures should be taken.

[0331] Furthermore, an emotion engine that estimates the user's emotions may be incorporated. That is, the identification processing unit 290 may use the emotion identification model 59 to estimate the user's emotions and perform identification processing using the user's emotions.

[0332] This invention enables more accurate management of risks such as information leaks and harassment by combining an emotion engine with a system that monitors employee activities. The system consists of terminals, a server, an administrator device, and an emotion engine.

[0333] The terminal monitors user actions and conversations in real time, collecting conversation data using a voice input device in addition to key input and application usage history. The emotion engine recognizes the user's emotions from this voice data and generates emotional information as data for analysis.

[0334] The server receives operation logs, conversation data, and emotion information sent from the terminal. The server analyzes the received data using AI and machine learning models and detects anomalies by comparing it with normal operation patterns. In addition, if the emotions recognized by the emotion engine deviate from the normal working state, this is also used as a factor in determining anomaly detection.

[0335] For example, if a user persistently accesses certain confidential information and the emotion engine simultaneously detects a high stress level, the server will determine this situation to be highly dangerous and immediately send an alert to the administrator. This allows the administrator to quickly understand the situation and take appropriate action.

[0336] Furthermore, the server automatically restricts network access to employee terminals as needed, preventing the risk of information leaks. It also includes features that use emotion-based feedback to help users enjoy a better work environment.

[0337] This system allows companies to improve information security and the quality of their work environment in an integrated manner, and provides the convenience of enabling even small and medium-sized enterprises to achieve this at a low cost.

[0338] The following describes the processing flow.

[0339] Step 1:

[0340] The terminal monitors user activity in real time. It collects information such as keystrokes, mouse operations, and accessed files, and logs any suspicious activity.

[0341] Step 2:

[0342] The device uses a voice input device to collect the user's conversation. If specific keywords are used in the conversation, the voice data is converted into text to generate conversation data.

[0343] Step 3:

[0344] The device uses an emotion engine to analyze the user's emotions from collected conversation data. It analyzes voice tone, speed, intonation, etc., to determine emotional states such as joy, anger, and stress.

[0345] Step 4:

[0346] The device sends operation logs, conversation data, and sentiment information to the server. This data is encrypted for security purposes.

[0347] Step 5:

[0348] The server analyzes the received data using an AI algorithm. It utilizes machine learning models to identify abnormal or risky behaviors by comparing them to normal operating patterns.

[0349] Step 6:

[0350] The server further improves the accuracy of anomaly detection based on user sentiment information. If the emotional state differs significantly from normal, it will be given priority in the risk assessment.

[0351] Step 7:

[0352] The server sends real-time alerts to administrators based on the detection of anomalies or risks. These alerts include specific details of the problem and recommended countermeasures.

[0353] Step 8:

[0354] The server will automatically implement measures such as restricting network access or limiting specific operations on terminals if necessary.

[0355] Step 9:

[0356] Users receive feedback from administrators and use it to improve their situation and adjust their work environment. Emotion-based feedback is utilized, enabling more sophisticated and personalized responses.

[0357] (Example 2)

[0358] Next, we will describe Example 2. In the following description, the data processing device 12 will be referred to as the "server" and the smart glasses 214 will be referred to as the "terminal".

[0359] In today's work environment, concerns about risks such as information leaks and harassment necessitate more accurate monitoring of employee behavior and emotional states to prevent risks proactively. Furthermore, there is the challenge of improving the employee work environment to provide a more efficient and comfortable working environment.

[0360] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 2 is realized by the following means.

[0361] In this invention, the server includes means for monitoring the operation of an employee's information processing device, means for analyzing conversation data collected using a voice input device and recognizing emotions, means for detecting abnormalities in the operation or conversation data and recognized emotion information and notifying the administrator, means for restricting the operation of the information processing device in accordance with the detected abnormalities, and means for proposing improvements to the work environment to the employee based on the analysis results. This makes it possible to improve the employee's work environment while detecting and responding to risks such as information leakage and harassment at an early stage.

[0362] An "information processing device" is a device that collects, processes, and analyzes data for use as information.

[0363] "Means of monitoring" refers to a device or program that has a mechanism for observing and recording employee operations and activities in real time.

[0364] "Audio input device" refers to hardware such as microphones used to collect audio data, as well as software to process that data.

[0365] "Conversation data" refers to audio information collected via a voice input device, and represents data indicating the content of the user's statements.

[0366] "Means of analysis" refers to a program or device used to analyze collected data and extract meaning or patterns.

[0367] "Emotion recognition" is the process of estimating, quantifying, or classifying a user's emotional state from audio data.

[0368] "Means for detecting abnormalities" refers to a program or mechanism that identifies and notifies of behavior or conditions that deviate from normal operating patterns.

[0369] "Means of notifying administrators" refers to a system that transmits information about detected anomalies to those responsible for management.

[0370] "Means of limiting operation" refers to a mechanism that reduces or stops the functionality of a device or program when certain conditions are met.

[0371] "Means of proposing improvements to the work environment" refers to a program or system that provides changes or recommendations to improve employee work efficiency and comfort.

[0372] A "server" is a central device or system that manages and processes data in a centralized manner over a network.

[0373] This invention provides a system for monitoring employee activities and managing risks. Its main components include terminals, servers, and an emotion engine.

[0374] The terminal functions as a user information processing device, monitoring operations in real time. Specifically, it records key inputs and application usage history, and collects user conversation data using a voice input device. This voice data is then transferred to the emotion engine.

[0375] The emotion engine is software that analyzes voice data and implements algorithms to detect the user's emotional state. This engine uses voice signal processing technology to quantify emotions such as stress and anxiety, and provides data for analysis.

[0376] The server is a central device that aggregates and analyzes operation logs, conversation data, and sentiment information transmitted from terminals. Using AI models and machine learning algorithms, the server performs anomaly detection. Specifically, it compares the data against normal operation patterns and notifies the administrator if an anomaly is detected. It also determines that an anomaly occurs if the sentiment information deviates from the normal range.

[0377] For example, if a user repeatedly accesses confidential data in a short period of time, and the emotion engine detects a high stress level, the server will consider this situation abnormal and send an alert to the administrator. In this case, the server will restrict the user's network access as needed to reduce the risk of information leakage.

[0378] Furthermore, the server uses employee emotional data to provide feedback for improving the work environment. For example, if a user experiences prolonged periods of high stress, it may display a message suggesting a break, thereby promoting a better work environment.

[0379] By using a generative AI model, the server can quickly and efficiently detect anomalies and provide information to administrators. For example, by entering a prompt such as, "The user is attempting to access the same confidential file multiple times in a short period of time, and the emotion engine has detected high stress levels. Could you please provide a risk assessment for this situation?", the AI ​​will provide an appropriate decision.

[0380] The flow of the specific processing in Example 2 will be explained using Figure 13.

[0381] Step 1:

[0382] The terminal acts as a user information processing device, monitoring keystrokes and application usage history in real time. It receives physical keystrokes and application event logs as input. By collecting this data and storing it in a database, it generates a user operation log.

[0383] Step 2:

[0384] The terminal collects conversational data interactively from the user using a voice input device. It receives voice signals as input and saves them as audio files. This audio data is preprocessed to prepare it for transmission to the emotion engine as voice data.

[0385] Step 3:

[0386] The emotion engine receives audio data transmitted from the device and extracts emotional information using an audio signal analysis algorithm. By taking audio data as input and applying phoneme analysis and emotion recognition algorithms, it outputs stress and emotional states as numerical data. This enables real-time monitoring of the user's emotional state.

[0387] Step 4:

[0388] The server receives operation logs, conversation data, and sentiment information collected from terminals. To analyze this data, it uses AI models and machine learning algorithms to detect anomalies by comparing them to normal patterns. It receives operation logs and sentiment data as input and runs an anomaly detection model to output abnormal conditions.

[0389] Step 5:

[0390] The server notifies the administrator of any detected anomalies. Specifically, it not only displays alert messages on the management screen but also sends them to the administrator via email and SMS. It receives anomaly detection results as input and outputs alerts to the notification system.

[0391] Step 6:

[0392] The server generates feedback suggesting improvements to the user's work environment based on the analyzed emotional information. It receives emotional data and work history as input, and outputs appropriate change suggestions to the user through a feedback algorithm. For example, if prolonged high stress is detected, a message encouraging a break will be displayed on the user's screen.

[0393] (Application Example 2)

[0394] Next, we will explain application example 2. In the following explanation, the data processing device 12 will be referred to as the "server," and the smart glasses 214 will be referred to as the "terminal."

[0395] Conventional employee activity monitoring systems lack sufficient means to reduce the risk of information leaks and harassment, particularly in their inadequate real-time anomaly detection and emotion analysis. Furthermore, they fail to provide adequate immediate notifications to managers and proper feedback for improving the work environment.

[0396] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means.

[0397] In this invention, the server includes means for monitoring the operation of an employee's information processing device, means for analyzing conversation data collected using a voice input device, and emotion processing means for analyzing the user's emotions from the operation and conversation data. This enables real-time anomaly detection, reduces the risk of information leakage and harassment through prompt notification to administrators, and contributes to improving the work environment.

[0398] An "employee" is a person who is employed by a company or organization and performs duties.

[0399] An "information processing device" is a general term for any device that can input, process, and output data, and includes computers and smart devices.

[0400] "Means for monitoring operations" refers to technologies and devices for recording and analyzing a series of operations and actions performed on an information processing device used by an employee.

[0401] A "voice input device" is a device used to collect human voice as digital data, and includes a microphone and a dedicated sensor.

[0402] "Conversation data" refers to text data and audio data generated based on human speech collected through voice input devices.

[0403] "Emotional processing means" refers to technologies and devices that analyze audio data and other inputs, recognize the emotions contained within them, and generate them as data.

[0404] "Means for detecting anomalies" refer to technologies and devices for identifying patterns or situations that deviate from normal operations or behaviors and recognizing them as risks.

[0405] "Means of notifying administrators" refers to technologies and devices that quickly transmit information to relevant parties when an anomaly is detected in the system.

[0406] "Means of restricting operation" refers to technologies or devices that restrict the functions of an information processing device or control access to it in order to prevent it from performing fraudulent or dangerous actions.

[0407] A "cloud computing device" is a server or network system that allows data processing and storage to be performed remotely via the internet.

[0408] "Means of sending warnings in real time" refers to technologies and devices that immediately send warning information to administrators when an anomaly occurs.

[0409] "Means of providing feedback" refer to technologies and devices that present areas for improvement and useful information based on the state of the user or system.

[0410] This system aims to detect anomalies and promptly notify administrators by monitoring employee operations on information processing devices and analyzing conversation data in real time. The system mainly consists of terminals, servers, voice input devices, emotion processing engines, and cloud computing devices.

[0411] The terminal is a device for monitoring user actions in real time, collecting conversational data using a voice input device in addition to key input and application usage history. This data is analyzed by an emotion processing engine to recognize the user's emotional state.

[0412] The server receives operation logs, conversation data, and sentiment data sent from the terminal. The received data is analyzed using AI and machine learning models, and anomalies are detected by comparing them to normal operation patterns. If an anomaly is detected, the server sends a warning to the administrator in real time and restricts the operation of the information processing device as necessary. This makes it possible to reduce the risk of information leakage and harassment.

[0413] As a concrete example, in an office environment, if an employee accesses confidential information during normal working hours while exhibiting a high stress level, the emotion processing engine identifies this as abnormal, and the server immediately notifies the administrator. Upon receiving the notification, the administrator can view the details through the system's dashboard and take necessary actions quickly. This enables rapid risk management.

[0414] As an example of a prompt for a generative AI model, you could use the text, "Generate code to detect risk when an employee exhibits typical non-work-related behavior and high levels of stress."

[0415] The flow of a specific process in Application Example 2 will be explained using Figure 14.

[0416] Step 1:

[0417] The terminal monitors user actions and collects input logs and voice input data. This data includes application usage history, keystrokes, and voice data captured from the microphone. This ensures that all monitorable actions and conversation data are entered.

[0418] Step 2:

[0419] The device sends the collected audio data to the emotion processing engine. The emotion processing engine analyzes the audio data and recognizes emotional information. Specifically, it extracts features from the audio data and identifies emotions such as stress and anger using a machine learning model. This results in the output of the emotion analysis results.

[0420] Step 3:

[0421] The server receives operation logs, conversation data, and sentiment information sent from the terminal. The server analyzes the data using AI and machine learning models and detects anomalies by comparing it to normal operation patterns. The input is operation and sentiment data, and the output is information about the presence or absence of anomalies.

[0422] Step 4:

[0423] If the server detects an anomaly, it will notify the administrator in real time. Specifically, the notification system will generate and send alerts via email and to a dedicated dashboard. This provides administrators with the information they need to take immediate action.

[0424] Step 5:

[0425] In response to any anomalies detected by the server, the operation of the information processing device will be restricted. This includes controlling network access and disabling specific functions. These restrictions are implemented to minimize the risk of information leakage and fraudulent activity.

[0426] Step 6:

[0427] Based on the information provided, administrators monitor user behavior and, if necessary, provide direct feedback and make environmental adjustments. At this stage, measures are taken to improve the user's work environment, taking into account the collected sentiment data.

[0428] The specific processing unit 290 transmits the result of the specific processing to the smart glasses 214. In the smart glasses 214, the control unit 46A causes the speaker 240 to output the result of the specific processing. The microphone 238 acquires audio indicating user input for the result of the specific processing. The control unit 46A transmits the audio data indicating user input acquired by the microphone 238 to the data processing unit 12. In the data processing unit 12, the specific processing unit 290 acquires the audio data.

[0429] Data generation model 58 is a type of so-called generative AI (Artificial Intelligence). One example of data generation model 58 is ChatGPT (Internet search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search) <url: https: gemini.google.com ?hl="ja">Examples of generative AI include the following. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 is input with prompts containing instructions, and with inference data such as audio data representing speech, text data representing text, and image data representing images. The data generation model 58 infers from the input inference data according to the instructions indicated by the prompts, and outputs the inference results in data formats such as audio data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0430] In the above embodiment, an example was given in which specific processing is performed by the data processing device 12, but the technology of this disclosure is not limited thereto, and the specific processing may also be performed by the smart glasses 214.

[0431] [Third Embodiment]

[0432] Figure 5 shows an example of the configuration of the data processing system 310 according to the third embodiment.

[0433] As shown in Figure 5, the data processing system 310 includes a data processing device 12 and a headset terminal 314. An example of the data processing device 12 is a server.

[0434] The data processing device 12 comprises a computer 22, a database 24, and a communication interface 26. The computer 22 is an example of a "computer" related to the technology of this disclosure. The computer 22 comprises a processor 28, RAM 30, and storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication interface 26 are also connected to the bus 34. The communication interface 26 is connected to a network 54. An example of the network 54 is a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0435] The headset terminal 314 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication interface 44, and a display 343. The computer 36 includes a processor 46, RAM 48, and storage 50. The processor 46, RAM 48, and storage 50 are connected to a bus 52. The microphone 238, speaker 240, camera 42, and display 343 are also connected to the bus 52.

[0436] The microphone 238 receives voice signals from the user 20 and receives instructions from the user 20. The microphone 238 captures the voice signals from the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to the instructions from the processor 46.

[0437] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an image sensor such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the area around the user 20 (for example, an imaging range defined by a field of view equivalent to the width of a typical healthy person's field of vision).

[0438] Communication interface 44 is connected to network 54. Communication interfaces 44 and 26 are responsible for the exchange of various information between processor 46 and processor 28 via network 54. The exchange of various information between processor 46 and processor 28 using communication interfaces 44 and 26 is performed in a secure manner.

[0439] Figure 6 shows an example of the main functions of the data processing device 12 and the headset terminal 314. As shown in Figure 6, the data processing device 12 performs specific processing using the processor 28. The storage 32 stores the specific processing program 56.

[0440] The specific processing program 56 is an example of a "program" relating to the technology of this disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0441] The storage 32 stores the data generation model 58 and the emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0442] In the headset terminal 314, the processor 46 performs the reception output processing. The storage 50 stores the reception output program 60. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output processing is realized by the processor 46 operating as a control unit 46A according to the reception output program 60 executed on the RAM 48.

[0443] Next, the specific processing performed by the specific processing unit 290 of the data processing device 12 will be described. In the following description, the data processing device 12 will be referred to as the "server" and the headset terminal 314 will be referred to as the "terminal".

[0444] This invention is a system designed to reduce the risk of information leaks and harassment within a company. It aims to monitor employees' operations and conversations on information processing devices and to detect fraudulent or inappropriate behavior at an early stage. The system consists of an information processing device, a server, and an administrator terminal connected to it.

[0445] The terminal records keystrokes, mouse operations, and application usage to monitor user activity in real time. In addition, it collects targeted audio from workplace conversations via a voice input device. This system is designed to record audio data only when specific keywords or phrases are used.

[0446] The server receives operation logs and voice data sent from the terminal and performs analysis using AI technology. Machine learning models are used for the analysis, which improves the accuracy of detecting abnormal behavior based on past cases.

[0447] For example, if a user repeatedly attempts to access a confidential folder that they would not normally access, the server will determine this behavior is abnormal based on the operation logs and immediately send a warning to the administrator's terminal. Similarly, if aggressive remarks or mentions of confidential information are detected in the conversation data, an alert will be sent to the administrator.

[0448] On the other hand, the server will, in response to any detected anomalies, temporarily restrict the terminal's network access or the use of specific functions if necessary. This allows for the immediate suppression of serious data breaches.

[0449] Users receive feedback from administrators and have the opportunity to modify their actions as needed. This can also be used to address issues that stem from misunderstandings and to improve business processes.

[0450] The introduction of this system will enable small and medium-sized businesses to efficiently manage information security and harassment while keeping costs down, which is expected to improve overall corporate safety and productivity.

[0451] The following describes the processing flow.

[0452] Step 1:

[0453] The terminal monitors user activity in real time. This includes keyboard input, mouse movements, and application launch history, and logs any suspicious activity.

[0454] Step 2:

[0455] The device records specific conversations through a voice input device. Based on user permission, the microphone is activated, and if a set keyword appears in the conversation, the audio data is converted to text and recorded.

[0456] Step 3:

[0457] The terminal encrypts and sends operation logs and conversation data to the server. This transmission occurs at regular intervals, but can also be performed immediately if an anomaly occurs.

[0458] Step 4:

[0459] The server analyzes the received data using an AI algorithm. The analysis is performed to identify patterns of abnormal behavior based on a machine learning model using historical datasets.

[0460] Step 5:

[0461] The server detects anomalies based on the analysis results. Upon detection of anomalies, it immediately generates a notification for the administrator and sends an alert via email or dashboard.

[0462] Step 6:

[0463] The server will implement automatic measures, such as restricting the device's internet access, as needed. These restrictions will remain in place until the problem is deemed resolved.

[0464] Step 7:

[0465] Based on the alerts received, administrators conduct interviews with users to confirm the details of the problem and provide feedback. This feedback serves as important guidance for users to correct their behavior.

[0466] (Example 1)

[0467] Next, we will describe Example 1. In the following description, the data processing device 12 will be referred to as the "server," and the headset-type terminal 314 will be referred to as the "terminal."

[0468] Information leaks and workplace harassment within companies can significantly undermine organizational safety and a healthy work environment. While early detection and effective countermeasures are crucial, traditional methods have limitations in real-time monitoring and anomaly detection. Therefore, a more accurate and responsive approach is needed.

[0469] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 1 is realized by the following means.

[0470] In this invention, the server includes means for monitoring operations on a user's computing device, means for recording voice data collected using a voice input device based on specific words, and means for detecting anomalies in the operations or voice data and sending warnings to an administrator's computing device. This makes it possible to effectively monitor and respond quickly to risks such as information leaks and harassment.

[0471] "User computing device" refers to an electronic device used by a user to process information and operate.

[0472] A "voice input device" refers to a device used to input voice data into a computer.

[0473] "Audio data" refers to sound information collected through an audio input device.

[0474] "Specific terms" refers to keywords or phrases that have been pre-set as targets for monitoring.

[0475] "Generative AI technology" refers to the technology of analyzing data using machine learning algorithms.

[0476] "Administrative computing equipment" refers to information processing equipment used by system administrators.

[0477] "Abnormal" refers to actions or behaviors that deviate from normal operations or speech patterns.

[0478] "Communication access" refers to the function of exchanging data with the outside world via a network.

[0479] "Immediate notification" refers to the process of sending a warning without delay when an anomaly is detected.

[0480] A "data processing device" refers to a device used to analyze and process data through a computer system.

[0481] This system is designed to reduce the risk of information leaks and harassment, and is intended for implementation within companies. Servers, terminals, and users each play their respective roles in operating the system.

[0482] The terminal functions as the user's computing device. Dedicated monitoring software runs on the terminal, recording the user's keystrokes, mouse operations, and application usage in real time. Through this monitoring, suspicious operations that could potentially lead to information leaks are immediately detected. In addition, the terminal is connected to a voice input device and has the function of collecting workplace conversations based on specific keywords. For example, certain words such as "secret" or "password" can be pre-set, and voice data will be recorded when these words are used in a conversation.

[0483] The server collects operation logs and voice data transmitted from terminals and analyzes them using generative AI technology. This analysis process utilizes machine learning models to detect abnormal behavior based on past cases. When an anomaly is detected, it immediately notifies the administrator's computing device and restricts communication access to the affected terminal as necessary. This function plays a crucial role in ensuring the information security of the company.

[0484] For example, if a user attempts to access many confidential files during non-working hours, the server will detect this as an anomaly and send a warning to the administrator using the following prompt: "Please propose countermeasures for when a user attempts to access a confidential folder more than three times within the specified time frame." Implementing such a system can be expected to improve information security and the work environment.

[0485] This system requires computing and voice input devices as hardware, and utilizes analysis tools powered by generative AI technology as software. Immediate notifications to administrators via prompt messages enhance system responsiveness and support rapid response. This is expected to improve security awareness and operational efficiency throughout the company.

[0486] The flow of the specific processing in Example 1 will be explained using Figure 11.

[0487] Step 1:

[0488] The terminal monitors user activity in real time. Specifically, it records keyboard input, mouse operations, and application usage. All user actions are recorded as input and saved as an operation log. The operation log is initially processed within the terminal for a basic check for any signs of abnormality, and then sent to the server.

[0489] Step 2:

[0490] The terminal collects workplace conversations using a voice input device. Specific keywords and phrases are detected as input. The input audio is recorded as digital audio data and saved only if it matches the specified criteria. Specifically, conversations containing pre-configured keywords such as "secret" or "password" are recorded. This data is also later sent to the server.

[0491] Step 3:

[0492] The server receives operation logs and audio data transmitted from the terminal. This entire received data becomes input to the server. The server analyzes the data using a generative AI model to determine if there is any abnormal behavior. The analysis results highlight operations and conversations that deviate from normal patterns.

[0493] Step 4:

[0494] When the server detects an anomaly, it issues a warning to the administrator's computing device based on the analysis results. The input is the analyzed data, and the output is alert information sent to the administrator. For example, if a user attempts to access confidential files multiple times outside of business hours, the administrator is immediately notified.

[0495] Step 5:

[0496] The server takes necessary actions in response to abnormal behavior. Specifically, it temporarily restricts network access and the use of certain functions on the user's terminal. The input is analytical data indicating abnormal behavior, and the output is the restrictive measures taken.

[0497] Step 6:

[0498] Users receive feedback from administrators and have the opportunity to adjust their behavior. This includes details of problems that occurred and hints to resolve misunderstandings. User input is a review of their own actions, and the expected output is improved work processes.

[0499] Through this series of processing steps, the system can manage the risks of information leakage and harassment with high accuracy and speed.

[0500] (Application Example 1)

[0501] Next, we will explain Application Example 1. In the following explanation, the data processing device 12 will be referred to as the "server," and the headset-type terminal 314 will be referred to as the "terminal."

[0502] In recent years, information leaks and harassment within companies have become serious problems, and there is a need to prevent them from occurring in the first place. However, there are limited ways to reduce these risks efficiently and practically without placing an excessive burden on employees' work. Furthermore, there is the challenge of implementing a system that can quickly identify multiple signs of abnormality and allow managers to respond immediately.

[0503] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 1 is realized by the following means.

[0504] In this invention, the server includes means for monitoring procedures on an employee's electronic device, means for analyzing conversational information collected using voice input volume, and means for notifying an administrator's mobile terminal via a communication device. This enables the identification of inappropriate behavior or conversations in real time, allowing administrators to take prompt action.

[0505] "Employee" refers to an individual employed by a company or organization who uses electronic devices to perform their duties.

[0506] "Electronic devices" are devices designed for information processing, and include personal computers, smartphones, and other similar devices.

[0507] A "procedure" refers to a series of operations or actions performed on an electronic device, and is important for tracking user behavior.

[0508] "Voice input volume" refers to the devices and metrics used to collect voice data, and is used to record conversations within the workplace.

[0509] "Conversational information" refers to audio data collected using speech input and analyzed based on specific keywords and phrases.

[0510] "Analysis" is the process of processing collected data and extracting meaningful information from it, and is used for detecting anomalies.

[0511] A "communication device" is a device that has the function of sending and receiving information, and is used to notify administrators of information via the internet or network.

[0512] "Administrator" refers to an individual or organization responsible for monitoring the system and responding to any anomalies.

[0513] A "mobile device" refers to a portable electronic device, such as a smartphone or tablet.

[0514] "Notification" refers to the communication of information that a system uses to inform an administrator of the occurrence of an anomaly.

[0515] "Real-time" means that information processing and notifications are performed with near-simultaneity, and is important in situations where immediacy is required.

[0516] "Inappropriate conduct" refers to operations or actions by employees that violate work-related norms.

[0517] "Responding quickly" refers to a state in which appropriate action can be taken immediately when an abnormality occurs.

[0518] The system that implements this invention consists of a program that monitors the operation and conversation information of employees on electronic devices and detects abnormalities. It mainly uses the following hardware and software.

[0519] The server utilizes cloud services for information processing and data analysis. Specifically, it uses generative AI models such as Amazon SageMaker and Google Cloud AI to analyze collected procedural and conversational information. When detecting data anomalies, it leverages machine learning algorithms based on past patterns, enabling real-time analysis.

[0520] The terminal is an electronic device used by employees that collects conversational information based on the amount of voice input. The collected information is transmitted to the server in real time. The terminal has a built-in communication device and is optimized for smooth communication with the server.

[0521] Administrators, who are also users, receive anomaly notifications from the server via mobile devices such as smartphones. These notifications are sent instantly via communication platforms like Twilio, enabling administrators to respond quickly. This allows for content review and responses from anywhere.

[0522] For example, if an employee attempts to access an inappropriate website multiple times, the server will detect this as an anomaly and send a warning to the administrator's mobile device. In this way, malicious activity can be prevented while simultaneously enhancing the company's information security.

[0523] An example of a prompt to input into a generative AI model is, "Explain how to monitor inappropriate network activity among employees." Using this prompt, the AI ​​can suggest appropriate methods for monitoring behavior.

[0524] The flow of a specific process in Application Example 1 will be explained using Figure 12.

[0525] Step 1:

[0526] The terminal collects operation logs and audio from employees' electronic devices. Input consists of conversational data collected based on each user action (keyboard input, mouse operation) and the amount of voice input. This data is temporarily stored within the terminal and prepared for transmission to the server.

[0527] Step 2:

[0528] The terminal sends the collected operation logs and audio data to the server. The input is the data temporarily stored in step 1, and the output is stored in a database on the cloud. In this process, the terminal performs the action of moving data to the server over the network.

[0529] Step 3:

[0530] The server analyzes the received data. The input consists of operation logs and audio data stored in a cloud database. Using generative AI models and machine learning algorithms, it produces output that detects abnormal behavior and inappropriate conversations. Specifically, this involves comparison with past data patterns and keyword detection.

[0531] Step 4:

[0532] The server sends an alert to the administrator based on the detected anomaly. The input is the anomaly data detected in step 3. The output is the notification message sent to the administrator's mobile device. This process uses a communication platform such as Twilio to provide real-time notifications.

[0533] Step 5:

[0534] The administrator, as a user, receives notifications to confirm anomalies and take action as necessary. The input is the warning message displayed on the administrator's mobile device. The output is the response action (anomaly confirmation and response to the warning). The administrator uses the information from this notification to decide what measures should be taken.

[0535] Furthermore, an emotion engine that estimates the user's emotions may be incorporated. That is, the identification processing unit 290 may use the emotion identification model 59 to estimate the user's emotions and perform identification processing using the user's emotions.

[0536] This invention enables more accurate management of risks such as information leaks and harassment by combining an emotion engine with a system that monitors employee activities. The system consists of terminals, a server, an administrator device, and an emotion engine.

[0537] The terminal monitors user actions and conversations in real time, collecting conversation data using a voice input device in addition to key input and application usage history. The emotion engine recognizes the user's emotions from this voice data and generates emotional information as data for analysis.

[0538] The server receives operation logs, conversation data, and emotion information sent from the terminal. The server analyzes the received data using AI and machine learning models and detects anomalies by comparing it with normal operation patterns. In addition, if the emotions recognized by the emotion engine deviate from the normal working state, this is also used as a factor in determining anomaly detection.

[0539] For example, if a user persistently accesses certain confidential information and the emotion engine simultaneously detects a high stress level, the server will determine this situation to be highly dangerous and immediately send an alert to the administrator. This allows the administrator to quickly understand the situation and take appropriate action.

[0540] Furthermore, the server automatically restricts network access to employee terminals as needed, preventing the risk of information leaks. It also includes features that use emotion-based feedback to help users enjoy a better work environment.

[0541] This system allows companies to improve information security and the quality of their work environment in an integrated manner, and provides the convenience of enabling even small and medium-sized enterprises to achieve this at a low cost.

[0542] The following describes the processing flow.

[0543] Step 1:

[0544] The terminal monitors user activity in real time. It collects information such as keystrokes, mouse operations, and accessed files, and logs any suspicious activity.

[0545] Step 2:

[0546] The device uses a voice input device to collect the user's conversation. If specific keywords are used in the conversation, the voice data is converted into text to generate conversation data.

[0547] Step 3:

[0548] The device uses an emotion engine to analyze the user's emotions from collected conversation data. It analyzes voice tone, speed, intonation, etc., to determine emotional states such as joy, anger, and stress.

[0549] Step 4:

[0550] The device sends operation logs, conversation data, and sentiment information to the server. This data is encrypted for security purposes.

[0551] Step 5:

[0552] The server analyzes the received data using an AI algorithm. It utilizes machine learning models to identify abnormal or risky behaviors by comparing them to normal operating patterns.

[0553] Step 6:

[0554] The server further improves the accuracy of anomaly detection based on user sentiment information. If the emotional state differs significantly from normal, it will be given priority in the risk assessment.

[0555] Step 7:

[0556] The server sends real-time alerts to administrators based on the detection of anomalies or risks. These alerts include specific details of the problem and recommended countermeasures.

[0557] Step 8:

[0558] The server will automatically implement measures such as restricting network access or limiting specific operations on terminals if necessary.

[0559] Step 9:

[0560] Users receive feedback from administrators and use it to improve their situation and adjust their work environment. Emotion-based feedback is utilized, enabling more sophisticated and personalized responses.

[0561] (Example 2)

[0562] Next, we will describe Example 2. In the following description, the data processing device 12 will be referred to as the "server," and the headset-type terminal 314 will be referred to as the "terminal."

[0563] In today's work environment, concerns about risks such as information leaks and harassment necessitate more accurate monitoring of employee behavior and emotional states to prevent risks proactively. Furthermore, there is the challenge of improving the employee work environment to provide a more efficient and comfortable working environment.

[0564] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 2 is realized by the following means.

[0565] In this invention, the server includes means for monitoring the operation of an employee's information processing device, means for analyzing conversation data collected using a voice input device and recognizing emotions, means for detecting abnormalities in the operation or conversation data and recognized emotion information and notifying the administrator, means for restricting the operation of the information processing device in accordance with the detected abnormalities, and means for proposing improvements to the work environment to the employee based on the analysis results. This makes it possible to improve the employee's work environment while detecting and responding to risks such as information leakage and harassment at an early stage.

[0566] An "information processing device" is a device that collects, processes, and analyzes data for use as information.

[0567] "Means of monitoring" refers to a device or program that has a mechanism for observing and recording employee operations and activities in real time.

[0568] "Audio input device" refers to hardware such as microphones used to collect audio data, as well as software to process that data.

[0569] "Conversation data" refers to audio information collected via a voice input device, and represents data indicating the content of the user's statements.

[0570] "Means of analysis" refers to a program or device used to analyze collected data and extract meaning or patterns.

[0571] "Emotion recognition" is the process of estimating, quantifying, or classifying a user's emotional state from audio data.

[0572] "Means for detecting abnormalities" refers to a program or mechanism that identifies and notifies of behavior or conditions that deviate from normal operating patterns.

[0573] "Means of notifying administrators" refers to a system that transmits information about detected anomalies to those responsible for management.

[0574] "Means of limiting operation" refers to a mechanism that reduces or stops the functionality of a device or program when certain conditions are met.

[0575] "Means of proposing improvements to the work environment" refers to a program or system that provides changes or recommendations to improve employee work efficiency and comfort.

[0576] A "server" is a central device or system that manages and processes data in a centralized manner over a network.

[0577] This invention provides a system for monitoring employee activities and managing risks. Its main components include terminals, servers, and an emotion engine.

[0578] The terminal functions as a user information processing device, monitoring operations in real time. Specifically, it records key inputs and application usage history, and collects user conversation data using a voice input device. This voice data is then transferred to the emotion engine.

[0579] The emotion engine is software that analyzes voice data and implements algorithms to detect the user's emotional state. This engine uses voice signal processing technology to quantify emotions such as stress and anxiety, and provides data for analysis.

[0580] The server is a central device that aggregates and analyzes operation logs, conversation data, and sentiment information transmitted from terminals. Using AI models and machine learning algorithms, the server performs anomaly detection. Specifically, it compares the data against normal operation patterns and notifies the administrator if an anomaly is detected. It also determines that an anomaly occurs if the sentiment information deviates from the normal range.

[0581] For example, if a user repeatedly accesses confidential data in a short period of time, and the emotion engine detects a high stress level, the server will consider this situation abnormal and send an alert to the administrator. In this case, the server will restrict the user's network access as needed to reduce the risk of information leakage.

[0582] Furthermore, the server uses employee emotional data to provide feedback for improving the work environment. For example, if a user experiences prolonged periods of high stress, it may display a message suggesting a break, thereby promoting a better work environment.

[0583] By using a generative AI model, the server can quickly and efficiently detect anomalies and provide information to administrators. For example, by entering a prompt such as, "The user is attempting to access the same confidential file multiple times in a short period of time, and the emotion engine has detected high stress levels. Could you please provide a risk assessment for this situation?", the AI ​​will provide an appropriate decision.

[0584] The flow of the specific processing in Example 2 will be explained using Figure 13.

[0585] Step 1:

[0586] The terminal acts as a user information processing device, monitoring keystrokes and application usage history in real time. It receives physical keystrokes and application event logs as input. By collecting this data and storing it in a database, it generates a user operation log.

[0587] Step 2:

[0588] The terminal collects conversational data interactively from the user using a voice input device. It receives voice signals as input and saves them as audio files. This audio data is preprocessed to prepare it for transmission to the emotion engine as voice data.

[0589] Step 3:

[0590] The emotion engine receives audio data transmitted from the device and extracts emotional information using an audio signal analysis algorithm. By taking audio data as input and applying phoneme analysis and emotion recognition algorithms, it outputs stress and emotional states as numerical data. This enables real-time monitoring of the user's emotional state.

[0591] Step 4:

[0592] The server receives operation logs, conversation data, and sentiment information collected from terminals. To analyze this data, it uses AI models and machine learning algorithms to detect anomalies by comparing them to normal patterns. It receives operation logs and sentiment data as input and runs an anomaly detection model to output abnormal conditions.

[0593] Step 5:

[0594] The server notifies the administrator of any detected anomalies. Specifically, it not only displays alert messages on the management screen but also sends them to the administrator via email and SMS. It receives anomaly detection results as input and outputs alerts to the notification system.

[0595] Step 6:

[0596] The server generates feedback suggesting improvements to the user's work environment based on the analyzed emotional information. It receives emotional data and work history as input, and outputs appropriate change suggestions to the user through a feedback algorithm. For example, if prolonged high stress is detected, a message encouraging a break will be displayed on the user's screen.

[0597] (Application Example 2)

[0598] Next, we will explain application example 2. In the following explanation, the data processing device 12 will be referred to as the "server," and the headset-type terminal 314 will be referred to as the "terminal."

[0599] Conventional employee activity monitoring systems lack sufficient means to reduce the risk of information leaks and harassment, particularly in their inadequate real-time anomaly detection and emotion analysis. Furthermore, they fail to provide adequate immediate notifications to managers and proper feedback for improving the work environment.

[0600] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means.

[0601] In this invention, the server includes means for monitoring the operation of an employee's information processing device, means for analyzing conversation data collected using a voice input device, and emotion processing means for analyzing the user's emotions from the operation and conversation data. This enables real-time anomaly detection, reduces the risk of information leakage and harassment through prompt notification to administrators, and contributes to improving the work environment.

[0602] An "employee" is a person who is employed by a company or organization and performs duties.

[0603] An "information processing device" is a general term for any device that can input, process, and output data, and includes computers and smart devices.

[0604] "Means for monitoring operations" refers to technologies and devices for recording and analyzing a series of operations and actions performed on an information processing device used by an employee.

[0605] A "voice input device" is a device used to collect human voice as digital data, and includes a microphone and a dedicated sensor.

[0606] "Conversation data" refers to text data and audio data generated based on human speech collected through voice input devices.

[0607] "Emotional processing means" refers to technologies and devices that analyze audio data and other inputs, recognize the emotions contained within them, and generate them as data.

[0608] "Means for detecting anomalies" refer to technologies and devices for identifying patterns or situations that deviate from normal operations or behaviors and recognizing them as risks.

[0609] "Means of notifying administrators" refers to technologies and devices that quickly transmit information to relevant parties when an anomaly is detected in the system.

[0610] "Means of restricting operation" refers to technologies or devices that restrict the functions of an information processing device or control access to it in order to prevent it from performing fraudulent or dangerous actions.

[0611] A "cloud computing device" is a server or network system that allows data processing and storage to be performed remotely via the internet.

[0612] "Means of sending warnings in real time" refers to technologies and devices that immediately send warning information to administrators when an anomaly occurs.

[0613] "Means of providing feedback" refer to technologies and devices that present areas for improvement and useful information based on the state of the user or system.

[0614] This system aims to detect anomalies and promptly notify administrators by monitoring employee operations on information processing devices and analyzing conversation data in real time. The system mainly consists of terminals, servers, voice input devices, emotion processing engines, and cloud computing devices.

[0615] The terminal is a device for monitoring user actions in real time, collecting conversational data using a voice input device in addition to key input and application usage history. This data is analyzed by an emotion processing engine to recognize the user's emotional state.

[0616] The server receives operation logs, conversation data, and sentiment data sent from the terminal. The received data is analyzed using AI and machine learning models, and anomalies are detected by comparing them to normal operation patterns. If an anomaly is detected, the server sends a warning to the administrator in real time and restricts the operation of the information processing device as necessary. This makes it possible to reduce the risk of information leakage and harassment.

[0617] As a concrete example, in an office environment, if an employee accesses confidential information during normal working hours while exhibiting a high stress level, the emotion processing engine identifies this as abnormal, and the server immediately notifies the administrator. Upon receiving the notification, the administrator can view the details through the system's dashboard and take necessary actions quickly. This enables rapid risk management.

[0618] As an example of a prompt for a generative AI model, you could use the text, "Generate code to detect risk when an employee exhibits typical non-work-related behavior and high levels of stress."

[0619] The flow of a specific process in Application Example 2 will be explained using Figure 14.

[0620] Step 1:

[0621] The terminal monitors user actions and collects input logs and voice input data. This data includes application usage history, keystrokes, and voice data captured from the microphone. This ensures that all monitorable actions and conversation data are entered.

[0622] Step 2:

[0623] The device sends the collected audio data to the emotion processing engine. The emotion processing engine analyzes the audio data and recognizes emotional information. Specifically, it extracts features from the audio data and identifies emotions such as stress and anger using a machine learning model. This results in the output of the emotion analysis results.

[0624] Step 3:

[0625] The server receives operation logs, conversation data, and sentiment information sent from the terminal. The server analyzes the data using AI and machine learning models and detects anomalies by comparing it to normal operation patterns. The input is operation and sentiment data, and the output is information about the presence or absence of anomalies.

[0626] Step 4:

[0627] If the server detects an anomaly, it will notify the administrator in real time. Specifically, the notification system will generate and send alerts via email and to a dedicated dashboard. This provides administrators with the information they need to take immediate action.

[0628] Step 5:

[0629] In response to any anomalies detected by the server, the operation of the information processing device will be restricted. This includes controlling network access and disabling specific functions. These restrictions are implemented to minimize the risk of information leakage and fraudulent activity.

[0630] Step 6:

[0631] Based on the information provided, administrators monitor user behavior and, if necessary, provide direct feedback and make environmental adjustments. At this stage, measures are taken to improve the user's work environment, taking into account the collected sentiment data.

[0632] The specific processing unit 290 transmits the result of the specific processing to the headset terminal 314. In the headset terminal 314, the control unit 46A causes the speaker 240 and display 343 to output the result of the specific processing. The microphone 238 acquires audio indicating user input for the result of the specific processing. The control unit 46A transmits the audio data indicating user input acquired by the microphone 238 to the data processing unit 12. In the data processing unit 12, the specific processing unit 290 acquires the audio data.

[0633] Data generation model 58 is a type of so-called generative AI (Artificial Intelligence). One example of data generation model 58 is ChatGPT (Internet search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search) <url: https: gemini.google.com ?hl="ja">Examples of generative AI include the following. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 is input with prompts containing instructions, and with inference data such as audio data representing speech, text data representing text, and image data representing images. The data generation model 58 infers from the input inference data according to the instructions indicated by the prompts, and outputs the inference results in data formats such as audio data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0634] In the above embodiment, an example was given in which specific processing is performed by the data processing device 12, but the technology of this disclosure is not limited thereto, and specific processing may also be performed by the headset terminal 314.

[0635] [Fourth Embodiment]

[0636] Figure 7 shows an example of the configuration of the data processing system 410 according to the fourth embodiment.

[0637] As shown in Figure 7, the data processing system 410 includes a data processing device 12 and a robot 414. An example of the data processing device 12 is a server.

[0638] The data processing device 12 comprises a computer 22, a database 24, and a communication interface 26. The computer 22 is an example of a "computer" related to the technology of this disclosure. The computer 22 comprises a processor 28, RAM 30, and storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication interface 26 are also connected to the bus 34. The communication interface 26 is connected to a network 54. An example of the network 54 is a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0639] The robot 414 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication interface 44, and a controlled object 443. The computer 36 includes a processor 46, RAM 48, and storage 50. The processor 46, RAM 48, and storage 50 are connected to a bus 52. The microphone 238, speaker 240, camera 42, and controlled object 443 are also connected to the bus 52.

[0640] The microphone 238 receives voice signals from the user 20 and receives instructions from the user 20. The microphone 238 captures the voice signals from the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to the instructions from the processor 46.

[0641] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an image sensor such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the area around the user 20 (for example, an imaging range defined by a field of view equivalent to the width of a typical healthy person's field of vision).

[0642] Communication interface 44 is connected to network 54. Communication interfaces 44 and 26 are responsible for the exchange of various information between processor 46 and processor 28 via network 54. The exchange of various information between processor 46 and processor 28 using communication interfaces 44 and 26 is performed in a secure manner.

[0643] The controlled object 443 includes a display device, LEDs in the eyes, and motors that drive the arms, hands, and feet. The posture and gestures of the robot 414 are controlled by controlling the motors of the arms, hands, and feet. Some of the robot 414's emotions can be expressed by controlling these motors. Furthermore, the robot 414's facial expressions can also be expressed by controlling the illumination state of the LEDs in its eyes.

[0644] Figure 8 shows an example of the main functions of the data processing device 12 and the robot 414. As shown in Figure 8, the data processing device 12 performs specific processing using the processor 28. The storage 32 stores the specific processing program 56.

[0645] The specific processing program 56 is an example of a "program" relating to the technology of this disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0646] The storage 32 stores the data generation model 58 and the emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0647] In robot 414, the processor 46 performs the reception output processing. The storage 50 stores the reception output program 60. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output processing is realized by the processor 46 operating as a control unit 46A according to the reception output program 60 executed on the RAM 48.

[0648] Next, the specific processing performed by the specific processing unit 290 of the data processing device 12 will be described. In the following description, the data processing device 12 will be referred to as the "server" and the robot 414 as the "terminal".

[0649] This invention is a system designed to reduce the risk of information leaks and harassment within a company. It aims to monitor employees' operations and conversations on information processing devices and to detect fraudulent or inappropriate behavior at an early stage. The system consists of an information processing device, a server, and an administrator terminal connected to it.

[0650] The terminal records keystrokes, mouse operations, and application usage to monitor user activity in real time. In addition, it collects targeted audio from workplace conversations via a voice input device. This system is designed to record audio data only when specific keywords or phrases are used.

[0651] The server receives operation logs and voice data sent from the terminal and performs analysis using AI technology. Machine learning models are used for the analysis, which improves the accuracy of detecting abnormal behavior based on past cases.

[0652] For example, if a user repeatedly attempts to access a confidential folder that they would not normally access, the server will determine this behavior is abnormal based on the operation logs and immediately send a warning to the administrator's terminal. Similarly, if aggressive remarks or mentions of confidential information are detected in the conversation data, an alert will be sent to the administrator.

[0653] On the other hand, the server will, in response to any detected anomalies, temporarily restrict the terminal's network access or the use of specific functions if necessary. This allows for the immediate suppression of serious data breaches.

[0654] Users receive feedback from administrators and have the opportunity to modify their actions as needed. This can also be used to address issues that stem from misunderstandings and to improve business processes.

[0655] The introduction of this system will enable small and medium-sized businesses to efficiently manage information security and harassment while keeping costs down, which is expected to improve overall corporate safety and productivity.

[0656] The following describes the processing flow.

[0657] Step 1:

[0658] The terminal monitors user activity in real time. This includes keyboard input, mouse movements, and application launch history, and logs any suspicious activity.

[0659] Step 2:

[0660] The device records specific conversations through a voice input device. Based on user permission, the microphone is activated, and if a set keyword appears in the conversation, the audio data is converted to text and recorded.

[0661] Step 3:

[0662] The terminal encrypts and sends operation logs and conversation data to the server. This transmission occurs at regular intervals, but can also be performed immediately if an anomaly occurs.

[0663] Step 4:

[0664] The server analyzes the received data using an AI algorithm. The analysis is performed to identify patterns of abnormal behavior based on a machine learning model using historical datasets.

[0665] Step 5:

[0666] The server detects anomalies based on the analysis results. Upon detection of anomalies, it immediately generates a notification for the administrator and sends an alert via email or dashboard.

[0667] Step 6:

[0668] The server will implement automatic measures, such as restricting the device's internet access, as needed. These restrictions will remain in place until the problem is deemed resolved.

[0669] Step 7:

[0670] Based on the alerts received, administrators conduct interviews with users to confirm the details of the problem and provide feedback. This feedback serves as important guidance for users to correct their behavior.

[0671] (Example 1)

[0672] Next, we will describe Example 1. In the following description, the data processing device 12 will be referred to as the "server" and the robot 414 as the "terminal".

[0673] Information leaks and workplace harassment within companies can significantly undermine organizational safety and a healthy work environment. While early detection and effective countermeasures are crucial, traditional methods have limitations in real-time monitoring and anomaly detection. Therefore, a more accurate and responsive approach is needed.

[0674] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 1 is realized by the following means.

[0675] In this invention, the server includes means for monitoring operations on a user's computing device, means for recording voice data collected using a voice input device based on specific words, and means for detecting anomalies in the operations or voice data and sending warnings to an administrator's computing device. This makes it possible to effectively monitor and respond quickly to risks such as information leaks and harassment.

[0676] "User computing device" refers to an electronic device used by a user to process information and operate.

[0677] A "voice input device" refers to a device used to input voice data into a computer.

[0678] "Audio data" refers to sound information collected through an audio input device.

[0679] "Specific terms" refers to keywords or phrases that have been pre-set as targets for monitoring.

[0680] "Generative AI technology" refers to the technology of analyzing data using machine learning algorithms.

[0681] "Administrative computing equipment" refers to information processing equipment used by system administrators.

[0682] "Abnormal" refers to actions or behaviors that deviate from normal operations or speech patterns.

[0683] "Communication access" refers to the function of exchanging data with the outside world via a network.

[0684] "Immediate notification" refers to the process of sending a warning without delay when an anomaly is detected.

[0685] A "data processing device" refers to a device used to analyze and process data through a computer system.

[0686] This system is designed to reduce the risk of information leaks and harassment, and is intended for implementation within companies. Servers, terminals, and users each play their respective roles in operating the system.

[0687] The terminal functions as the user's computing device. Dedicated monitoring software runs on the terminal, recording the user's keystrokes, mouse operations, and application usage in real time. Through this monitoring, suspicious operations that could potentially lead to information leaks are immediately detected. In addition, the terminal is connected to a voice input device and has the function of collecting workplace conversations based on specific keywords. For example, certain words such as "secret" or "password" can be pre-set, and voice data will be recorded when these words are used in a conversation.

[0688] The server collects operation logs and voice data transmitted from terminals and analyzes them using generative AI technology. This analysis process utilizes machine learning models to detect abnormal behavior based on past cases. When an anomaly is detected, it immediately notifies the administrator's computing device and restricts communication access to the affected terminal as necessary. This function plays a crucial role in ensuring the information security of the company.

[0689] For example, if a user attempts to access many confidential files during non-working hours, the server will detect this as an anomaly and send a warning to the administrator using the following prompt: "Please propose countermeasures for when a user attempts to access a confidential folder more than three times within the specified time frame." Implementing such a system can be expected to improve information security and the work environment.

[0690] This system requires computing and voice input devices as hardware, and utilizes analysis tools powered by generative AI technology as software. Immediate notifications to administrators via prompt messages enhance system responsiveness and support rapid response. This is expected to improve security awareness and operational efficiency throughout the company.

[0691] The flow of the specific processing in Example 1 will be explained using Figure 11.

[0692] Step 1:

[0693] The terminal monitors user activity in real time. Specifically, it records keyboard input, mouse operations, and application usage. All user actions are recorded as input and saved as an operation log. The operation log is initially processed within the terminal for a basic check for any signs of abnormality, and then sent to the server.

[0694] Step 2:

[0695] The terminal collects workplace conversations using a voice input device. Specific keywords and phrases are detected as input. The input audio is recorded as digital audio data and saved only if it matches the specified criteria. Specifically, conversations containing pre-configured keywords such as "secret" or "password" are recorded. This data is also later sent to the server.

[0696] Step 3:

[0697] The server receives operation logs and audio data transmitted from the terminal. This entire received data becomes input to the server. The server analyzes the data using a generative AI model to determine if there is any abnormal behavior. The analysis results highlight operations and conversations that deviate from normal patterns.

[0698] Step 4:

[0699] When the server detects an anomaly, it issues a warning to the administrator's computing device based on the analysis results. The input is the analyzed data, and the output is alert information sent to the administrator. For example, if a user attempts to access confidential files multiple times outside of business hours, the administrator is immediately notified.

[0700] Step 5:

[0701] The server takes necessary actions in response to abnormal behavior. Specifically, it temporarily restricts network access and the use of certain functions on the user's terminal. The input is analytical data indicating abnormal behavior, and the output is the restrictive measures taken.

[0702] Step 6:

[0703] Users receive feedback from administrators and have the opportunity to adjust their behavior. This includes details of problems that occurred and hints to resolve misunderstandings. User input is a review of their own actions, and the expected output is improved work processes.

[0704] Through this series of processing steps, the system can manage the risks of information leakage and harassment with high accuracy and speed.

[0705] (Application Example 1)

[0706] Next, we will explain Application Example 1. In the following explanation, the data processing device 12 will be referred to as the "server" and the robot 414 as the "terminal".

[0707] In recent years, information leaks and harassment within companies have become serious problems, and there is a need to prevent them from occurring in the first place. However, there are limited ways to reduce these risks efficiently and practically without placing an excessive burden on employees' work. Furthermore, there is the challenge of implementing a system that can quickly identify multiple signs of abnormality and allow managers to respond immediately.

[0708] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 1 is realized by the following means.

[0709] In this invention, the server includes means for monitoring procedures on an employee's electronic device, means for analyzing conversational information collected using voice input volume, and means for notifying an administrator's mobile terminal via a communication device. This enables the identification of inappropriate behavior or conversations in real time, allowing administrators to take prompt action.

[0710] "Employee" refers to an individual employed by a company or organization who uses electronic devices to perform their duties.

[0711] "Electronic devices" are devices designed for information processing, and include personal computers, smartphones, and other similar devices.

[0712] A "procedure" refers to a series of operations or actions performed on an electronic device, and is important for tracking user behavior.

[0713] "Voice input volume" refers to the devices and metrics used to collect voice data, and is used to record conversations within the workplace.

[0714] "Conversational information" refers to audio data collected using speech input and analyzed based on specific keywords and phrases.

[0715] "Analysis" is the process of processing collected data and extracting meaningful information from it, and is used for detecting anomalies.

[0716] A "communication device" is a device that has the function of sending and receiving information, and is used to notify administrators of information via the internet or network.

[0717] "Administrator" refers to an individual or organization responsible for monitoring the system and responding to any anomalies.

[0718] A "mobile device" refers to a portable electronic device, such as a smartphone or tablet.

[0719] "Notification" refers to the communication of information that a system uses to inform an administrator of the occurrence of an anomaly.

[0720] "Real-time" means that information processing and notifications are performed with near-simultaneity, and is important in situations where immediacy is required.

[0721] "Inappropriate conduct" refers to operations or actions by employees that violate work-related norms.

[0722] "Responding quickly" refers to a state in which appropriate action can be taken immediately when an abnormality occurs.

[0723] The system that implements this invention consists of a program that monitors the operation and conversation information of employees on electronic devices and detects abnormalities. It mainly uses the following hardware and software.

[0724] The server utilizes cloud services for information processing and data analysis. Specifically, it uses generative AI models such as Amazon SageMaker and Google Cloud AI to analyze collected procedural and conversational information. When detecting data anomalies, it leverages machine learning algorithms based on past patterns, enabling real-time analysis.

[0725] The terminal is an electronic device used by employees that collects conversational information based on the amount of voice input. The collected information is transmitted to the server in real time. The terminal has a built-in communication device and is optimized for smooth communication with the server.

[0726] Administrators, who are also users, receive anomaly notifications from the server via mobile devices such as smartphones. These notifications are sent instantly via communication platforms like Twilio, enabling administrators to respond quickly. This allows for content review and responses from anywhere.

[0727] For example, if an employee attempts to access an inappropriate website multiple times, the server will detect this as an anomaly and send a warning to the administrator's mobile device. In this way, malicious activity can be prevented while simultaneously enhancing the company's information security.

[0728] An example of a prompt to input into a generative AI model is, "Explain how to monitor inappropriate network activity among employees." Using this prompt, the AI ​​can suggest appropriate methods for monitoring behavior.

[0729] The flow of a specific process in Application Example 1 will be explained using Figure 12.

[0730] Step 1:

[0731] The terminal collects operation logs and audio from employees' electronic devices. Input consists of conversational data collected based on each user action (keyboard input, mouse operation) and the amount of voice input. This data is temporarily stored within the terminal and prepared for transmission to the server.

[0732] Step 2:

[0733] The terminal sends the collected operation logs and audio data to the server. The input is the data temporarily stored in step 1, and the output is stored in a database on the cloud. In this process, the terminal performs the action of moving data to the server over the network.

[0734] Step 3:

[0735] The server analyzes the received data. The input consists of operation logs and audio data stored in a cloud database. Using generative AI models and machine learning algorithms, it produces output that detects abnormal behavior and inappropriate conversations. Specifically, this involves comparison with past data patterns and keyword detection.

[0736] Step 4:

[0737] The server sends an alert to the administrator based on the detected anomaly. The input is the anomaly data detected in step 3. The output is the notification message sent to the administrator's mobile device. This process uses a communication platform such as Twilio to provide real-time notifications.

[0738] Step 5:

[0739] The administrator, as a user, receives notifications to confirm anomalies and take action as necessary. The input is the warning message displayed on the administrator's mobile device. The output is the response action (anomaly confirmation and response to the warning). The administrator uses the information from this notification to decide what measures should be taken.

[0740] Furthermore, an emotion engine that estimates the user's emotions may be incorporated. That is, the identification processing unit 290 may use the emotion identification model 59 to estimate the user's emotions and perform identification processing using the user's emotions.

[0741] This invention enables more accurate management of risks such as information leaks and harassment by combining an emotion engine with a system that monitors employee activities. The system consists of terminals, a server, an administrator device, and an emotion engine.

[0742] The terminal monitors user actions and conversations in real time, collecting conversation data using a voice input device in addition to key input and application usage history. The emotion engine recognizes the user's emotions from this voice data and generates emotional information as data for analysis.

[0743] The server receives operation logs, conversation data, and emotion information sent from the terminal. The server analyzes the received data using AI and machine learning models and detects anomalies by comparing it with normal operation patterns. In addition, if the emotions recognized by the emotion engine deviate from the normal working state, this is also used as a factor in determining anomaly detection.

[0744] For example, if a user persistently accesses certain confidential information and the emotion engine simultaneously detects a high stress level, the server will determine this situation to be highly dangerous and immediately send an alert to the administrator. This allows the administrator to quickly understand the situation and take appropriate action.

[0745] Furthermore, the server automatically restricts network access to employee terminals as needed, preventing the risk of information leaks. It also includes features that use emotion-based feedback to help users enjoy a better work environment.

[0746] This system allows companies to improve information security and the quality of their work environment in an integrated manner, and provides the convenience of enabling even small and medium-sized enterprises to achieve this at a low cost.

[0747] The following describes the processing flow.

[0748] Step 1:

[0749] The terminal monitors user activity in real time. It collects information such as keystrokes, mouse operations, and accessed files, and logs any suspicious activity.

[0750] Step 2:

[0751] The device uses a voice input device to collect the user's conversation. If specific keywords are used in the conversation, the voice data is converted into text to generate conversation data.

[0752] Step 3:

[0753] The device uses an emotion engine to analyze the user's emotions from collected conversation data. It analyzes voice tone, speed, intonation, etc., to determine emotional states such as joy, anger, and stress.

[0754] Step 4:

[0755] The device sends operation logs, conversation data, and sentiment information to the server. This data is encrypted for security purposes.

[0756] Step 5:

[0757] The server analyzes the received data using an AI algorithm. It utilizes machine learning models to identify abnormal or risky behaviors by comparing them to normal operating patterns.

[0758] Step 6:

[0759] The server further improves the accuracy of anomaly detection based on user sentiment information. If the emotional state differs significantly from normal, it will be given priority in the risk assessment.

[0760] Step 7:

[0761] The server sends real-time alerts to administrators based on the detection of anomalies or risks. These alerts include specific details of the problem and recommended countermeasures.

[0762] Step 8:

[0763] The server will automatically implement measures such as restricting network access or limiting specific operations on terminals if necessary.

[0764] Step 9:

[0765] Users receive feedback from administrators and use it to improve their situation and adjust their work environment. Emotion-based feedback is utilized, enabling more sophisticated and personalized responses.

[0766] (Example 2)

[0767] Next, we will describe Example 2. In the following description, the data processing device 12 will be referred to as the "server" and the robot 414 as the "terminal".

[0768] In today's work environment, concerns about risks such as information leaks and harassment necessitate more accurate monitoring of employee behavior and emotional states to prevent risks proactively. Furthermore, there is the challenge of improving the employee work environment to provide a more efficient and comfortable working environment.

[0769] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 2 is realized by the following means.

[0770] In this invention, the server includes means for monitoring the operation of an employee's information processing device, means for analyzing conversation data collected using a voice input device and recognizing emotions, means for detecting abnormalities in the operation or conversation data and recognized emotion information and notifying the administrator, means for restricting the operation of the information processing device in accordance with the detected abnormalities, and means for proposing improvements to the work environment to the employee based on the analysis results. This makes it possible to improve the employee's work environment while detecting and responding to risks such as information leakage and harassment at an early stage.

[0771] An "information processing device" is a device that collects, processes, and analyzes data for use as information.

[0772] "Means of monitoring" refers to a device or program that has a mechanism for observing and recording employee operations and activities in real time.

[0773] "Audio input device" refers to hardware such as microphones used to collect audio data, as well as software to process that data.

[0774] "Conversation data" refers to audio information collected via a voice input device, and represents data indicating the content of the user's statements.

[0775] "Means of analysis" refers to a program or device used to analyze collected data and extract meaning or patterns.

[0776] "Emotion recognition" is the process of estimating, quantifying, or classifying a user's emotional state from audio data.

[0777] "Means for detecting abnormalities" refers to a program or mechanism that identifies and notifies of behavior or conditions that deviate from normal operating patterns.

[0778] "Means of notifying administrators" refers to a system that transmits information about detected anomalies to those responsible for management.

[0779] "Means of limiting operation" refers to a mechanism that reduces or stops the functionality of a device or program when certain conditions are met.

[0780] "Means of proposing improvements to the work environment" refers to a program or system that provides changes or recommendations to improve employee work efficiency and comfort.

[0781] A "server" is a central device or system that manages and processes data in a centralized manner over a network.

[0782] This invention provides a system for monitoring employee activities and managing risks. Its main components include terminals, servers, and an emotion engine.

[0783] The terminal functions as a user information processing device, monitoring operations in real time. Specifically, it records key inputs and application usage history, and collects user conversation data using a voice input device. This voice data is then transferred to the emotion engine.

[0784] The emotion engine is software that analyzes voice data and implements algorithms to detect the user's emotional state. This engine uses voice signal processing technology to quantify emotions such as stress and anxiety, and provides data for analysis.

[0785] The server is a central device that aggregates and analyzes operation logs, conversation data, and sentiment information transmitted from terminals. Using AI models and machine learning algorithms, the server performs anomaly detection. Specifically, it compares the data against normal operation patterns and notifies the administrator if an anomaly is detected. It also determines that an anomaly occurs if the sentiment information deviates from the normal range.

[0786] For example, if a user repeatedly accesses confidential data in a short period of time, and the emotion engine detects a high stress level, the server will consider this situation abnormal and send an alert to the administrator. In this case, the server will restrict the user's network access as needed to reduce the risk of information leakage.

[0787] Furthermore, the server uses employee emotional data to provide feedback for improving the work environment. For example, if a user experiences prolonged periods of high stress, it may display a message suggesting a break, thereby promoting a better work environment.

[0788] By using a generative AI model, the server can quickly and efficiently detect anomalies and provide information to administrators. For example, by entering a prompt such as, "The user is attempting to access the same confidential file multiple times in a short period of time, and the emotion engine has detected high stress levels. Could you please provide a risk assessment for this situation?", the AI ​​will provide an appropriate decision.

[0789] The flow of the specific processing in Example 2 will be explained using Figure 13.

[0790] Step 1:

[0791] The terminal acts as a user information processing device, monitoring keystrokes and application usage history in real time. It receives physical keystrokes and application event logs as input. By collecting this data and storing it in a database, it generates a user operation log.

[0792] Step 2:

[0793] The terminal collects conversational data interactively from the user using a voice input device. It receives voice signals as input and saves them as audio files. This audio data is preprocessed to prepare it for transmission to the emotion engine as voice data.

[0794] Step 3:

[0795] The emotion engine receives audio data transmitted from the device and extracts emotional information using an audio signal analysis algorithm. By taking audio data as input and applying phoneme analysis and emotion recognition algorithms, it outputs stress and emotional states as numerical data. This enables real-time monitoring of the user's emotional state.

[0796] Step 4:

[0797] The server receives operation logs, conversation data, and sentiment information collected from terminals. To analyze this data, it uses AI models and machine learning algorithms to detect anomalies by comparing them to normal patterns. It receives operation logs and sentiment data as input and runs an anomaly detection model to output abnormal conditions.

[0798] Step 5:

[0799] The server notifies the administrator of any detected anomalies. Specifically, it not only displays alert messages on the management screen but also sends them to the administrator via email and SMS. It receives anomaly detection results as input and outputs alerts to the notification system.

[0800] Step 6:

[0801] The server generates feedback suggesting improvements to the user's work environment based on the analyzed emotional information. It receives emotional data and work history as input, and outputs appropriate change suggestions to the user through a feedback algorithm. For example, if prolonged high stress is detected, a message encouraging a break will be displayed on the user's screen.

[0802] (Application Example 2)

[0803] Next, we will explain application example 2. In the following explanation, the data processing device 12 will be referred to as the "server" and the robot 414 as the "terminal".

[0804] Conventional employee activity monitoring systems lack sufficient means to reduce the risk of information leaks and harassment, particularly in their inadequate real-time anomaly detection and emotion analysis. Furthermore, they fail to provide adequate immediate notifications to managers and proper feedback for improving the work environment.

[0805] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means.

[0806] In this invention, the server includes means for monitoring the operation of an employee's information processing device, means for analyzing conversation data collected using a voice input device, and emotion processing means for analyzing the user's emotions from the operation and conversation data. This enables real-time anomaly detection, reduces the risk of information leakage and harassment through prompt notification to administrators, and contributes to improving the work environment.

[0807] An "employee" is a person who is employed by a company or organization and performs duties.

[0808] An "information processing device" is a general term for any device that can input, process, and output data, and includes computers and smart devices.

[0809] "Means for monitoring operations" refers to technologies and devices for recording and analyzing a series of operations and actions performed on an information processing device used by an employee.

[0810] A "voice input device" is a device used to collect human voice as digital data, and includes a microphone and a dedicated sensor.

[0811] "Conversation data" refers to text data and audio data generated based on human speech collected through voice input devices.

[0812] "Emotional processing means" refers to technologies and devices that analyze audio data and other inputs, recognize the emotions contained within them, and generate them as data.

[0813] "Means for detecting anomalies" refer to technologies and devices for identifying patterns or situations that deviate from normal operations or behaviors and recognizing them as risks.

[0814] "Means of notifying administrators" refers to technologies and devices that quickly transmit information to relevant parties when an anomaly is detected in the system.

[0815] "Means of restricting operation" refers to technologies or devices that restrict the functions of an information processing device or control access to it in order to prevent it from performing fraudulent or dangerous actions.

[0816] A "cloud computing device" is a server or network system that allows data processing and storage to be performed remotely via the internet.

[0817] "Means of sending warnings in real time" refers to technologies and devices that immediately send warning information to administrators when an anomaly occurs.

[0818] "Means of providing feedback" refer to technologies and devices that present areas for improvement and useful information based on the state of the user or system.

[0819] This system aims to detect anomalies and promptly notify administrators by monitoring employee operations on information processing devices and analyzing conversation data in real time. The system mainly consists of terminals, servers, voice input devices, emotion processing engines, and cloud computing devices.

[0820] The terminal is a device for monitoring user actions in real time, collecting conversational data using a voice input device in addition to key input and application usage history. This data is analyzed by an emotion processing engine to recognize the user's emotional state.

[0821] The server receives operation logs, conversation data, and sentiment data sent from the terminal. The received data is analyzed using AI and machine learning models, and anomalies are detected by comparing them to normal operation patterns. If an anomaly is detected, the server sends a warning to the administrator in real time and restricts the operation of the information processing device as necessary. This makes it possible to reduce the risk of information leakage and harassment.

[0822] As a concrete example, in an office environment, if an employee accesses confidential information during normal working hours while exhibiting a high stress level, the emotion processing engine identifies this as abnormal, and the server immediately notifies the administrator. Upon receiving the notification, the administrator can view the details through the system's dashboard and take necessary actions quickly. This enables rapid risk management.

[0823] As an example of a prompt for a generative AI model, you could use the text, "Generate code to detect risk when an employee exhibits typical non-work-related behavior and high levels of stress."

[0824] The flow of a specific process in Application Example 2 will be explained using Figure 14.

[0825] Step 1:

[0826] The terminal monitors user actions and collects input logs and voice input data. This data includes application usage history, keystrokes, and voice data captured from the microphone. This ensures that all monitorable actions and conversation data are entered.

[0827] Step 2:

[0828] The device sends the collected audio data to the emotion processing engine. The emotion processing engine analyzes the audio data and recognizes emotional information. Specifically, it extracts features from the audio data and identifies emotions such as stress and anger using a machine learning model. This results in the output of the emotion analysis results.

[0829] Step 3:

[0830] The server receives operation logs, conversation data, and sentiment information sent from the terminal. The server analyzes the data using AI and machine learning models and detects anomalies by comparing it to normal operation patterns. The input is operation and sentiment data, and the output is information about the presence or absence of anomalies.

[0831] Step 4:

[0832] If the server detects an anomaly, it will notify the administrator in real time. Specifically, the notification system will generate and send alerts via email and to a dedicated dashboard. This provides administrators with the information they need to take immediate action.

[0833] Step 5:

[0834] In response to any anomalies detected by the server, the operation of the information processing device will be restricted. This includes controlling network access and disabling specific functions. These restrictions are implemented to minimize the risk of information leakage and fraudulent activity.

[0835] Step 6:

[0836] Based on the information provided, administrators monitor user behavior and, if necessary, provide direct feedback and make environmental adjustments. At this stage, measures are taken to improve the user's work environment, taking into account the collected sentiment data.

[0837] The specific processing unit 290 transmits the result of the specific processing to the robot 414. In the robot 414, the control unit 46A causes the speaker 240 and the controlled object 443 to output the result of the specific processing. The microphone 238 acquires audio indicating user input for the result of the specific processing. The control unit 46A transmits the audio data indicating user input acquired by the microphone 238 to the data processing unit 12. In the data processing unit 12, the specific processing unit 290 acquires the audio data.

[0838] Data generation model 58 is a type of so-called generative AI (Artificial Intelligence). One example of data generation model 58 is ChatGPT (Internet search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search) <url: https: gemini.google.com ?hl="ja">Examples of generative AI include the following. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 is input with prompts containing instructions, and with inference data such as audio data representing speech, text data representing text, and image data representing images. The data generation model 58 infers from the input inference data according to the instructions indicated by the prompts, and outputs the inference results in data formats such as audio data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0839] In the above embodiment, an example was given in which the specific processing is performed by the data processing device 12, but the technology of this disclosure is not limited thereto, and the specific processing may also be performed by the robot 414.

[0840] Furthermore, the emotion identification model 59, acting as an emotion engine, may determine the user's emotion according to a specific mapping. Specifically, the emotion identification model 59 may determine the user's emotion according to a specific mapping, which is an emotion map (see Figure 9). Similarly, the emotion identification model 59 may also determine the robot's emotion, and the identification processing unit 290 may perform identification processing using the robot's emotion.

[0841] Figure 9 shows an emotion map 400 in which multiple emotions are mapped. In the emotion map 400, emotions are arranged in concentric circles radiating from the center. The closer to the center of the concentric circles, the more primitive the emotions are located. Further out of the concentric circles, emotions representing states and actions arising from mental states are located. Emotion is a concept that includes feelings and mental states. On the left side of the concentric circles, emotions that are generally generated from reactions occurring in the brain are located. On the right side of the concentric circles, emotions that are generally induced by situational judgment are located. Above and below the concentric circles, emotions that are generally generated from reactions occurring in the brain and induced by situational judgment are located. In addition, the emotion of "pleasure" is located on the upper side of the concentric circles, and the emotion of "displeasure" is located on the lower side. Thus, in the emotion map 400, multiple emotions are mapped based on the structure in which emotions arise, and emotions that are likely to occur simultaneously are mapped close together.

[0842] These emotions are distributed at the 3 o'clock position on the Emotion Map 400, and usually fluctuate between feelings of security and anxiety. In the right half of the Emotion Map 400, situational awareness takes precedence over internal feelings, resulting in a calm impression.

[0843] The inside of the Emotion Map 400 represents inner thoughts, while the outside represents actions. Therefore, the further you go from the outside of the Emotion Map 400, the more visible (expressed in actions) your emotions become.

[0844] Here, human emotions are based on various balances, such as posture and blood sugar levels. When these balances deviate from the ideal, it results in discomfort, and when they approach the ideal, it results in pleasure. Similarly, in robots, cars, motorcycles, etc., emotions can be created based on various balances, such as posture and battery level. When these balances deviate from the ideal, it results in discomfort, and when they approach the ideal, it results in pleasure. The emotion map can be generated, for example, based on Dr. Mitsuyoshi's emotion map (Research on a system for analyzing brain physiological signals of speech emotion recognition and emotion, Tokushima University, doctoral dissertation: https: / / ci.nii.ac.jp / naid / 500000375379). The left half of the emotion map contains emotions belonging to a region called "response," where sensation is dominant. The right half of the emotion map contains emotions belonging to a region called "situation," where situational awareness is dominant.

[0845] The emotion map defines two emotions that promote learning. One is the emotion around the middle of the negative "repentance" and "reflection" on the situation side. In other words, it is when the robot experiences negative emotions such as "I never want to feel this way again" or "I don't want to be scolded again." The other is the emotion around the positive "desire" on the reaction side. In other words, it is when the robot has positive feelings such as "I want more" or "I want to know more."

[0846] The emotion identification model 59 inputs user input into a pre-trained neural network, obtains emotion values ​​representing each emotion shown in the emotion map 400, and determines the user's emotion. This neural network is pre-trained based on multiple training data sets, which are combinations of user input and emotion values ​​representing each emotion shown in the emotion map 400. Furthermore, this neural network is trained so that emotions located close together have similar values, as shown in the emotion map 900 in Figure 10. Figure 10 shows an example where multiple emotions such as "reassured," "calm," and "confident" have similar emotion values.

[0847] The above description primarily focuses on the functions of the data processing device 12 in relation to this disclosure. However, the system related to this disclosure is not necessarily implemented on a server. The system related to this disclosure may be implemented as a general information processing system. This disclosure may be implemented, for example, as a software program that runs on a personal computer or as an application that runs on a smartphone. The method related to this disclosure may be provided to users in SaaS (Software as a Service) format.

[0848] In the above embodiment, an example was given in which a specific process is performed by a single computer 22. However, the technology of this disclosure is not limited thereto, and a distributed processing of the specific process may be performed by multiple computers, including computer 22. For example, a data generation model 58 may be provided in an external device of the data processing device 12, and the external device may generate data according to the input data.

[0849] In the above embodiment, an example was given in which the specific processing program 56 is stored in the storage 32, but the technology of this disclosure is not limited thereto. For example, the specific processing program 56 may be stored in a portable, computer-readable, non-temporary storage medium such as a USB (Universal Serial Bus) memory. The specific processing program 56 stored in the non-temporary storage medium is installed in the computer 22 of the data processing device 12. The processor 28 executes specific processing according to the specific processing program 56.

[0850] Alternatively, the specific processing program 56 may be stored in a storage device such as a server connected to the data processing device 12 via the network 54, and the specific processing program 56 may be downloaded and installed on the computer 22 in response to a request from the data processing device 12.

[0851] Furthermore, it is not necessary to store the entirety of the specific processing program 56 in a storage device such as a server connected to the data processing device 12 via the network 54, or to store the entirety of the specific processing program 56 in the storage 32; it is acceptable to store only a portion of the specific processing program 56.

[0852] The following types of processors can be used as hardware resources to perform specific processing. Examples of processors include a CPU, a general-purpose processor that functions as a hardware resource to perform specific processing by executing software, i.e., a program. Other examples of processors include dedicated electrical circuits, such as FPGAs (Field-Programmable Gate Arrays), PLDs (Programmable Logic Devices), or ASICs (Application Specific Integrated Circuits), which have circuit configurations specifically designed to perform specific processing. All of these processors have built-in or connected memory, and all of them perform specific processing by using memory.

[0853] The hardware resource that performs a specific process may consist of one of these various processors, or it may consist of a combination of two or more processors of the same or different types (for example, a combination of multiple FPGAs, or a combination of a CPU and an FPGA). Alternatively, the hardware resource that performs a specific process may consist of a single processor.

[0854] Examples of configurations using a single processor include, firstly, a configuration in which one or more CPUs and software are combined to form a single processor, and this processor functions as a hardware resource that performs a specific process. Secondly, there is a configuration using a processor that realizes the functions of the entire system, including multiple hardware resources that perform a specific process, on a single IC chip, as exemplified by SoCs (System-on-a-chip). In this way, a specific process is realized using one or more of the above types of processors as hardware resources.

[0855] Furthermore, the hardware structure of these various processors can more specifically utilize electrical circuits that combine circuit elements such as semiconductor devices. Also, the specific processing described above is merely an example. Therefore, it goes without saying that unnecessary steps can be deleted, new steps added, or the processing order rearranged, as long as it does not deviate from the main purpose.

[0856] The descriptions and illustrations presented above are detailed explanations of the technical aspects of this disclosure and are merely examples of the technical aspects. For example, the above descriptions of the structure, function, operation, and effect are examples of the structure, function, operation, and effect of the technical aspects of this disclosure. Therefore, it goes without saying that you may delete unnecessary parts, add new elements, or replace elements in the descriptions and illustrations presented above, as long as you do not deviate from the essence of the technical aspects of this disclosure. Furthermore, in order to avoid confusion and facilitate understanding of the technical aspects of this disclosure, explanations of common technical knowledge and the like that do not require special explanation to enable the implementation of the technical aspects of this disclosure have been omitted from the descriptions and illustrations presented above.

[0857] All documents, patent applications, and technical standards described herein are incorporated by reference to the same extent as if each individual document, patent application, and technical standard were specifically and individually noted to be incorporated by reference.

[0858] The following is further disclosed regarding the embodiments described above.

[0859] (Claim 1)

[0860] Means for monitoring the operation of an employee's information processing device,

[0861] A means for analyzing conversational data collected using a voice input device,

[0862] Means for detecting abnormalities in the aforementioned operations or conversation data and notifying the administrator,

[0863] Means for restricting the operation of the information processing device in response to detected anomalies,

[0864] A system that includes this.

[0865] (Claim 2)

[0866] The system according to claim 1, comprising means for analyzing collected operation or conversation data using a cloud computing device.

[0867] (Claim 3)

[0868] The system according to claim 1, comprising means for sending a warning to an administrator in real time based on analysis.

[0869] "Example 1"

[0870] (Claim 1)

[0871] Means for monitoring operations on a user's computing device,

[0872] A means for recording audio data collected using a voice input device based on specific words or phrases,

[0873] Means for detecting abnormalities in the aforementioned operations or audio data and transmitting a warning to the administrator's computer,

[0874] Means for restricting communication access or functionality of the user's computing device in response to detected anomalies,

[0875] A means of analyzing operation and voice data using generative AI technology,

[0876] A system that includes this.

[0877] (Claim 2)

[0878] The system according to claim 1, comprising means for analyzing collected operation or audio data with a data processing device.

[0879] (Claim 3)

[0880] The system according to claim 1, comprising means for immediately notifying an administrator based on analysis.

[0881] "Application Example 1"

[0882] (Claim 1)

[0883] Means for monitoring procedures on electronic devices used by employees,

[0884] A means of analyzing conversational information collected using the amount of voice input,

[0885] Means for identifying abnormalities in the aforementioned procedures or conversation information and reporting them to the administrator,

[0886] Means for restricting the operation of an electronic device in response to an identified anomaly,

[0887] A means of notifying the administrator's mobile terminal via a communication device,

[0888] A system that includes this.

[0889] (Claim 2)

[0890] The system according to claim 1, comprising means for analyzing collected procedure or conversation information with a remote processing device.

[0891] (Claim 3)

[0892] The system according to claim 1, comprising means for immediately sending a warning to an administrator based on analysis.

[0893] "Example 2 of combining an emotion engine"

[0894] (Claim 1)

[0895] Means for monitoring the operation of an employee's information processing device,

[0896] A means of analyzing conversational data collected using a voice input device to recognize emotions,

[0897] Means for detecting abnormalities in the aforementioned operation or conversation data and recognized emotion information and notifying the administrator,

[0898] Means for restricting the operation of the information processing device in response to detected anomalies,

[0899] Based on the analysis results, a means of proposing improvements to the work environment to employees,

[0900] A system that includes this.

[0901] (Claim 2)

[0902] The system according to claim 1, comprising means for analyzing collected operation or conversation data and emotional information using a computing device.

[0903] (Claim 3)

[0904] The system according to claim 1, comprising means for sending a warning to an administrator in real time based on analysis.

[0905] "Application example 2 when combining with an emotional engine"

[0906] (Claim 1)

[0907] Means for monitoring the operation of an employee's information processing device,

[0908] A means for analyzing conversational data collected using a voice input device,

[0909] An emotion processing means for analyzing the user's emotions from the aforementioned operations and conversation data,

[0910] Means for detecting anomalies in the aforementioned operations, conversation data, or emotion data and notifying the administrator,

[0911] A means for restricting the operation of the information processing device in response to detected anomalies and sending a real-time warning to the administrator,

[0912] A system that includes this.

[0913] (Claim 2)

[0914] The system according to claim 1, comprising means for analyzing collected operation, conversation data, and emotion data using a cloud computing device.

[0915] (Claim 3)

[0916] The system according to claim 1, comprising means for providing feedback based on the user's emotional state and improving the work environment. [Explanation of Symbols]

[0917] 10, 210, 310, 410 Data Processing Systems 12 Data Processing Devices 14 Smart Devices 214 Smart Glasses 314 Headset-type terminal 414 Robots< / url:> < / url:> < / url:> < / url:>

Claims

1. Means for monitoring the operation of an employee's information processing device, A means for analyzing conversational data collected using a voice input device, Means for detecting abnormalities in the aforementioned operations or conversation data and notifying the administrator, Means for restricting the operation of the information processing device in response to detected anomalies, A system that includes this.

2. The system according to claim 1, further comprising means for analyzing collected operation or conversation data using a cloud computing device.

3. The system according to claim 1, further comprising means for sending a warning to an administrator in real time based on analysis.

Images