system

Abstract

We provide the system. [Solution] A means for receiving data acquired from a data collection device, A means for preprocessing received data and converting data of different formats into a unified format, A means for detecting anomalies based on a machine learning algorithm using preprocessed data, A means of notifying users of alerts based on anomaly detection, A means of proposing countermeasures for abnormalities, A system that includes this.

Description

Technical Field

[0001] The technology of the present disclosure relates to a system.

Background Art

[0002] Patent Document 1 discloses a method for controlling a persona chatbot, which is performed by at least one processor, including steps of receiving a user utterance, adding the user utterance to a prompt including an instruction sentence related to an explanation of a chatbot character, encoding the prompt, and inputting the encoded prompt into a language model to generate a chatbot utterance in response to the user utterance.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] In small and medium - sized enterprises, due to the lack of professional security personnel, it is difficult to cope with advanced cyber threats, and new cyberattacks exploiting AI and machine learning are evolving. Therefore, there is a demand for providing a security system that can detect threats in real - time, respond immediately, and is easy to introduce and operate at a low cost.

Means for Solving the Problems

[0005] This invention provides a system that centrally manages multiple data formats by receiving data acquired from a data collection device and converting that data into a unified format using a data preprocessor. Subsequently, it uses a machine learning algorithm to detect anomalies in real time. When an anomaly is detected, it notifies the user with an alert and immediately proposes countermeasures, thereby providing a system that enables even small and medium-sized enterprises to efficiently respond to cyber threats.

[0006] A "data collection device" refers to equipment or systems that acquire data from networks or IoT devices.

[0007] A "unified format" refers to a data format that improves the efficiency of analysis and management by converting data in different formats into a consistent format.

[0008] A "preprocessing device" refers to a device or system that has the function of removing noise from acquired data and converting it into a format suitable for analysis.

[0009] A "machine learning algorithm" refers to a method based on mathematical models used to analyze data and detect patterns and anomalies.

[0010] "Real-time analysis" refers to the process of performing analysis immediately upon data collection, and includes features that enable rapid response.

[0011] An "alert" refers to warning information sent to users when an anomaly is detected.

[0012] "User" refers to an individual or organization that uses this system to perform security management.

[0013] "Countermeasures" refer to specific actions or measures taken to mitigate or eliminate risks in response to detected anomalies. [Brief explanation of the drawing]

[0014] [Figure 1] It is a conceptual diagram showing an example of the configuration of a data processing system according to the first embodiment. [Figure 2] It is a conceptual diagram showing an example of the main functions of a data processing device and a smart device according to the first embodiment. [Figure 3] It is a conceptual diagram showing an example of the configuration of a data processing system according to the second embodiment. [Figure 4] It is a conceptual diagram showing an example of the main functions of a data processing device and smart glasses according to the second embodiment. [Figure 5] It is a conceptual diagram showing an example of the configuration of a data processing system according to the third embodiment. [Figure 6] It is a conceptual diagram showing an example of the main functions of a data processing device and a headset-type terminal according to the third embodiment. [Figure 7] It is a conceptual diagram showing an example of the configuration of a data processing system according to the fourth embodiment. [Figure 8] It is a conceptual diagram showing an example of the main functions of a data processing device and a robot according to the fourth embodiment. [Figure 9] It shows an emotion map to which a plurality of emotions are mapped. [Figure 10] It shows an emotion map to which a plurality of emotions are mapped. [Figure 11] It is a sequence diagram showing the processing flow of the data processing system in Example 1. [Figure 12] It is a sequence diagram showing the processing flow of the data processing system in Application Example 1. [Figure 13] It is a sequence diagram showing the processing flow of the data processing system in Example 2 when an emotion engine is combined. [Figure 14] It is a sequence diagram showing the processing flow of the data processing system in Application Example 2 when an emotion engine is combined.

MODE FOR CARRYING OUT THE INVENTION

[0015] Hereinafter, an example of an embodiment of the system according to the technology of the present disclosure will be described with reference to the accompanying drawings.

[0016] First, the terms used in the following description will be explained.

[0017] In the following embodiments, the numbered processor (hereinafter simply referred to as "processor") may be a single arithmetic unit or a combination of multiple arithmetic units. Also, the processor may be a single type of arithmetic unit or a combination of multiple types of arithmetic units. Examples of arithmetic units include a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), a GPGPU (General-Purpose computing on Graphics Processing Units), an APU (Accelerated Processing Unit), and the like.

[0018] In the following embodiments, the numbered RAM (Random Access Memory) is a memory in which information is temporarily stored and is used as a work memory by the processor.

[0019] In the following embodiments, the numbered storage is one or more non-volatile storage devices that store various programs and various parameters, etc. Examples of non-volatile storage devices include flash memory (SSD (Solid State Drive)), magnetic disks (e.g., hard disks), or magnetic tapes, etc.

[0020] In the following embodiments, the signed communication interface (I / F) is an interface that includes a communication processor and an antenna, etc. The communication interface manages communication between multiple computers. Examples of communication standards applicable to the communication interface include wireless communication standards such as 5G (5th Generation Mobile Communication System), Wi-Fi (registered trademark), or Bluetooth (registered trademark).

[0021] In the following embodiments, "A and / or B" is synonymous with "at least one of A and B." That is, "A and / or B" means that it may be A alone, or B alone, or a combination of A and B. Furthermore, in this specification, the same concept as "A and / or B" applies when expressing three or more things linked by "and / or."

[0022] [First Embodiment]

[0023] Figure 1 shows an example of the configuration of the data processing system 10 according to the first embodiment.

[0024] As shown in Figure 1, the data processing system 10 includes a data processing device 12 and a smart device 14. An example of the data processing device 12 is a server.

[0025] The data processing device 12 comprises a computer 22, a database 24, and a communication interface 26. The computer 22 is an example of a "computer" related to the technology of this disclosure. The computer 22 comprises a processor 28, RAM 30, and storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication interface 26 are also connected to the bus 34. The communication interface 26 is connected to a network 54. An example of the network 54 is a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0026] The smart device 14 comprises a computer 36, a reception device 38, an output device 40, a camera 42, and a communication interface 44. The computer 36 comprises a processor 46, RAM 48, and storage 50. The processor 46, RAM 48, and storage 50 are connected to a bus 52. The reception device 38, output device 40, and camera 42 are also connected to the bus 52.

[0027] The reception device 38 is equipped with a touch panel 38A and a microphone 38B, etc., and receives user input. The touch panel 38A receives user input by detecting contact with an object (e.g., a pen or finger). The microphone 38B receives user input by detecting the user's voice. The control unit 46A transmits data indicating the user input received by the touch panel 38A and microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the data indicating the user input.

[0028] The output device 40 includes a display 40A and a speaker 40B, and presents data to the user 20 by outputting the data in a form perceptible to the user 20 (e.g., audio and / or text). The display 40A displays visible information such as text and images according to instructions from the processor 46. The speaker 40B outputs audio according to instructions from the processor 46. The camera 42 is a small digital camera equipped with an optical system such as a lens, aperture, and shutter, and an image sensor such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor.

[0029] Communication interface 44 is connected to network 54. Communication interfaces 44 and 26 are responsible for the exchange of various types of information between processor 46 and processor 28 via network 54.

[0030] Figure 2 shows an example of the main functions of the data processing device 12 and the smart device 14.

[0031] As shown in Figure 2, in the data processing device 12, a specific processing is performed by the processor 28. A specific processing program 56 is stored in the storage 32. The specific processing program 56 is an example of a "program" related to the technology of this disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 according to the specific processing program 56 executed on the RAM 30.

[0032] The storage 32 stores the data generation model 58 and the emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0033] In the smart device 14, the processor 46 performs the reception output processing. The storage 50 stores the reception output program 60. The reception output program 60 is used in conjunction with a specific processing program 56 by the data processing system 10. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output processing is realized by the processor 46 operating as a control unit 46A according to the reception output program 60 executed on the RAM 48.

[0034] Next, the specific processing performed by the specific processing unit 290 of the data processing device 12 will be described. In the following description, the data processing device 12 will be referred to as the "server" and the smart device 14 as the "terminal".

[0035] This invention includes a system for addressing security challenges faced by small and medium-sized enterprises. The system aims to receive data from various network and IoT devices via a data collection device, process this data in real time, and quickly and effectively identify threats.

[0036] First, the server collects log information and video data from each terminal and IoT device connected to the network (e.g., surveillance cameras and door sensors). Since this data is in various formats, the server converts it into a unified format and prepares it for analysis. At this stage, noise is removed, and redundant data that is not necessary for analysis is eliminated.

[0037] Next, the server uses the formatted data to detect anomalies using a machine learning algorithm. This algorithm is designed to model normal operating patterns and detect actions that deviate from them. For example, if a terminal transfers data far exceeding the normal range, it will be judged as an anomaly.

[0038] If an anomaly is detected, the server immediately generates an alert and transmits the information to the relevant user (e.g., network administrator). This alert provides appropriate countermeasures based on the situation, allowing users to respond quickly to threats. The countermeasures are specific and recommend actions such as restricting suspicious access.

[0039] Furthermore, the servers regularly retrain their machine learning algorithm models with new data, ensuring they are always able to effectively respond to the latest threats. This retraining process maintains system accuracy and enables flexible responses to evolving security threats.

[0040] In this way, the present invention provides a concrete method for solving the complex security challenges faced by small and medium-sized enterprises and for achieving advanced threat detection and rapid response. This system is expected to reduce security risks and streamline management within companies.

[0041] The following describes the processing flow.

[0042] Step 1:

[0043] The server collects data from each terminal and IoT device connected to the network. Specifically, this includes network logs, operating status from each device, and sensor information. Because this data is in various formats, it is converted to a unified format in the next step.

[0044] Step 2:

[0045] The server preprocesses the collected data and converts it into a unified format. This includes data standardization, noise reduction, and data imputation. This process ensures that data obtained from different devices can be consistently analyzed.

[0046] Step 3:

[0047] The server inputs pre-processed data into a machine learning model to perform anomaly detection. This model is trained on normal patterns and identifies abnormal behavior or actions that are considered cyberattacks. For example, it can detect sudden data transfers or unauthorized access attempts.

[0048] Step 4:

[0049] When an anomaly is detected, the server generates an alert. This alert is immediately sent to the relevant users, such as network administrators. The alert includes detailed information such as the type of anomaly, the time it occurred, and the scope of its impact.

[0050] Step 5:

[0051] The server proposes countermeasures for detected anomalies. These proposals are made automatically and may include, for example, restricting access from specific devices or blacklisting suspicious IP addresses. Users can then quickly implement these countermeasures.

[0052] Step 6:

[0053] The server periodically retrains its machine learning models with new data to maintain system accuracy. This process allows the system to continuously adapt to new threats. Since retraining is performed as an automated system process, no additional management is required from the user.

[0054] (Example 1)

[0055] Next, we will describe Example 1. In the following description, the data processing device 12 will be referred to as the "server," and the smart device 14 will be referred to as the "terminal."

[0056] The problem that this invention aims to solve is to provide a system that can effectively and quickly respond to the increasing information security risks in small and medium-sized enterprises. Conventional methods have made it difficult to deal with complex security problems within limited resources and technical constraints. Therefore, there is a need for a system that can detect anomalies in real time, automatically propose the optimal countermeasures, and flexibly adapt to new threats.

[0057] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 1 is realized by the following means.

[0058] In this invention, the server includes means for receiving information acquired from network devices, means for preprocessing the received information and converting information in different formats into a unified format, and means for detecting anomalies based on an automatic learning function using the preprocessed information. This enables real-time anomaly detection and the proposal of appropriate countermeasures, thereby reducing information security risks for small and medium-sized enterprises and streamlining management.

[0059] "Network equipment" refers to all devices connected to a communication network that are used to send and receive data.

[0060] "Information" refers to digital data used for security analysis, such as log data and video data acquired from network devices.

[0061] "Preprocessing" refers to processes such as noise reduction and format conversion that are performed to prepare collected information into an analyzable format.

[0062] A "unified format" refers to a data format that converts information in various forms into a consistent representation suitable for analysis.

[0063] "Automatic learning function" refers to a machine learning algorithm used to detect patterns in data and identify anomalies.

[0064] "Anomaly" refers to a state that indicates suspicious activity or data transfer that deviates from the normal operating pattern.

[0065] A "warning" refers to a notification that alerts the user to a detected abnormal condition.

[0066] "Countermeasures" refer to specific guidelines and procedures to be taken in response to detected anomalies.

[0067] "Retraining" refers to the process of updating learning algorithms using the latest data to improve the accuracy of automated learning functions.

[0068] "Immediate analysis" refers to performing analysis immediately after data is collected, and detecting and reporting anomalies right away.

[0069] The invented system was developed to manage corporate information security and efficiently detect anomalies. In this system, a server plays a central role. The server collects information from network devices and multiple terminals and analyzes that information in real time.

[0070] The server acquires log data and video data from network devices and terminals through pre-configured protocols. Since this data is typically in various formats such as JSON or XML, the server converts it to a unified format. This conversion process uses programming languages ​​such as Python and Java (registered trademark) to perform data normalization and noise reduction.

[0071] The collected information is analyzed by a machine learning algorithm running on the server. The algorithm used here employs an anomaly detection model designed to detect abnormal behavior. This model learns normal behavioral patterns, evaluates deviations from them in real time, and identifies them as anomalies. When an anomaly is detected, the server immediately alerts the user and suggests countermeasures. These countermeasures may include restricting suspicious access or changing access permissions.

[0072] Furthermore, the servers regularly retrain their machine learning models with new data to address evolving security threats. This process continuously optimizes the accuracy and effectiveness of the models.

[0073] As a concrete example, if abnormal access occurs to the network in a certain office, the server immediately detects the anomaly and sends a warning to the user, who is the security officer. At this time, the user is presented with specific countermeasures, such as temporarily suspending security protocols or blocking the source of the unauthorized access.

[0074] An example of a prompt to input into a generative AI model is, "Please tell me about the latest anomaly detected on our network and the countermeasures." This prompt is used to get the generative AI model to suggest details of the anomaly and immediate countermeasures.

[0075] The flow of the specific processing in Example 1 will be explained using Figure 11.

[0076] Step 1:

[0077] The server receives log information and video data from network devices and individual terminals. This information is provided in various formats. The server collects this diverse data as input and outputs a unified dataset. Specifically, the server uses API calls and database queries to centrally collect information.

[0078] Step 2:

[0079] The server preprocesses the collected information and converts data in different formats into a unified format. It takes the raw data collected in the previous step as input and creates data formatted for analysis as output. Specifically, it uses a Python script to normalize the data and remove unnecessary noise.

[0080] Step 3:

[0081] The server uses automated learning capabilities to detect anomalies based on formatted data. It uses pre-processed data as input and generates detection results indicating the presence or absence of anomalies as output. Specifically, it feeds data into a trained machine learning model and identifies data that deviates from normal patterns.

[0082] Step 4:

[0083] When an anomaly is detected, the server notifies the user of a warning. It receives the anomaly detection result as input and generates a warning message to be sent to the user as output. Specifically, the server sends an alert to the network administrator via the email system.

[0084] Step 5:

[0085] The server proposes specific countermeasures for detected anomalies. It takes the anomaly detection results as input and presents recommended countermeasures as output. Specifically, the server refers to past countermeasures recorded in the database and displays the suggestions on the user dashboard.

[0086] Step 6:

[0087] The server periodically retrains its automated learning model using the latest data. It uses newly collected data as input and outputs the updated model results. Specifically, the server generates a new dataset, feeds it into the AI ​​model, and performs a retraining process to improve the model's accuracy.

[0088] (Application Example 1)

[0089] Next, we will explain Application Example 1. In the following explanation, the data processing device 12 will be referred to as the "server," and the smart device 14 will be referred to as the "terminal."

[0090] Small and medium-sized enterprises (SMEs) face the challenge of implementing effective security measures with limited resources. Furthermore, traditional systems struggle with real-time anomaly detection and the rapid proposal of countermeasures based on these detections, potentially increasing security risks. Additionally, tracking past warning history and monitoring the progress of machine learning models becomes cumbersome, complicating management.

[0091] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 1 is realized by the following means.

[0092] In this invention, the server includes means for receiving information acquired from a data collection device, means for preprocessing the received information and converting information in different formats into a unified format, means for detecting anomalies based on a machine learning method using the preprocessed information, means for checking past warning history on a terminal device, and means for periodically retraining the machine learning method using new information. This enables efficient and effective resolution of security challenges faced by small and medium-sized enterprises, and allows for real-time anomaly detection and rapid response.

[0093] A "data collection device" is a device used to acquire data from various information sources, and it has the function of collecting information from network-connected information terminals, IoT devices, and other similar devices.

[0094] "Preprocessing" refers to the process of converting information in different formats into a unified, analyzable format, and includes noise reduction and removal of unnecessary data.

[0095] "Machine learning techniques" refer to algorithms that learn patterns and rules from data to detect anomalies in a target, and are primarily used to build predictive models based on past data.

[0096] Anomaly detection is the process of identifying behaviors or information that deviate from normal operating patterns, and it is a means to enable rapid security responses.

[0097] "Warning History Confirmation" is a function for tracking and managing records of warnings and alerts that have occurred in the past, and is used to identify the cause of problems and to formulate future countermeasures.

[0098] "Retraining" refers to the process of updating machine learning models with new information to keep them up-to-date, enabling flexible responses to evolving security threats.

[0099] A "terminal device" is a device with computing resources that can be directly operated by a user, and is used to receive information from security systems and to check history.

[0100] The system for implementing this invention is primarily built on the interaction between a server and terminal devices. The server is responsible for acquiring information from various networks and IoT devices via a data collection device. Since this information often arrives in an unstructured format, the server performs preprocessing to convert the information into a unified format. Data preprocessing includes noise reduction and removal of redundant information, and is mainly implemented using Python.

[0101] Subsequently, the server utilizes TENSORFLOW® to perform anomaly detection based on machine learning techniques. This is designed to learn normal operating patterns and immediately detect deviations. When an anomaly is detected, a real-time warning is sent to the terminal device via Firebase. The terminal device has a function to check past warning history, which users can use to track the cause of problems and perform post-incident analysis.

[0102] To maintain the accuracy of machine learning models, the servers retrain the models using new information. This retraining process utilizes an ever-evolving dataset to flexibly respond to the latest security threats.

[0103] For example, if data access exceeds normal operating limits during nighttime hours, the server immediately detects the anomaly and sends a warning to the terminal device. Based on this warning, administrators can take swift action, such as blocking access.

[0104] An example of a prompt message for a generated AI model might be: "Review recent data collection logs, identify any potentially anomalous patterns, and create an endpoint to alert the affected users." Utilizing this prompt message can support the development of more advanced anomaly detection models.

[0105] The flow of a specific process in Application Example 1 will be explained using Figure 12.

[0106] Step 1:

[0107] The server receives information from data collection devices, networks, and IoT devices. It acquires raw information in various formats as input and prepares this information for preprocessing as output. Specifically, the server transfers log information and temporarily stores it in a receive buffer.

[0108] Step 2:

[0109] The server preprocesses the received information and converts it into a unified format. The input is information in various formats, and the output is information in a parseable, unified format. It performs processes to remove data noise and redundant information. Specifically, it uses a Python data processing library to perform data cleaning.

[0110] Step 3:

[0111] The server uses pre-processed information to perform anomaly detection using a machine learning model. It receives information in a unified format as input and generates anomaly detection results as output. The data is input into a TensorFlow model to detect deviations from normal operating patterns. Specifically, if an anomaly is detected, a flag is set and the data is passed to the next process.

[0112] Step 4:

[0113] The server uses Firebase to send alerts to terminal devices when an anomaly is detected. The input is the result of the anomaly detection, and the output is the sending of the warning message. Specifically, it sends a push notification to the administrator's terminal and displays a warning screen.

[0114] Step 5:

[0115] The terminal allows users to review their past warning history based on the warnings they receive. Input consists of warning data and history data, and output is a list of the history. Specifically, the history data is displayed as a list on the GUI, allowing the user to access detailed information.

[0116] Step 6:

[0117] The server periodically retrains the machine learning model using new information. It receives the latest dataset as input and an updated model as output. Specifically, it runs a periodic batch job to retrain the model using TensorFlow.

[0118] Step 7:

[0119] The user provides prompts to the generated AI model, assisting in its development. Inputs are prompts such as, "Review recent data collection logs, identify potentially anomalous patterns, and create an endpoint to alert the affected users." Outputs include the generated analysis model and suggestions. Specifically, the user creates model improvements based on the prompts and integrates them into the system.

[0120] Furthermore, an emotion engine that estimates the user's emotions may be incorporated. That is, the identification processing unit 290 may use the emotion identification model 59 to estimate the user's emotions and perform identification processing using the user's emotions.

[0121] This invention provides a system that enables more accurate security responses by considering the user's emotional state during data collection and anomaly detection. Specific embodiments are described below.

[0122] First, the server collects the necessary data from each terminal and IoT device connected to the network. This collected data includes network logs, surveillance camera footage, and door sensor recordings. Because this data exists in different formats, the server converts it into a unified format.

[0123] Next, the server analyzes the pre-processed data and uses machine learning algorithms to detect anomalies. These algorithms are designed to learn normal usage patterns and identify deviations from them or movements that could be considered cyberattacks. In this process, an emotion engine is introduced to recognize the user's emotional state, and based on the user's reactions and feedback, it optimizes the priority of security responses and notification methods.

[0124] If an anomaly is detected, the server generates an alert and notifies the user in real time. The alert includes details of the anomaly, as well as suggested countermeasures based on the user's emotional state. For example, if the emotion engine determines that the user is stressed, the alert will be made more concise and countermeasures will be suggested in a step-by-step manner.

[0125] Furthermore, the server customizes suggested countermeasures for anomalies based on information obtained by the emotion engine. This ensures that optimal security measures are implemented while taking into account the user's current emotional state. For example, if a system administrator is extremely busy, the emotion engine recognizes this and reduces their workload by prioritizing and presenting only high-priority information.

[0126] By incorporating an emotion engine in this way, flexible responses that take into account the user's situation become possible, enabling safe and efficient security management even for small and medium-sized enterprises.

[0127] The following describes the processing flow.

[0128] Step 1:

[0129] The server collects data from various terminals and IoT devices on the network. This data includes network logs, camera footage, and sensor operation information. Because this data is often sent in different formats, it is collected for subsequent processing.

[0130] Step 2:

[0131] The server preprocesses the collected data and standardizes its format. Specifically, it cleans the data and removes noise. Furthermore, it converts it into time-series data or structured data as needed and formats it into an analyzable format.

[0132] Step 3:

[0133] The server inputs pre-processed data into a machine learning algorithm to perform anomaly detection. This algorithm operates in real time, detecting anomalies and potential threats that deviate from normal patterns. The detection results are stored along with detailed information such as the type of anomaly and its scope of impact.

[0134] Step 4:

[0135] When an anomaly is detected, the server runs the emotion engine to evaluate the user's emotional state. The emotion engine analyzes user input and behavior logs to determine the current emotional state (e.g., stress level, concentration level, etc.). This information is used to prioritize and customize alerts.

[0136] Step 5:

[0137] Based on anomaly detection, the server generates and notifies the user of an alert. At this time, it considers the emotional state fed back by the emotion engine and adjusts the content and tone accordingly. For example, if the user is feeling stressed, a concise alert summarizing the key points will be delivered.

[0138] Step 6:

[0139] The server then proposes appropriate countermeasures for the detected anomalies. In doing so, it adjusts the method and order in which the countermeasures are presented based on the user's emotional state. For example, if there are multiple suggestions, they are presented in stages or as alternatives to minimize emotional burden.

[0140] Step 7:

[0141] The server periodically retrains its machine learning models with new datasets to maintain system accuracy. Retraining enables flexible responses to evolving threats and adaptation to changing user usage patterns over time.

[0142] (Example 2)

[0143] Next, we will describe Example 2. In the following description, the data processing device 12 will be referred to as the "server" and the smart device 14 as the "terminal".

[0144] In recent years, the increasing complexity of information and the sophistication of cyberattacks have necessitated improved accuracy in anomaly detection systems. However, conventional systems focus solely on anomaly detection, making it difficult to provide flexible response measures that take into account the user's psychological state. Therefore, there is a need for efficient notifications and response proposals that do not cause unnecessary stress to users.

[0145] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 2 is realized by the following means.

[0146] In this invention, the server includes means for receiving information acquired from data collection means, means for preprocessing the received information and converting information of different formats into a standard format, means for analyzing the preprocessed information and recognizing anomalies based on a machine learning model, means for evaluating the user's psychological state using an emotion analysis device, means for notifying a warning based on the anomaly recognition and the user's psychological state, and means for proposing countermeasures against the anomaly and adjusting the countermeasures considering the user's psychological state. This enables not only anomaly detection but also efficient and flexible security responses that take into account the user's psychological state.

[0147] "Data collection means" refers to methods and devices for acquiring data and information from networks and various information terminals.

[0148] "Means of receiving" refers to methods or devices that take in information acquired through data collection means and convert it into a format that can be processed within the system.

[0149] "Preprocessing" refers to the process of preparing acquired raw data for easier analysis, such as converting it into a standardized format.

[0150] A "standard format" refers to a unified data structure obtained by converting data in various formats into a consistent, analyzable format.

[0151] "Means for recognizing anomalies" refer to methods and devices that use machine learning models and algorithms to identify abnormal information that deviates from normal patterns.

[0152] An "emotion analysis device" is a method or device used to analyze a user's behavior and reactions and evaluate their emotional state.

[0153] "Means of notifying warnings" refers to methods or devices for communicating warnings to users about anomalies detected by the system.

[0154] "Means for proposing countermeasures" refers to methods or devices for presenting appropriate countermeasures to users in response to detected anomalies.

[0155] "Means of adjustment based on psychological state" refers to methods or devices that optimize the information and countermeasures provided to suit the user's emotions and psychological state.

[0156] This invention is a system that centrally manages information acquired from data collection devices and performs anomaly detection and analysis of users' emotional states. Specifically, it is implemented in the following procedure.

[0157] The server first collects data such as network logs, surveillance camera footage, and sensor records from various terminals and IoT devices connected to the network. Since this data exists in various formats, the server converts it all into a unified format. Database software and data management tools are used for this purpose. Specifically, SQL databases and data format conversion libraries are used.

[0158] Next, the server uses a machine learning model to analyze this preprocessed data and identify anomalies. This machine learning model is trained to model normal usage patterns and identify anomalies that deviate from them. Here, machine learning frameworks such as TensorFlow and PyTorch are used.

[0159] Subsequently, the server evaluates the user's emotional state using an emotion analysis device. This step involves speech recognition and text feedback analysis, utilizing an emotion engine to determine the user's psychological state. Natural language processing (NLP) technology is used for emotion analysis. Specific tools used include NLTK and spaCy.

[0160] When an anomaly is detected, the server immediately generates an alert and notifies the user of the details of the anomaly. This alert includes appropriate countermeasures for the anomaly, and is tailored to the user's psychological state. For example, if the user is experiencing stress, concise and easy-to-understand content is prioritized.

[0161] For example, in an office environment, if a suspicious login attempt is detected, the server immediately notifies the administrator of the information. However, if the administrator is busy with work, only high-priority information is quickly presented based on sentiment analysis.

[0162] An example of a prompt might be a question like, "What factors does this system consider when detecting anomalies and optimizing user responses based on its emotion engine?" This would deepen engineers' understanding of the specific problems they face and help them design and improve the system.

[0163] The flow of the specific processing in Example 2 will be explained using Figure 13.

[0164] Step 1:

[0165] The server receives network logs, surveillance camera footage, sensor recordings, and other data from various terminals and IoT devices as input. Because this data exists in different formats, the server uses a data management tool to convert it all into a unified format. This conversion process, by formatting the data into formats such as JSON or CSV, facilitates subsequent analysis steps. As a result, the converted data is output.

[0166] Step 2:

[0167] Using pre-processed data as input, the server performs anomaly analysis using a machine learning model. In this step, frameworks such as TensorFlow are used to reference normal usage pattern models and detect anomalies. Specifically, it identifies unusual login attempts and fluctuations in network traffic and outputs corresponding alert information. This anomaly information is used in the next step.

[0168] Step 3:

[0169] Based on the anomaly information obtained, the server uses an emotion analysis device to evaluate the user's emotional state. The input for this step consists of the anomaly information and user feedback and behavioral data. Using NLP techniques, the psychological state is inferred from voice tone and text, and the user's emotional state is output as the analysis result. For example, the evaluation might be expressed as a numerical value called StressLevel.

[0170] Step 4:

[0171] Based on anomaly information and the user's emotional state, the server generates and notifies the user of the most appropriate warning message. The inputs here are details of the anomaly and the output of the emotional analysis. Based on this, the warning message is adjusted. Specifically, if high stress levels are detected, only concise and highly important information is provided. The output is a customized alert message for the user.

[0172] Step 5:

[0173] Finally, the user takes action based on the alert received. In this step, they use the provided countermeasures to improve the situation. The user reviews the alert content and takes specific actions, such as reporting to the system administrator or strengthening security measures, as needed. As a result, it is confirmed that appropriate security measures have been taken.

[0174] (Application Example 2)

[0175] Next, we will explain application example 2. In the following explanation, the data processing device 12 will be referred to as the "server," and the smart device 14 will be referred to as the "terminal."

[0176] Conventional anomaly detection systems focus solely on purely technical data analysis and lack the ability to flexibly respond to changes in the operator's emotional state. As a result, notifications and suggestions may not be efficient for recipients when they are feeling stressed. This can make decision-making more difficult, especially in busy environments, and may compromise the timeliness of security responses.

[0177] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means.

[0178] In this invention, the server includes means for receiving information acquired from data collection means, means for preprocessing the received information and converting different types of information into a unified format, and means for detecting anomalies using machine learning techniques based on the preprocessed information. This makes it possible to detect anomalies in real time while taking into account the emotional state of the operator, and to provide appropriate notifications and countermeasures.

[0179] "Data collection means" refers to devices and methods for acquiring different types of information from networks and equipment.

[0180] "Means for receiving information" refers to methods and devices for acquiring information sent from data collection means.

[0181] "Means of preprocessing and conversion" refers to processes or devices that analyze received information and convert data in different formats into a unified format.

[0182] "Machine learning techniques" are methods that use algorithms to analyze data and detect patterns and anomalies.

[0183] "Means for detecting anomalies" refer to processes or devices that use machine learning techniques to discover unusual patterns.

[0184] "Means for evaluating the emotional state of the operator" refers to methods and technologies for analyzing and evaluating the psychological state of the user in real time.

[0185] "Means for optimizing notification content" refers to processes and technologies for adjusting how anomalies are reported and how countermeasures are suggested, based on the emotional state of the operator.

[0186] A server plays a crucial role in implementing this invention. First, the server receives information from a wide variety of data collection methods. This includes network logs, video from surveillance cameras, and sensor recordings. Since the received information may be in different formats, the server preprocesses it and converts it into a unified format.

[0187] Next, the server analyzes the unified data using machine learning techniques to detect anomalies. This process also incorporates a function to evaluate the user's emotional state based on heart rate and facial expression data obtained from the user's device. This allows the server to optimize notification content and propose more appropriate countermeasures when an anomaly is detected, taking the user's emotional state into consideration.

[0188] For example, if a user is in a stressful situation, the server will adjust its notifications to be concise and offer step-by-step suggestions to reduce the user's burden. This improves usability and allows users to take quick and appropriate action.

[0189] As a concrete example, consider network problems that occur when students are taking online classes. This system reduces user stress by allowing the server to provide a concise message such as, "The network is unstable. Please try again in a few minutes."

[0190] Examples of prompts for a generative AI model include the following:

[0191] "How can we improve the content of network anomaly alerts when users are experiencing stress?"

[0192] The flow of a specific process in Application Example 2 will be explained using Figure 14.

[0193] Step 1:

[0194] The server receives network logs, video from surveillance cameras, and sensor recordings from data collection devices. Since this data is in different formats, the server performs a process to convert it to a unified format. Specifically, it converts data in different formats into a common data model and structures it to prepare for efficient analysis.

[0195] Step 2:

[0196] The server uses pre-processed data and machine learning techniques to analyze it and detect anomalies. In this analysis, a model trained on normal patterns is applied to identify deviant patterns and potential anomalies. The input is pre-processed data in a unified format, and the output includes the presence or absence of anomalies and their details.

[0197] Step 3:

[0198] The server receives heart rate and facial expression data transmitted from the user's device and evaluates the user's emotional state. During this process, an emotion recognition algorithm is used to analyze the data and identify emotions such as stress and relaxation. The system uses the user's biometric data as input and obtains the user's emotional state as output.

[0199] Step 4:

[0200] If an anomaly is detected, the server generates an optimized notification that takes the user's emotional state into account. Specifically, if the user is experiencing stress, the notification will be concise and include step-by-step countermeasures. The system uses anomaly information and emotional state as input to generate the optimal notification content to send to the user as output.

[0201] Step 5:

[0202] Ultimately, the server sends the generated notification to the user in real time. This notification includes details of the anomaly that occurred and specific actions the user should take. Based on this notification, the user can quickly and accurately take appropriate action.

[0203] The specific processing unit 290 transmits the result of the specific processing to the smart device 14. In the smart device 14, the control unit 46A causes the output device 40 to output the result of the specific processing. The microphone 38B acquires audio indicating user input for the result of the specific processing. The control unit 46A transmits the audio data indicating user input acquired by the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0204] Data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of data generation model 58 is ChatGPT (registered trademark) (Internet search).<URL: https: / / openai.com / blog / chatgpt> ), Gemini (registered trademark) (Internet search) <url: https: gemini.google.com ?hl="ja">Examples of generative AI include the following. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 is input with prompts containing instructions, and with inference data such as audio data representing speech, text data representing text, and image data representing images. The data generation model 58 infers from the input inference data according to the instructions indicated by the prompts, and outputs the inference results in data formats such as audio data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0205] In the above embodiment, an example was given in which specific processing is performed by the data processing device 12, but the technology of this disclosure is not limited thereto, and the specific processing may also be performed by the smart device 14.

[0206] [Second Embodiment]

[0207] Figure 3 shows an example of the configuration of the data processing system 210 according to the second embodiment.

[0208] As shown in Figure 3, the data processing system 210 includes a data processing device 12 and smart glasses 214. An example of the data processing device 12 is a server.

[0209] The data processing device 12 comprises a computer 22, a database 24, and a communication interface 26. The computer 22 is an example of a "computer" related to the technology of this disclosure. The computer 22 comprises a processor 28, RAM 30, and storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication interface 26 are also connected to the bus 34. The communication interface 26 is connected to a network 54. An example of the network 54 is a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0210] The smart glasses 214 include a computer 36, a microphone 238, a speaker 240, a camera 42, and a communication interface 44. The computer 36 includes a processor 46, RAM 48, and storage 50. The processor 46, RAM 48, and storage 50 are connected to a bus 52. The microphone 238, speaker 240, and camera 42 are also connected to the bus 52.

[0211] The microphone 238 receives voice signals from the user 20 and receives instructions from the user 20. The microphone 238 captures the voice signals from the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to the instructions from the processor 46.

[0212] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an image sensor such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the area around the user 20 (for example, an imaging range defined by a field of view equivalent to the width of a typical healthy person's field of vision).

[0213] Communication interface 44 is connected to network 54. Communication interfaces 44 and 26 are responsible for the exchange of various information between processor 46 and processor 28 via network 54. The exchange of various information between processor 46 and processor 28 using communication interfaces 44 and 26 is performed in a secure manner.

[0214] Figure 4 shows an example of the main functions of the data processing device 12 and the smart glasses 214. As shown in Figure 4, the data processing device 12 performs specific processing using the processor 28. The storage 32 stores the specific processing program 56.

[0215] The specific processing program 56 is an example of a "program" relating to the technology of this disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0216] The storage 32 stores the data generation model 58 and the emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0217] In the smart glasses 214, the processor 46 performs the reception output processing. The storage 50 stores the reception output program 60. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output processing is realized by the processor 46 operating as a control unit 46A according to the reception output program 60 executed on the RAM 48.

[0218] Next, the identification processing performed by the identification processing unit 290 of the data processing device 12 will be described. In the following description, the data processing device 12 will be referred to as the "server" and the smart glasses 214 will be referred to as the "terminal".

[0219] This invention includes a system for addressing security challenges faced by small and medium-sized enterprises. The system aims to receive data from various network and IoT devices via a data collection device, process this data in real time, and quickly and effectively identify threats.

[0220] First, the server collects log information and video data from each terminal and IoT device connected to the network (e.g., surveillance cameras and door sensors). Since this data is in various formats, the server converts it into a unified format and prepares it for analysis. At this stage, noise is removed, and redundant data that is not necessary for analysis is eliminated.

[0221] Next, the server uses the formatted data to detect anomalies using a machine learning algorithm. This algorithm is designed to model normal operating patterns and detect actions that deviate from them. For example, if a terminal transfers data far exceeding the normal range, it will be judged as an anomaly.

[0222] If an anomaly is detected, the server immediately generates an alert and transmits the information to the relevant user (e.g., network administrator). This alert provides appropriate countermeasures based on the situation, allowing users to respond quickly to threats. The countermeasures are specific and recommend actions such as restricting suspicious access.

[0223] Furthermore, the servers regularly retrain their machine learning algorithm models with new data, ensuring they are always able to effectively respond to the latest threats. This retraining process maintains system accuracy and enables flexible responses to evolving security threats.

[0224] In this way, the present invention provides a concrete method for solving the complex security challenges faced by small and medium-sized enterprises and for achieving advanced threat detection and rapid response. This system is expected to reduce security risks and streamline management within companies.

[0225] The following describes the processing flow.

[0226] Step 1:

[0227] The server collects data from each terminal and IoT device connected to the network. Specifically, this includes network logs, operating status from each device, and sensor information. Because this data is in various formats, it is converted to a unified format in the next step.

[0228] Step 2:

[0229] The server preprocesses the collected data and converts it into a unified format. This includes data standardization, noise reduction, and data imputation. This process ensures that data obtained from different devices can be consistently analyzed.

[0230] Step 3:

[0231] The server inputs pre-processed data into a machine learning model to perform anomaly detection. This model is trained on normal patterns and identifies abnormal behavior or actions that are considered cyberattacks. For example, it can detect sudden data transfers or unauthorized access attempts.

[0232] Step 4:

[0233] When an anomaly is detected, the server generates an alert. This alert is immediately sent to the relevant users, such as network administrators. The alert includes detailed information such as the type of anomaly, the time it occurred, and the scope of its impact.

[0234] Step 5:

[0235] The server proposes countermeasures for detected anomalies. These proposals are made automatically and may include, for example, restricting access from specific devices or blacklisting suspicious IP addresses. Users can then quickly implement these countermeasures.

[0236] Step 6:

[0237] The server periodically retrains its machine learning models with new data to maintain system accuracy. This process allows the system to continuously adapt to new threats. Since retraining is performed as an automated system process, no additional management is required from the user.

[0238] (Example 1)

[0239] Next, we will describe Example 1. In the following description, the data processing device 12 will be referred to as the "server," and the smart glasses 214 will be referred to as the "terminal."

[0240] The problem that this invention aims to solve is to provide a system that can effectively and quickly respond to the increasing information security risks in small and medium-sized enterprises. Conventional methods have made it difficult to deal with complex security problems within limited resources and technical constraints. Therefore, there is a need for a system that can detect anomalies in real time, automatically propose the optimal countermeasures, and flexibly adapt to new threats.

[0241] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 1 is realized by the following means.

[0242] In this invention, the server includes means for receiving information acquired from network devices, means for preprocessing the received information and converting information in different formats into a unified format, and means for detecting anomalies based on an automatic learning function using the preprocessed information. This enables real-time anomaly detection and the proposal of appropriate countermeasures, thereby reducing information security risks for small and medium-sized enterprises and streamlining management.

[0243] "Network equipment" refers to all devices connected to a communication network that are used to send and receive data.

[0244] "Information" refers to digital data used for security analysis, such as log data and video data acquired from network devices.

[0245] "Preprocessing" refers to processes such as noise reduction and format conversion that are performed to prepare collected information into an analyzable format.

[0246] A "unified format" refers to a data format that converts information in various forms into a consistent representation suitable for analysis.

[0247] "Automatic learning function" refers to a machine learning algorithm used to detect patterns in data and identify anomalies.

[0248] "Anomaly" refers to a state that indicates suspicious activity or data transfer that deviates from the normal operating pattern.

[0249] A "warning" refers to a notification that alerts the user to a detected abnormal condition.

[0250] "Countermeasures" refer to specific guidelines and procedures to be taken in response to detected anomalies.

[0251] "Retraining" refers to the process of updating learning algorithms using the latest data to improve the accuracy of automated learning functions.

[0252] "Immediate analysis" refers to performing analysis immediately after data is collected, and detecting and reporting anomalies right away.

[0253] The invented system was developed to manage corporate information security and efficiently detect anomalies. In this system, a server plays a central role. The server collects information from network devices and multiple terminals and analyzes that information in real time.

[0254] The server acquires log data and video data from network devices and terminals through pre-configured protocols. Since this data is typically in various formats such as JSON or XML, the server converts it to a unified format. This conversion process uses programming languages ​​such as Python or Java to perform data normalization and noise reduction.

[0255] The collected information is analyzed by a machine learning algorithm running on the server. The algorithm used here employs an anomaly detection model designed to detect abnormal behavior. This model learns normal behavioral patterns, evaluates deviations from them in real time, and identifies them as anomalies. When an anomaly is detected, the server immediately alerts the user and suggests countermeasures. These countermeasures may include restricting suspicious access or changing access permissions.

[0256] Furthermore, the servers regularly retrain their machine learning models with new data to address evolving security threats. This process continuously optimizes the accuracy and effectiveness of the models.

[0257] As a concrete example, if abnormal access occurs to the network in a certain office, the server immediately detects the anomaly and sends a warning to the user, who is the security officer. At this time, the user is presented with specific countermeasures, such as temporarily suspending security protocols or blocking the source of the unauthorized access.

[0258] An example of a prompt to input into a generative AI model is, "Please tell me about the latest anomaly detected on our network and the countermeasures." This prompt is used to get the generative AI model to suggest details of the anomaly and immediate countermeasures.

[0259] The flow of the specific processing in Example 1 will be explained using Figure 11.

[0260] Step 1:

[0261] The server receives log information and video data from network devices and individual terminals. This information is provided in various formats. The server collects this diverse data as input and outputs a unified dataset. Specifically, the server uses API calls and database queries to centrally collect information.

[0262] Step 2:

[0263] The server preprocesses the collected information and converts data in different formats into a unified format. It takes the raw data collected in the previous step as input and creates data formatted for analysis as output. Specifically, it uses a Python script to normalize the data and remove unnecessary noise.

[0264] Step 3:

[0265] The server uses automated learning capabilities to detect anomalies based on formatted data. It uses pre-processed data as input and generates detection results indicating the presence or absence of anomalies as output. Specifically, it feeds data into a trained machine learning model and identifies data that deviates from normal patterns.

[0266] Step 4:

[0267] When an anomaly is detected, the server notifies the user of a warning. It receives the anomaly detection result as input and generates a warning message to be sent to the user as output. Specifically, the server sends an alert to the network administrator via the email system.

[0268] Step 5:

[0269] The server proposes specific countermeasures for detected anomalies. It takes the anomaly detection results as input and presents recommended countermeasures as output. Specifically, the server refers to past countermeasures recorded in the database and displays the suggestions on the user dashboard.

[0270] Step 6:

[0271] The server periodically retrains its automated learning model using the latest data. It uses newly collected data as input and outputs the updated model results. Specifically, the server generates a new dataset, feeds it into the AI ​​model, and performs a retraining process to improve the model's accuracy.

[0272] (Application Example 1)

[0273] Next, we will explain Application Example 1. In the following explanation, the data processing device 12 will be referred to as the "server," and the smart glasses 214 will be referred to as the "terminal."

[0274] Small and medium-sized enterprises (SMEs) face the challenge of implementing effective security measures with limited resources. Furthermore, traditional systems struggle with real-time anomaly detection and the rapid proposal of countermeasures based on these detections, potentially increasing security risks. Additionally, tracking past warning history and monitoring the progress of machine learning models becomes cumbersome, complicating management.

[0275] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 1 is realized by the following means.

[0276] In this invention, the server includes means for receiving information acquired from a data collection device, means for preprocessing the received information and converting information in different formats into a unified format, means for detecting anomalies based on a machine learning method using the preprocessed information, means for checking past warning history on a terminal device, and means for periodically retraining the machine learning method using new information. This enables efficient and effective resolution of security challenges faced by small and medium-sized enterprises, and allows for real-time anomaly detection and rapid response.

[0277] A "data collection device" is a device used to acquire data from various information sources, and it has the function of collecting information from network-connected information terminals, IoT devices, and other similar devices.

[0278] "Preprocessing" refers to the process of converting information in different formats into a unified, analyzable format, and includes noise reduction and removal of unnecessary data.

[0279] "Machine learning techniques" refer to algorithms that learn patterns and rules from data to detect anomalies in a target, and are primarily used to build predictive models based on past data.

[0280] Anomaly detection is the process of identifying behaviors or information that deviate from normal operating patterns, and it is a means to enable rapid security responses.

[0281] "Warning History Confirmation" is a function for tracking and managing records of warnings and alerts that have occurred in the past, and is used to identify the cause of problems and to formulate future countermeasures.

[0282] "Retraining" refers to the process of updating machine learning models with new information to keep them up-to-date, enabling flexible responses to evolving security threats.

[0283] A "terminal device" is a device with computing resources that can be directly operated by a user and is used to receive information from a security system or check its history.

[0284] The system for implementing this invention is mainly constructed based on the interaction between a server and a terminal device. The server plays a role in acquiring information from various networks and IoT devices by a data collection device. Since this information often arrives in an unstructured format, the server performs preprocessing and converts the information into a unified format. The preprocessing of data includes noise removal and deletion of redundant information and is mainly implemented using Python.

[0285] After that, the server utilizes TensorFlow to perform anomaly detection based on machine learning techniques. This is for learning normal operation patterns and immediately discovering deviated behaviors. When an anomaly is detected, a warning is notified to the terminal device in real time through Firebase. The terminal device has a function to check the past warning history, and the user can utilize it for tracing the cause of the problem and postmortem analysis.

[0286] To maintain the accuracy of the machine learning model, the server retrains the model using new information. In this retraining process, an evolving dataset is utilized so that it can flexibly respond to the latest security threats.

[0287] As a specific example, when there is data access beyond the normal business scope at night, the server immediately detects the anomaly and sends a warning to the terminal device. Based on this warning, the administrator can take prompt measures such as blocking the access.

[0288] As an example of a prompt sentence for a generative AI model, it can be considered to input in the form of "Review the recent data collection logs, identify patterns that seem abnormal, and create an endpoint for warning the corresponding users." By utilizing this prompt sentence, the development of a more advanced anomaly detection model is supported.

[0289] The flow of a specific process in Application Example 1 will be explained using Figure 12.

[0290] Step 1:

[0291] The server receives information from data collection devices, networks, and IoT devices. It acquires raw information in various formats as input and prepares this information for preprocessing as output. Specifically, the server transfers log information and temporarily stores it in a receive buffer.

[0292] Step 2:

[0293] The server preprocesses the received information and converts it into a unified format. The input is information in various formats, and the output is information in a parseable, unified format. It performs processes to remove data noise and redundant information. Specifically, it uses a Python data processing library to perform data cleaning.

[0294] Step 3:

[0295] The server uses pre-processed information to perform anomaly detection using a machine learning model. It receives information in a unified format as input and generates anomaly detection results as output. The data is input into a TensorFlow model to detect deviations from normal operating patterns. Specifically, if an anomaly is detected, a flag is set and the data is passed to the next process.

[0296] Step 4:

[0297] The server uses Firebase to send alerts to terminal devices when an anomaly is detected. The input is the result of the anomaly detection, and the output is the sending of the warning message. Specifically, it sends a push notification to the administrator's terminal and displays a warning screen.

[0298] Step 5:

[0299] The terminal allows users to review their past warning history based on the warnings they receive. Input consists of warning data and history data, and output is a list of the history. Specifically, the history data is displayed as a list on the GUI, allowing the user to access detailed information.

[0300] Step 6:

[0301] The server periodically retrains the machine learning model using new information. It receives the latest dataset as input and an updated model as output. Specifically, it runs a periodic batch job to retrain the model using TensorFlow.

[0302] Step 7:

[0303] The user provides prompts to the generated AI model, assisting in its development. Inputs are prompts such as, "Review recent data collection logs, identify potentially anomalous patterns, and create an endpoint to alert the affected users." Outputs include the generated analysis model and suggestions. Specifically, the user creates model improvements based on the prompts and integrates them into the system.

[0304] Furthermore, an emotion engine that estimates the user's emotions may be incorporated. That is, the identification processing unit 290 may use the emotion identification model 59 to estimate the user's emotions and perform identification processing using the user's emotions.

[0305] This invention provides a system that enables more accurate security responses by considering the user's emotional state during data collection and anomaly detection. Specific embodiments are described below.

[0306] First, the server collects the necessary data from each terminal and IoT device connected to the network. The collected data includes network logs, videos from surveillance cameras, records of door sensors, etc. Since these data exist in different data formats, they are converted by the server into a unified format.

[0307] Next, the server analyzes the preprocessed data and uses machine learning algorithms to detect anomalies. This algorithm is designed to learn normal usage patterns and identify actions that deviate from them and movements that can be regarded as cyberattacks. In this process, an emotion engine that recognizes the user's emotional state is introduced, and based on the user's reactions and feedback, it optimizes the priority of security measures and the notification method.

[0308] When an anomaly is detected, the server generates an alert and notifies the user in real time. The content of the alert includes the details of the occurred anomaly and suggestions for countermeasures based on the user's emotional state. For example, if the emotion engine determines that the user is stressed, considerations such as simplifying the alert and presenting countermeasures step by step are taken.

[0309] Furthermore, the server customizes suggestions for countermeasures against anomalies based on the information obtained by the emotion engine. As a result, optimal security measures are taken in a form that takes into account the user's current emotional state. For example, when the system administrator is in a very busy situation, the emotion engine recognizes this and reduces the workload by preferentially presenting only highly important information.

[0310] In this way, by incorporating the emotion engine, it becomes possible to make flexible responses considering the user's situation, and it is possible to achieve safe and efficient security management even in small and medium-sized enterprises.

[0311] The following describes the processing flow.

[0312] Step 1:

[0313] The server collects data from various terminals and IoT devices on the network. This data includes network logs, camera footage, and sensor operation information. Because this data is often sent in different formats, it is collected for subsequent processing.

[0314] Step 2:

[0315] The server preprocesses the collected data and standardizes its format. Specifically, it cleans the data and removes noise. Furthermore, it converts it into time-series data or structured data as needed and formats it into an analyzable format.

[0316] Step 3:

[0317] The server inputs pre-processed data into a machine learning algorithm to perform anomaly detection. This algorithm operates in real time, detecting anomalies and potential threats that deviate from normal patterns. The detection results are stored along with detailed information such as the type of anomaly and its scope of impact.

[0318] Step 4:

[0319] When an anomaly is detected, the server runs the emotion engine to evaluate the user's emotional state. The emotion engine analyzes user input and behavior logs to determine the current emotional state (e.g., stress level, concentration level, etc.). This information is used to prioritize and customize alerts.

[0320] Step 5:

[0321] Based on anomaly detection, the server generates and notifies the user of an alert. At this time, it considers the emotional state fed back by the emotion engine and adjusts the content and tone accordingly. For example, if the user is feeling stressed, a concise alert summarizing the key points will be delivered.

[0322] Step 6:

[0323] The server then proposes appropriate countermeasures for the detected anomalies. In doing so, it adjusts the method and order in which the countermeasures are presented based on the user's emotional state. For example, if there are multiple suggestions, they are presented in stages or as alternatives to minimize emotional burden.

[0324] Step 7:

[0325] The server periodically retrains its machine learning models with new datasets to maintain system accuracy. Retraining enables flexible responses to evolving threats and adaptation to changing user usage patterns over time.

[0326] (Example 2)

[0327] Next, we will describe Example 2. In the following description, the data processing device 12 will be referred to as the "server" and the smart glasses 214 will be referred to as the "terminal".

[0328] In recent years, the increasing complexity of information and the sophistication of cyberattacks have necessitated improved accuracy in anomaly detection systems. However, conventional systems focus solely on anomaly detection, making it difficult to provide flexible response measures that take into account the user's psychological state. Therefore, there is a need for efficient notifications and response proposals that do not cause unnecessary stress to users.

[0329] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 2 is realized by the following means.

[0330] In this invention, the server includes means for receiving information acquired from data collection means, means for preprocessing the received information and converting information of different formats into a standard format, means for analyzing the preprocessed information and recognizing anomalies based on a machine learning model, means for evaluating the user's psychological state using an emotion analysis device, means for notifying a warning based on the anomaly recognition and the user's psychological state, and means for proposing countermeasures against the anomaly and adjusting the countermeasures considering the user's psychological state. This enables not only anomaly detection but also efficient and flexible security responses that take into account the user's psychological state.

[0331] "Data collection means" refers to methods and devices for acquiring data and information from networks and various information terminals.

[0332] "Means of receiving" refers to methods or devices that take in information acquired through data collection means and convert it into a format that can be processed within the system.

[0333] "Preprocessing" refers to the process of preparing acquired raw data for easier analysis, such as converting it into a standardized format.

[0334] A "standard format" refers to a unified data structure obtained by converting data in various formats into a consistent, analyzable format.

[0335] "Means for recognizing anomalies" refer to methods and devices that use machine learning models and algorithms to identify abnormal information that deviates from normal patterns.

[0336] An "emotion analysis device" is a method or device used to analyze a user's behavior and reactions and evaluate their emotional state.

[0337] "Means of notifying warnings" refers to methods or devices for communicating warnings to users about anomalies detected by the system.

[0338] "Means for proposing countermeasures" refers to methods or devices for presenting appropriate countermeasures to users in response to detected anomalies.

[0339] "Means of adjustment based on psychological state" refers to methods or devices that optimize the information and countermeasures provided to suit the user's emotions and psychological state.

[0340] This invention is a system that centrally manages information acquired from data collection devices and performs anomaly detection and analysis of users' emotional states. Specifically, it is implemented in the following procedure.

[0341] The server first collects data such as network logs, surveillance camera footage, and sensor records from various terminals and IoT devices connected to the network. Since this data exists in various formats, the server converts it all into a unified format. Database software and data management tools are used for this purpose. Specifically, SQL databases and data format conversion libraries are used.

[0342] Next, the server uses a machine learning model to analyze this preprocessed data and identify anomalies. This machine learning model is trained to model normal usage patterns and identify anomalies that deviate from them. Here, machine learning frameworks such as TensorFlow and PyTorch are used.

[0343] Subsequently, the server evaluates the user's emotional state using an emotion analysis device. This step involves speech recognition and text feedback analysis, utilizing an emotion engine to determine the user's psychological state. Natural language processing (NLP) technology is used for emotion analysis. Specific tools used include NLTK and spaCy.

[0344] When an anomaly is detected, the server immediately generates an alert and notifies the user of the details of the anomaly. This alert includes appropriate countermeasures for the anomaly, and is tailored to the user's psychological state. For example, if the user is experiencing stress, concise and easy-to-understand content is prioritized.

[0345] For example, in an office environment, if a suspicious login attempt is detected, the server immediately notifies the administrator of the information. However, if the administrator is busy with work, only high-priority information is quickly presented based on sentiment analysis.

[0346] An example of a prompt might be a question like, "What factors does this system consider when detecting anomalies and optimizing user responses based on its emotion engine?" This would deepen engineers' understanding of the specific problems they face and help them design and improve the system.

[0347] The flow of the specific processing in Example 2 will be explained using Figure 13.

[0348] Step 1:

[0349] The server receives network logs, surveillance camera footage, sensor recordings, and other data from various terminals and IoT devices as input. Because this data exists in different formats, the server uses a data management tool to convert it all into a unified format. This conversion process, by formatting the data into formats such as JSON or CSV, facilitates subsequent analysis steps. As a result, the converted data is output.

[0350] Step 2:

[0351] Using pre-processed data as input, the server performs anomaly analysis using a machine learning model. In this step, frameworks such as TensorFlow are used to reference normal usage pattern models and detect anomalies. Specifically, it identifies unusual login attempts and fluctuations in network traffic and outputs corresponding alert information. This anomaly information is used in the next step.

[0352] Step 3:

[0353] Based on the anomaly information obtained, the server uses an emotion analysis device to evaluate the user's emotional state. The input for this step consists of the anomaly information and user feedback and behavioral data. Using NLP techniques, the psychological state is inferred from voice tone and text, and the user's emotional state is output as the analysis result. For example, the evaluation might be expressed as a numerical value called StressLevel.

[0354] Step 4:

[0355] Based on anomaly information and the user's emotional state, the server generates and notifies the user of the most appropriate warning message. The inputs here are details of the anomaly and the output of the emotional analysis. Based on this, the warning message is adjusted. Specifically, if high stress levels are detected, only concise and highly important information is provided. The output is a customized alert message for the user.

[0356] Step 5:

[0357] Finally, the user takes action based on the alert received. In this step, they use the provided countermeasures to improve the situation. The user reviews the alert content and takes specific actions, such as reporting to the system administrator or strengthening security measures, as needed. As a result, it is confirmed that appropriate security measures have been taken.

[0358] (Application Example 2)

[0359] Next, we will explain application example 2. In the following explanation, the data processing device 12 will be referred to as the "server" and the smart glasses 214 as the "terminal".

[0360] Conventional anomaly detection systems focus solely on purely technical data analysis and lack the ability to flexibly respond to changes in the operator's emotional state. As a result, notifications and suggestions may not be efficient for recipients when they are feeling stressed. This can make decision-making more difficult, especially in busy environments, and may compromise the timeliness of security responses.

[0361] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means.

[0362] In this invention, the server includes means for receiving information acquired from data collection means, means for preprocessing the received information and converting different types of information into a unified format, and means for detecting anomalies using machine learning techniques based on the preprocessed information. This makes it possible to detect anomalies in real time while taking into account the emotional state of the operator, and to provide appropriate notifications and countermeasures.

[0363] "Data collection means" refers to devices and methods for acquiring different types of information from networks and equipment.

[0364] "Means for receiving information" refers to methods and devices for acquiring information sent from data collection means.

[0365] "Means of preprocessing and conversion" refers to processes or devices that analyze received information and convert data in different formats into a unified format.

[0366] "Machine learning techniques" are methods that use algorithms to analyze data and detect patterns and anomalies.

[0367] "Means for detecting anomalies" refer to processes or devices that use machine learning techniques to discover unusual patterns.

[0368] "Means for evaluating the emotional state of the operator" refers to methods and technologies for analyzing and evaluating the psychological state of the user in real time.

[0369] "Means for optimizing notification content" refers to processes and technologies for adjusting how anomalies are reported and how countermeasures are suggested, based on the emotional state of the operator.

[0370] A server plays a crucial role in implementing this invention. First, the server receives information from a wide variety of data collection methods. This includes network logs, video from surveillance cameras, and sensor recordings. Since the received information may be in different formats, the server preprocesses it and converts it into a unified format.

[0371] Next, the server analyzes the unified data using machine learning techniques to detect anomalies. This process also incorporates a function to evaluate the user's emotional state based on heart rate and facial expression data obtained from the user's device. This allows the server to optimize notification content and propose more appropriate countermeasures when an anomaly is detected, taking the user's emotional state into consideration.

[0372] For example, if a user is in a stressful situation, the server will adjust its notifications to be concise and offer step-by-step suggestions to reduce the user's burden. This improves usability and allows users to take quick and appropriate action.

[0373] As a concrete example, consider network problems that occur when students are taking online classes. This system reduces user stress by allowing the server to provide a concise message such as, "The network is unstable. Please try again in a few minutes."

[0374] Examples of prompts for a generative AI model include the following:

[0375] "How can we improve the content of network anomaly alerts when users are experiencing stress?"

[0376] The flow of a specific process in Application Example 2 will be explained using Figure 14.

[0377] Step 1:

[0378] The server receives network logs, video from surveillance cameras, and sensor recordings from data collection devices. Since this data is in different formats, the server performs a process to convert it to a unified format. Specifically, it converts data in different formats into a common data model and structures it to prepare for efficient analysis.

[0379] Step 2:

[0380] The server uses pre-processed data and machine learning techniques to analyze it and detect anomalies. In this analysis, a model trained on normal patterns is applied to identify deviant patterns and potential anomalies. The input is pre-processed data in a unified format, and the output includes the presence or absence of anomalies and their details.

[0381] Step 3:

[0382] The server receives heart rate and facial expression data transmitted from the user's device and evaluates the user's emotional state. During this process, an emotion recognition algorithm is used to analyze the data and identify emotions such as stress and relaxation. The system uses the user's biometric data as input and obtains the user's emotional state as output.

[0383] Step 4:

[0384] If an anomaly is detected, the server generates an optimized notification that takes the user's emotional state into account. Specifically, if the user is experiencing stress, the notification will be concise and include step-by-step countermeasures. The system uses anomaly information and emotional state as input to generate the optimal notification content to send to the user as output.

[0385] Step 5:

[0386] Ultimately, the server sends the generated notification to the user in real time. This notification includes details of the anomaly that occurred and specific actions the user should take. Based on this notification, the user can quickly and accurately take appropriate action.

[0387] The specific processing unit 290 transmits the result of the specific processing to the smart glasses 214. In the smart glasses 214, the control unit 46A causes the speaker 240 to output the result of the specific processing. The microphone 238 acquires audio indicating user input for the result of the specific processing. The control unit 46A transmits the audio data indicating user input acquired by the microphone 238 to the data processing unit 12. In the data processing unit 12, the specific processing unit 290 acquires the audio data.

[0388] Data generation model 58 is a type of so-called generative AI (Artificial Intelligence). One example of data generation model 58 is ChatGPT (Internet search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search) <url: https: gemini.google.com ?hl="ja">Examples of generative AI include the following. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 is input with prompts containing instructions, and with inference data such as audio data representing speech, text data representing text, and image data representing images. The data generation model 58 infers from the input inference data according to the instructions indicated by the prompts, and outputs the inference results in data formats such as audio data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0389] In the above embodiment, an example was given in which specific processing is performed by the data processing device 12, but the technology of this disclosure is not limited thereto, and the specific processing may also be performed by the smart glasses 214.

[0390] [Third Embodiment]

[0391] Figure 5 shows an example of the configuration of the data processing system 310 according to the third embodiment.

[0392] As shown in Figure 5, the data processing system 310 includes a data processing device 12 and a headset terminal 314. An example of the data processing device 12 is a server.

[0393] The data processing device 12 comprises a computer 22, a database 24, and a communication interface 26. The computer 22 is an example of a "computer" related to the technology of this disclosure. The computer 22 comprises a processor 28, RAM 30, and storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication interface 26 are also connected to the bus 34. The communication interface 26 is connected to a network 54. An example of the network 54 is a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0394] The headset terminal 314 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication interface 44, and a display 343. The computer 36 includes a processor 46, RAM 48, and storage 50. The processor 46, RAM 48, and storage 50 are connected to a bus 52. The microphone 238, speaker 240, camera 42, and display 343 are also connected to the bus 52.

[0395] The microphone 238 receives voice signals from the user 20 and receives instructions from the user 20. The microphone 238 captures the voice signals from the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to the instructions from the processor 46.

[0396] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an image sensor such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the area around the user 20 (for example, an imaging range defined by a field of view equivalent to the width of a typical healthy person's field of vision).

[0397] Communication interface 44 is connected to network 54. Communication interfaces 44 and 26 are responsible for the exchange of various information between processor 46 and processor 28 via network 54. The exchange of various information between processor 46 and processor 28 using communication interfaces 44 and 26 is performed in a secure manner.

[0398] Figure 6 shows an example of the main functions of the data processing device 12 and the headset terminal 314. As shown in Figure 6, the data processing device 12 performs specific processing using the processor 28. The storage 32 stores the specific processing program 56.

[0399] The specific processing program 56 is an example of a "program" relating to the technology of this disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0400] The storage 32 stores the data generation model 58 and the emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0401] In the headset terminal 314, the processor 46 performs the reception output processing. The storage 50 stores the reception output program 60. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output processing is realized by the processor 46 operating as a control unit 46A according to the reception output program 60 executed on the RAM 48.

[0402] Next, the specific processing performed by the specific processing unit 290 of the data processing device 12 will be described. In the following description, the data processing device 12 will be referred to as the "server" and the headset terminal 314 will be referred to as the "terminal".

[0403] This invention includes a system for addressing security challenges faced by small and medium-sized enterprises. The system aims to receive data from various network and IoT devices via a data collection device, process this data in real time, and quickly and effectively identify threats.

[0404] First, the server collects log information and video data from each terminal and IoT device connected to the network (e.g., surveillance cameras and door sensors). Since this data is in various formats, the server converts it into a unified format and prepares it for analysis. At this stage, noise is removed, and redundant data that is not necessary for analysis is eliminated.

[0405] Next, the server uses the formatted data to detect anomalies using a machine learning algorithm. This algorithm is designed to model normal operating patterns and detect actions that deviate from them. For example, if a terminal transfers data far exceeding the normal range, it will be judged as an anomaly.

[0406] If an anomaly is detected, the server immediately generates an alert and transmits the information to the relevant user (e.g., network administrator). This alert provides appropriate countermeasures based on the situation, allowing users to respond quickly to threats. The countermeasures are specific and recommend actions such as restricting suspicious access.

[0407] Furthermore, the servers regularly retrain their machine learning algorithm models with new data, ensuring they are always able to effectively respond to the latest threats. This retraining process maintains system accuracy and enables flexible responses to evolving security threats.

[0408] In this way, the present invention provides a concrete method for solving the complex security challenges faced by small and medium-sized enterprises and for achieving advanced threat detection and rapid response. This system is expected to reduce security risks and streamline management within companies.

[0409] The following describes the processing flow.

[0410] Step 1:

[0411] The server collects data from each terminal and IoT device connected to the network. Specifically, this includes network logs, operating status from each device, and sensor information. Because this data is in various formats, it is converted to a unified format in the next step.

[0412] Step 2:

[0413] The server preprocesses the collected data and converts it into a unified format. This includes data standardization, noise reduction, and data imputation. This process ensures that data obtained from different devices can be consistently analyzed.

[0414] Step 3:

[0415] The server inputs pre-processed data into a machine learning model to perform anomaly detection. This model is trained on normal patterns and identifies abnormal behavior or actions that are considered cyberattacks. For example, it can detect sudden data transfers or unauthorized access attempts.

[0416] Step 4:

[0417] When an anomaly is detected, the server generates an alert. This alert is immediately sent to the relevant users, such as network administrators. The alert includes detailed information such as the type of anomaly, the time it occurred, and the scope of its impact.

[0418] Step 5:

[0419] The server proposes countermeasures for detected anomalies. These proposals are made automatically and may include, for example, restricting access from specific devices or blacklisting suspicious IP addresses. Users can then quickly implement these countermeasures.

[0420] Step 6:

[0421] The server periodically retrains its machine learning models with new data to maintain system accuracy. This process allows the system to continuously adapt to new threats. Since retraining is performed as an automated system process, no additional management is required from the user.

[0422] (Example 1)

[0423] Next, we will describe Example 1. In the following description, the data processing device 12 will be referred to as the "server," and the headset-type terminal 314 will be referred to as the "terminal."

[0424] The problem that this invention aims to solve is to provide a system that can effectively and quickly respond to the increasing information security risks in small and medium-sized enterprises. Conventional methods have made it difficult to deal with complex security problems within limited resources and technical constraints. Therefore, there is a need for a system that can detect anomalies in real time, automatically propose the optimal countermeasures, and flexibly adapt to new threats.

[0425] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 1 is realized by the following means.

[0426] In this invention, the server includes means for receiving information acquired from network devices, means for preprocessing the received information and converting information in different formats into a unified format, and means for detecting anomalies based on an automatic learning function using the preprocessed information. This enables real-time anomaly detection and the proposal of appropriate countermeasures, thereby reducing information security risks for small and medium-sized enterprises and streamlining management.

[0427] "Network equipment" refers to all devices connected to a communication network that are used to send and receive data.

[0428] "Information" refers to digital data used for security analysis, such as log data and video data acquired from network devices.

[0429] "Preprocessing" refers to processes such as noise reduction and format conversion that are performed to prepare collected information into an analyzable format.

[0430] A "unified format" refers to a data format that converts information in various forms into a consistent representation suitable for analysis.

[0431] "Automatic learning function" refers to a machine learning algorithm used to detect patterns in data and identify anomalies.

[0432] "Anomaly" refers to a state that indicates suspicious activity or data transfer that deviates from the normal operating pattern.

[0433] A "warning" refers to a notification that alerts the user to a detected abnormal condition.

[0434] "Countermeasures" refer to specific guidelines and procedures to be taken in response to detected anomalies.

[0435] "Retraining" refers to the process of updating learning algorithms using the latest data to improve the accuracy of automated learning functions.

[0436] "Immediate analysis" refers to performing analysis immediately after data is collected, and detecting and reporting anomalies right away.

[0437] The invented system was developed to manage corporate information security and efficiently detect anomalies. In this system, a server plays a central role. The server collects information from network devices and multiple terminals and analyzes that information in real time.

[0438] The server acquires log data and video data from network devices and terminals through pre-configured protocols. Since this data is typically in various formats such as JSON or XML, the server converts it to a unified format. This conversion process uses programming languages ​​such as Python or Java to perform data normalization and noise reduction.

[0439] The collected information is analyzed by a machine learning algorithm running on the server. The algorithm used here employs an anomaly detection model designed to detect abnormal behavior. This model learns normal behavioral patterns, evaluates deviations from them in real time, and identifies them as anomalies. When an anomaly is detected, the server immediately alerts the user and suggests countermeasures. These countermeasures may include restricting suspicious access or changing access permissions.

[0440] Furthermore, the servers regularly retrain their machine learning models with new data to address evolving security threats. This process continuously optimizes the accuracy and effectiveness of the models.

[0441] As a concrete example, if abnormal access occurs to the network in a certain office, the server immediately detects the anomaly and sends a warning to the user, who is the security officer. At this time, the user is presented with specific countermeasures, such as temporarily suspending security protocols or blocking the source of the unauthorized access.

[0442] An example of a prompt to input into a generative AI model is, "Please tell me about the latest anomaly detected on our network and the countermeasures." This prompt is used to get the generative AI model to suggest details of the anomaly and immediate countermeasures.

[0443] The flow of the specific processing in Example 1 will be explained using Figure 11.

[0444] Step 1:

[0445] The server receives log information and video data from network devices and individual terminals. This information is provided in various formats. The server collects this diverse data as input and outputs a unified dataset. Specifically, the server uses API calls and database queries to centrally collect information.

[0446] Step 2:

[0447] The server preprocesses the collected information and converts data in different formats into a unified format. It takes the raw data collected in the previous step as input and creates data formatted for analysis as output. Specifically, it uses a Python script to normalize the data and remove unnecessary noise.

[0448] Step 3:

[0449] The server uses automated learning capabilities to detect anomalies based on formatted data. It uses pre-processed data as input and generates detection results indicating the presence or absence of anomalies as output. Specifically, it feeds data into a trained machine learning model and identifies data that deviates from normal patterns.

[0450] Step 4:

[0451] When an anomaly is detected, the server notifies the user of a warning. It receives the anomaly detection result as input and generates a warning message to be sent to the user as output. Specifically, the server sends an alert to the network administrator via the email system.

[0452] Step 5:

[0453] The server proposes specific countermeasures for detected anomalies. It takes the anomaly detection results as input and presents recommended countermeasures as output. Specifically, the server refers to past countermeasures recorded in the database and displays the suggestions on the user dashboard.

[0454] Step 6:

[0455] The server periodically retrains its automated learning model using the latest data. It uses newly collected data as input and outputs the updated model results. Specifically, the server generates a new dataset, feeds it into the AI ​​model, and performs a retraining process to improve the model's accuracy.

[0456] (Application Example 1)

[0457] Next, we will explain Application Example 1. In the following explanation, the data processing device 12 will be referred to as the "server," and the headset-type terminal 314 will be referred to as the "terminal."

[0458] Small and medium-sized enterprises (SMEs) face the challenge of implementing effective security measures with limited resources. Furthermore, traditional systems struggle with real-time anomaly detection and the rapid proposal of countermeasures based on these detections, potentially increasing security risks. Additionally, tracking past warning history and monitoring the progress of machine learning models becomes cumbersome, complicating management.

[0459] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 1 is realized by the following means.

[0460] In this invention, the server includes means for receiving information acquired from a data collection device, means for preprocessing the received information and converting information in different formats into a unified format, means for detecting anomalies based on a machine learning method using the preprocessed information, means for checking past warning history on a terminal device, and means for periodically retraining the machine learning method using new information. This enables efficient and effective resolution of security challenges faced by small and medium-sized enterprises, and allows for real-time anomaly detection and rapid response.

[0461] A "data collection device" is a device used to acquire data from various information sources, and it has the function of collecting information from network-connected information terminals, IoT devices, and other similar devices.

[0462] "Preprocessing" refers to the process of converting information in different formats into a unified, analyzable format, and includes noise reduction and removal of unnecessary data.

[0463] "Machine learning techniques" refer to algorithms that learn patterns and rules from data to detect anomalies in a target, and are primarily used to build predictive models based on past data.

[0464] Anomaly detection is the process of identifying behaviors or information that deviate from normal operating patterns, and it is a means to enable rapid security responses.

[0465] "Warning History Confirmation" is a function for tracking and managing records of warnings and alerts that have occurred in the past, and is used to identify the cause of problems and to formulate future countermeasures.

[0466] "Retraining" refers to the process of updating machine learning models with new information to keep them up-to-date, enabling flexible responses to evolving security threats.

[0467] A "terminal device" is a device with computing resources that can be directly operated by a user, and is used to receive information from security systems and to check history.

[0468] The system for implementing this invention is primarily built on the interaction between a server and terminal devices. The server is responsible for acquiring information from various networks and IoT devices via a data collection device. Since this information often arrives in an unstructured format, the server performs preprocessing to convert the information into a unified format. Data preprocessing includes noise reduction and removal of redundant information, and is mainly implemented using Python.

[0469] Subsequently, the server utilizes TensorFlow to perform anomaly detection based on machine learning techniques. This is designed to learn normal operating patterns and immediately detect deviations. When an anomaly is detected, a real-time warning is sent to the terminal device via Firebase. The terminal device has a function to check past warning history, which users can use to track the cause of problems and perform post-incident analysis.

[0470] To maintain the accuracy of machine learning models, the servers retrain the models using new information. This retraining process utilizes an ever-evolving dataset to flexibly respond to the latest security threats.

[0471] For example, if data access exceeds normal operating limits during nighttime hours, the server immediately detects the anomaly and sends a warning to the terminal device. Based on this warning, administrators can take swift action, such as blocking access.

[0472] An example of a prompt message for a generated AI model might be: "Review recent data collection logs, identify any potentially anomalous patterns, and create an endpoint to alert the affected users." Utilizing this prompt message can support the development of more advanced anomaly detection models.

[0473] The flow of a specific process in Application Example 1 will be explained using Figure 12.

[0474] Step 1:

[0475] The server receives information from data collection devices, networks, and IoT devices. It acquires raw information in various formats as input and prepares this information for preprocessing as output. Specifically, the server transfers log information and temporarily stores it in a receive buffer.

[0476] Step 2:

[0477] The server preprocesses the received information and converts it into a unified format. The input is information in various formats, and the output is information in a parseable, unified format. It performs processes to remove data noise and redundant information. Specifically, it uses a Python data processing library to perform data cleaning.

[0478] Step 3:

[0479] The server uses pre-processed information to perform anomaly detection using a machine learning model. It receives information in a unified format as input and generates anomaly detection results as output. The data is input into a TensorFlow model to detect deviations from normal operating patterns. Specifically, if an anomaly is detected, a flag is set and the data is passed to the next process.

[0480] Step 4:

[0481] The server uses Firebase to send alerts to terminal devices when an anomaly is detected. The input is the result of the anomaly detection, and the output is the sending of the warning message. Specifically, it sends a push notification to the administrator's terminal and displays a warning screen.

[0482] Step 5:

[0483] The terminal allows users to review their past warning history based on the warnings they receive. Input consists of warning data and history data, and output is a list of the history. Specifically, the history data is displayed as a list on the GUI, allowing the user to access detailed information.

[0484] Step 6:

[0485] The server periodically retrains the machine learning model using new information. It receives the latest dataset as input and an updated model as output. Specifically, it runs a periodic batch job to retrain the model using TensorFlow.

[0486] Step 7:

[0487] The user provides prompts to the generated AI model, assisting in its development. Inputs are prompts such as, "Review recent data collection logs, identify potentially anomalous patterns, and create an endpoint to alert the affected users." Outputs include the generated analysis model and suggestions. Specifically, the user creates model improvements based on the prompts and integrates them into the system.

[0488] Furthermore, an emotion engine that estimates the user's emotions may be incorporated. That is, the identification processing unit 290 may use the emotion identification model 59 to estimate the user's emotions and perform identification processing using the user's emotions.

[0489] This invention provides a system that enables more accurate security responses by considering the user's emotional state during data collection and anomaly detection. Specific embodiments are described below.

[0490] First, the server collects the necessary data from each terminal and IoT device connected to the network. This collected data includes network logs, surveillance camera footage, and door sensor recordings. Because this data exists in different formats, the server converts it into a unified format.

[0491] Next, the server analyzes the pre-processed data and uses machine learning algorithms to detect anomalies. These algorithms are designed to learn normal usage patterns and identify deviations from them or movements that could be considered cyberattacks. In this process, an emotion engine is introduced to recognize the user's emotional state, and based on the user's reactions and feedback, it optimizes the priority of security responses and notification methods.

[0492] If an anomaly is detected, the server generates an alert and notifies the user in real time. The alert includes details of the anomaly, as well as suggested countermeasures based on the user's emotional state. For example, if the emotion engine determines that the user is stressed, the alert will be made more concise and countermeasures will be suggested in a step-by-step manner.

[0493] Furthermore, the server customizes suggested countermeasures for anomalies based on information obtained by the emotion engine. This ensures that optimal security measures are implemented while taking into account the user's current emotional state. For example, if a system administrator is extremely busy, the emotion engine recognizes this and reduces their workload by prioritizing and presenting only high-priority information.

[0494] By incorporating an emotion engine in this way, flexible responses that take into account the user's situation become possible, enabling safe and efficient security management even for small and medium-sized enterprises.

[0495] The following describes the processing flow.

[0496] Step 1:

[0497] The server collects data from various terminals and IoT devices on the network. This data includes network logs, camera footage, and sensor operation information. Because this data is often sent in different formats, it is collected for subsequent processing.

[0498] Step 2:

[0499] The server preprocesses the collected data and standardizes its format. Specifically, it cleans the data and removes noise. Furthermore, it converts it into time-series data or structured data as needed and formats it into an analyzable format.

[0500] Step 3:

[0501] The server inputs pre-processed data into a machine learning algorithm to perform anomaly detection. This algorithm operates in real time, detecting anomalies and potential threats that deviate from normal patterns. The detection results are stored along with detailed information such as the type of anomaly and its scope of impact.

[0502] Step 4:

[0503] When an anomaly is detected, the server runs the emotion engine to evaluate the user's emotional state. The emotion engine analyzes user input and behavior logs to determine the current emotional state (e.g., stress level, concentration level, etc.). This information is used to prioritize and customize alerts.

[0504] Step 5:

[0505] Based on anomaly detection, the server generates and notifies the user of an alert. At this time, it considers the emotional state fed back by the emotion engine and adjusts the content and tone accordingly. For example, if the user is feeling stressed, a concise alert summarizing the key points will be delivered.

[0506] Step 6:

[0507] The server then proposes appropriate countermeasures for the detected anomalies. In doing so, it adjusts the method and order in which the countermeasures are presented based on the user's emotional state. For example, if there are multiple suggestions, they are presented in stages or as alternatives to minimize emotional burden.

[0508] Step 7:

[0509] The server periodically retrains its machine learning models with new datasets to maintain system accuracy. Retraining enables flexible responses to evolving threats and adaptation to changing user usage patterns over time.

[0510] (Example 2)

[0511] Next, we will describe Example 2. In the following description, the data processing device 12 will be referred to as the "server," and the headset-type terminal 314 will be referred to as the "terminal."

[0512] In recent years, the increasing complexity of information and the sophistication of cyberattacks have necessitated improved accuracy in anomaly detection systems. However, conventional systems focus solely on anomaly detection, making it difficult to provide flexible response measures that take into account the user's psychological state. Therefore, there is a need for efficient notifications and response proposals that do not cause unnecessary stress to users.

[0513] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 2 is realized by the following means.

[0514] In this invention, the server includes means for receiving information acquired from data collection means, means for preprocessing the received information and converting information of different formats into a standard format, means for analyzing the preprocessed information and recognizing anomalies based on a machine learning model, means for evaluating the user's psychological state using an emotion analysis device, means for notifying a warning based on the anomaly recognition and the user's psychological state, and means for proposing countermeasures against the anomaly and adjusting the countermeasures considering the user's psychological state. This enables not only anomaly detection but also efficient and flexible security responses that take into account the user's psychological state.

[0515] "Data collection means" refers to methods and devices for acquiring data and information from networks and various information terminals.

[0516] "Means of receiving" refers to methods or devices that take in information acquired through data collection means and convert it into a format that can be processed within the system.

[0517] "Preprocessing" refers to the process of preparing acquired raw data for easier analysis, such as converting it into a standardized format.

[0518] A "standard format" refers to a unified data structure obtained by converting data in various formats into a consistent, analyzable format.

[0519] "Means for recognizing anomalies" refer to methods and devices that use machine learning models and algorithms to identify abnormal information that deviates from normal patterns.

[0520] An "emotion analysis device" is a method or device used to analyze a user's behavior and reactions and evaluate their emotional state.

[0521] "Means of notifying warnings" refers to methods or devices for communicating warnings to users about anomalies detected by the system.

[0522] "Means for proposing countermeasures" refers to methods or devices for presenting appropriate countermeasures to users in response to detected anomalies.

[0523] "Means of adjustment based on psychological state" refers to methods or devices that optimize the information and countermeasures provided to suit the user's emotions and psychological state.

[0524] This invention is a system that centrally manages information acquired from data collection devices and performs anomaly detection and analysis of users' emotional states. Specifically, it is implemented in the following procedure.

[0525] The server first collects data such as network logs, surveillance camera footage, and sensor records from various terminals and IoT devices connected to the network. Since this data exists in various formats, the server converts it all into a unified format. Database software and data management tools are used for this purpose. Specifically, SQL databases and data format conversion libraries are used.

[0526] Next, the server uses a machine learning model to analyze this preprocessed data and identify anomalies. This machine learning model is trained to model normal usage patterns and identify anomalies that deviate from them. Here, machine learning frameworks such as TensorFlow and PyTorch are used.

[0527] Subsequently, the server evaluates the user's emotional state using an emotion analysis device. This step involves speech recognition and text feedback analysis, utilizing an emotion engine to determine the user's psychological state. Natural language processing (NLP) technology is used for emotion analysis. Specific tools used include NLTK and spaCy.

[0528] When an anomaly is detected, the server immediately generates an alert and notifies the user of the details of the anomaly. This alert includes appropriate countermeasures for the anomaly, and is tailored to the user's psychological state. For example, if the user is experiencing stress, concise and easy-to-understand content is prioritized.

[0529] For example, in an office environment, if a suspicious login attempt is detected, the server immediately notifies the administrator of the information. However, if the administrator is busy with work, only high-priority information is quickly presented based on sentiment analysis.

[0530] An example of a prompt might be a question like, "What factors does this system consider when detecting anomalies and optimizing user responses based on its emotion engine?" This would deepen engineers' understanding of the specific problems they face and help them design and improve the system.

[0531] The flow of the specific processing in Example 2 will be explained using Figure 13.

[0532] Step 1:

[0533] The server receives network logs, surveillance camera footage, sensor recordings, and other data from various terminals and IoT devices as input. Because this data exists in different formats, the server uses a data management tool to convert it all into a unified format. This conversion process, by formatting the data into formats such as JSON or CSV, facilitates subsequent analysis steps. As a result, the converted data is output.

[0534] Step 2:

[0535] Using pre-processed data as input, the server performs anomaly analysis using a machine learning model. In this step, frameworks such as TensorFlow are used to reference normal usage pattern models and detect anomalies. Specifically, it identifies unusual login attempts and fluctuations in network traffic and outputs corresponding alert information. This anomaly information is used in the next step.

[0536] Step 3:

[0537] Based on the anomaly information obtained, the server uses an emotion analysis device to evaluate the user's emotional state. The input for this step consists of the anomaly information and user feedback and behavioral data. Using NLP techniques, the psychological state is inferred from voice tone and text, and the user's emotional state is output as the analysis result. For example, the evaluation might be expressed as a numerical value called StressLevel.

[0538] Step 4:

[0539] Based on anomaly information and the user's emotional state, the server generates and notifies the user of the most appropriate warning message. The inputs here are details of the anomaly and the output of the emotional analysis. Based on this, the warning message is adjusted. Specifically, if high stress levels are detected, only concise and highly important information is provided. The output is a customized alert message for the user.

[0540] Step 5:

[0541] Finally, the user takes action based on the alert received. In this step, they use the provided countermeasures to improve the situation. The user reviews the alert content and takes specific actions, such as reporting to the system administrator or strengthening security measures, as needed. As a result, it is confirmed that appropriate security measures have been taken.

[0542] (Application Example 2)

[0543] Next, we will explain application example 2. In the following explanation, the data processing device 12 will be referred to as the "server," and the headset-type terminal 314 will be referred to as the "terminal."

[0544] Conventional anomaly detection systems focus solely on purely technical data analysis and lack the ability to flexibly respond to changes in the operator's emotional state. As a result, notifications and suggestions may not be efficient for recipients when they are feeling stressed. This can make decision-making more difficult, especially in busy environments, and may compromise the timeliness of security responses.

[0545] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means.

[0546] In this invention, the server includes means for receiving information acquired from data collection means, means for preprocessing the received information and converting different types of information into a unified format, and means for detecting anomalies using machine learning techniques based on the preprocessed information. This makes it possible to detect anomalies in real time while taking into account the emotional state of the operator, and to provide appropriate notifications and countermeasures.

[0547] "Data collection means" refers to devices and methods for acquiring different types of information from networks and equipment.

[0548] "Means for receiving information" refers to methods and devices for acquiring information sent from data collection means.

[0549] "Means of preprocessing and conversion" refers to processes or devices that analyze received information and convert data in different formats into a unified format.

[0550] "Machine learning techniques" are methods that use algorithms to analyze data and detect patterns and anomalies.

[0551] "Means for detecting anomalies" refer to processes or devices that use machine learning techniques to discover unusual patterns.

[0552] "Means for evaluating the emotional state of the operator" refers to methods and technologies for analyzing and evaluating the psychological state of the user in real time.

[0553] "Means for optimizing notification content" refers to processes and technologies for adjusting how anomalies are reported and how countermeasures are suggested, based on the emotional state of the operator.

[0554] A server plays a crucial role in implementing this invention. First, the server receives information from a wide variety of data collection methods. This includes network logs, video from surveillance cameras, and sensor recordings. Since the received information may be in different formats, the server preprocesses it and converts it into a unified format.

[0555] Next, the server analyzes the unified data using machine learning techniques to detect anomalies. This process also incorporates a function to evaluate the user's emotional state based on heart rate and facial expression data obtained from the user's device. This allows the server to optimize notification content and propose more appropriate countermeasures when an anomaly is detected, taking the user's emotional state into consideration.

[0556] For example, if a user is in a stressful situation, the server will adjust its notifications to be concise and offer step-by-step suggestions to reduce the user's burden. This improves usability and allows users to take quick and appropriate action.

[0557] As a concrete example, consider network problems that occur when students are taking online classes. This system reduces user stress by allowing the server to provide a concise message such as, "The network is unstable. Please try again in a few minutes."

[0558] Examples of prompts for a generative AI model include the following:

[0559] "How can we improve the content of network anomaly alerts when users are experiencing stress?"

[0560] The flow of a specific process in Application Example 2 will be explained using Figure 14.

[0561] Step 1:

[0562] The server receives network logs, video from surveillance cameras, and sensor recordings from data collection devices. Since this data is in different formats, the server performs a process to convert it to a unified format. Specifically, it converts data in different formats into a common data model and structures it to prepare for efficient analysis.

[0563] Step 2:

[0564] The server uses pre-processed data and machine learning techniques to analyze it and detect anomalies. In this analysis, a model trained on normal patterns is applied to identify deviant patterns and potential anomalies. The input is pre-processed data in a unified format, and the output includes the presence or absence of anomalies and their details.

[0565] Step 3:

[0566] The server receives heart rate and facial expression data transmitted from the user's device and evaluates the user's emotional state. During this process, an emotion recognition algorithm is used to analyze the data and identify emotions such as stress and relaxation. The system uses the user's biometric data as input and obtains the user's emotional state as output.

[0567] Step 4:

[0568] If an anomaly is detected, the server generates an optimized notification that takes the user's emotional state into account. Specifically, if the user is experiencing stress, the notification will be concise and include step-by-step countermeasures. The system uses anomaly information and emotional state as input to generate the optimal notification content to send to the user as output.

[0569] Step 5:

[0570] Ultimately, the server sends the generated notification to the user in real time. This notification includes details of the anomaly that occurred and specific actions the user should take. Based on this notification, the user can quickly and accurately take appropriate action.

[0571] The specific processing unit 290 transmits the result of the specific processing to the headset terminal 314. In the headset terminal 314, the control unit 46A causes the speaker 240 and display 343 to output the result of the specific processing. The microphone 238 acquires audio indicating user input for the result of the specific processing. The control unit 46A transmits the audio data indicating user input acquired by the microphone 238 to the data processing unit 12. In the data processing unit 12, the specific processing unit 290 acquires the audio data.

[0572] Data generation model 58 is a type of so-called generative AI (Artificial Intelligence). One example of data generation model 58 is ChatGPT (Internet search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search) <url: https: gemini.google.com ?hl="ja">Examples of generative AI include the following. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 is input with prompts containing instructions, and with inference data such as audio data representing speech, text data representing text, and image data representing images. The data generation model 58 infers from the input inference data according to the instructions indicated by the prompts, and outputs the inference results in data formats such as audio data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0573] In the above embodiment, an example was given in which specific processing is performed by the data processing device 12, but the technology of this disclosure is not limited thereto, and specific processing may also be performed by the headset terminal 314.

[0574] [Fourth Embodiment]

[0575] Figure 7 shows an example of the configuration of the data processing system 410 according to the fourth embodiment.

[0576] As shown in Figure 7, the data processing system 410 includes a data processing device 12 and a robot 414. An example of the data processing device 12 is a server.

[0577] The data processing device 12 comprises a computer 22, a database 24, and a communication interface 26. The computer 22 is an example of a "computer" related to the technology of this disclosure. The computer 22 comprises a processor 28, RAM 30, and storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication interface 26 are also connected to the bus 34. The communication interface 26 is connected to a network 54. An example of the network 54 is a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0578] The robot 414 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication interface 44, and a controlled object 443. The computer 36 includes a processor 46, RAM 48, and storage 50. The processor 46, RAM 48, and storage 50 are connected to a bus 52. The microphone 238, speaker 240, camera 42, and controlled object 443 are also connected to the bus 52.

[0579] The microphone 238 receives voice signals from the user 20 and receives instructions from the user 20. The microphone 238 captures the voice signals from the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to the instructions from the processor 46.

[0580] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an image sensor such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the area around the user 20 (for example, an imaging range defined by a field of view equivalent to the width of a typical healthy person's field of vision).

[0581] Communication interface 44 is connected to network 54. Communication interfaces 44 and 26 are responsible for the exchange of various information between processor 46 and processor 28 via network 54. The exchange of various information between processor 46 and processor 28 using communication interfaces 44 and 26 is performed in a secure manner.

[0582] The controlled object 443 includes a display device, LEDs in the eyes, and motors that drive the arms, hands, and feet. The posture and gestures of the robot 414 are controlled by controlling the motors of the arms, hands, and feet. Some of the robot 414's emotions can be expressed by controlling these motors. Furthermore, the robot 414's facial expressions can also be expressed by controlling the illumination state of the LEDs in its eyes.

[0583] Figure 8 shows an example of the main functions of the data processing device 12 and the robot 414. As shown in Figure 8, the data processing device 12 performs specific processing using the processor 28. The storage 32 stores the specific processing program 56.

[0584] The specific processing program 56 is an example of a "program" relating to the technology of this disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0585] The storage 32 stores the data generation model 58 and the emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0586] In robot 414, the processor 46 performs the reception output processing. The storage 50 stores the reception output program 60. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output processing is realized by the processor 46 operating as a control unit 46A according to the reception output program 60 executed on the RAM 48.

[0587] Next, the specific processing performed by the specific processing unit 290 of the data processing device 12 will be described. In the following description, the data processing device 12 will be referred to as the "server" and the robot 414 as the "terminal".

[0588] This invention includes a system for addressing security challenges faced by small and medium-sized enterprises. The system aims to receive data from various network and IoT devices via a data collection device, process this data in real time, and quickly and effectively identify threats.

[0589] First, the server collects log information and video data from each terminal and IoT device connected to the network (e.g., surveillance cameras and door sensors). Since this data is in various formats, the server converts it into a unified format and prepares it for analysis. At this stage, noise is removed, and redundant data that is not necessary for analysis is eliminated.

[0590] Next, the server uses the formatted data to detect anomalies using a machine learning algorithm. This algorithm is designed to model normal operating patterns and detect actions that deviate from them. For example, if a terminal transfers data far exceeding the normal range, it will be judged as an anomaly.

[0591] If an anomaly is detected, the server immediately generates an alert and transmits the information to the relevant user (e.g., network administrator). This alert provides appropriate countermeasures based on the situation, allowing users to respond quickly to threats. The countermeasures are specific and recommend actions such as restricting suspicious access.

[0592] Furthermore, the servers regularly retrain their machine learning algorithm models with new data, ensuring they are always able to effectively respond to the latest threats. This retraining process maintains system accuracy and enables flexible responses to evolving security threats.

[0593] In this way, the present invention provides a concrete method for solving the complex security challenges faced by small and medium-sized enterprises and for achieving advanced threat detection and rapid response. This system is expected to reduce security risks and streamline management within companies.

[0594] The following describes the processing flow.

[0595] Step 1:

[0596] The server collects data from each terminal and IoT device connected to the network. Specifically, this includes network logs, operating status from each device, and sensor information. Because this data is in various formats, it is converted to a unified format in the next step.

[0597] Step 2:

[0598] The server preprocesses the collected data and converts it into a unified format. This includes data standardization, noise reduction, and data imputation. This process ensures that data obtained from different devices can be consistently analyzed.

[0599] Step 3:

[0600] The server inputs pre-processed data into a machine learning model to perform anomaly detection. This model is trained on normal patterns and identifies abnormal behavior or actions that are considered cyberattacks. For example, it can detect sudden data transfers or unauthorized access attempts.

[0601] Step 4:

[0602] When an anomaly is detected, the server generates an alert. This alert is immediately sent to the relevant users, such as network administrators. The alert includes detailed information such as the type of anomaly, the time it occurred, and the scope of its impact.

[0603] Step 5:

[0604] The server proposes countermeasures for detected anomalies. These proposals are made automatically and may include, for example, restricting access from specific devices or blacklisting suspicious IP addresses. Users can then quickly implement these countermeasures.

[0605] Step 6:

[0606] The server periodically retrains its machine learning models with new data to maintain system accuracy. This process allows the system to continuously adapt to new threats. Since retraining is performed as an automated system process, no additional management is required from the user.

[0607] (Example 1)

[0608] Next, we will describe Example 1. In the following description, the data processing device 12 will be referred to as the "server" and the robot 414 as the "terminal".

[0609] The problem that this invention aims to solve is to provide a system that can effectively and quickly respond to the increasing information security risks in small and medium-sized enterprises. Conventional methods have made it difficult to deal with complex security problems within limited resources and technical constraints. Therefore, there is a need for a system that can detect anomalies in real time, automatically propose the optimal countermeasures, and flexibly adapt to new threats.

[0610] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 1 is realized by the following means.

[0611] In this invention, the server includes means for receiving information acquired from network devices, means for preprocessing the received information and converting information in different formats into a unified format, and means for detecting anomalies based on an automatic learning function using the preprocessed information. This enables real-time anomaly detection and the proposal of appropriate countermeasures, thereby reducing information security risks for small and medium-sized enterprises and streamlining management.

[0612] "Network equipment" refers to all devices connected to a communication network that are used to send and receive data.

[0613] "Information" refers to digital data used for security analysis, such as log data and video data acquired from network devices.

[0614] "Preprocessing" refers to processes such as noise reduction and format conversion that are performed to prepare collected information into an analyzable format.

[0615] A "unified format" refers to a data format that converts information in various forms into a consistent representation suitable for analysis.

[0616] "Automatic learning function" refers to a machine learning algorithm used to detect patterns in data and identify anomalies.

[0617] "Anomaly" refers to a state that indicates suspicious activity or data transfer that deviates from the normal operating pattern.

[0618] A "warning" refers to a notification that alerts the user to a detected abnormal condition.

[0619] "Countermeasures" refer to specific guidelines and procedures to be taken in response to detected anomalies.

[0620] "Retraining" refers to the process of updating learning algorithms using the latest data to improve the accuracy of automated learning functions.

[0621] "Immediate analysis" refers to performing analysis immediately after data is collected, and detecting and reporting anomalies right away.

[0622] The invented system was developed to manage corporate information security and efficiently detect anomalies. In this system, a server plays a central role. The server collects information from network devices and multiple terminals and analyzes that information in real time.

[0623] The server acquires log data and video data from network devices and terminals through pre-configured protocols. Since this data is typically in various formats such as JSON or XML, the server converts it to a unified format. This conversion process uses programming languages ​​such as Python or Java to perform data normalization and noise reduction.

[0624] The collected information is analyzed by a machine learning algorithm running on the server. The algorithm used here employs an anomaly detection model designed to detect abnormal behavior. This model learns normal behavioral patterns, evaluates deviations from them in real time, and identifies them as anomalies. When an anomaly is detected, the server immediately alerts the user and suggests countermeasures. These countermeasures may include restricting suspicious access or changing access permissions.

[0625] Furthermore, the servers regularly retrain their machine learning models with new data to address evolving security threats. This process continuously optimizes the accuracy and effectiveness of the models.

[0626] As a concrete example, if abnormal access occurs to the network in a certain office, the server immediately detects the anomaly and sends a warning to the user, who is the security officer. At this time, the user is presented with specific countermeasures, such as temporarily suspending security protocols or blocking the source of the unauthorized access.

[0627] An example of a prompt to input into a generative AI model is, "Please tell me about the latest anomaly detected on our network and the countermeasures." This prompt is used to get the generative AI model to suggest details of the anomaly and immediate countermeasures.

[0628] The flow of the specific processing in Example 1 will be explained using Figure 11.

[0629] Step 1:

[0630] The server receives log information and video data from network devices and individual terminals. This information is provided in various formats. The server collects this diverse data as input and outputs a unified dataset. Specifically, the server uses API calls and database queries to centrally collect information.

[0631] Step 2:

[0632] The server preprocesses the collected information and converts data in different formats into a unified format. It takes the raw data collected in the previous step as input and creates data formatted for analysis as output. Specifically, it uses a Python script to normalize the data and remove unnecessary noise.

[0633] Step 3:

[0634] The server uses automated learning capabilities to detect anomalies based on formatted data. It uses pre-processed data as input and generates detection results indicating the presence or absence of anomalies as output. Specifically, it feeds data into a trained machine learning model and identifies data that deviates from normal patterns.

[0635] Step 4:

[0636] When an anomaly is detected, the server notifies the user of a warning. It receives the anomaly detection result as input and generates a warning message to be sent to the user as output. Specifically, the server sends an alert to the network administrator via the email system.

[0637] Step 5:

[0638] The server proposes specific countermeasures for detected anomalies. It takes the anomaly detection results as input and presents recommended countermeasures as output. Specifically, the server refers to past countermeasures recorded in the database and displays the suggestions on the user dashboard.

[0639] Step 6:

[0640] The server periodically retrains its automated learning model using the latest data. It uses newly collected data as input and outputs the updated model results. Specifically, the server generates a new dataset, feeds it into the AI ​​model, and performs a retraining process to improve the model's accuracy.

[0641] (Application Example 1)

[0642] Next, we will explain Application Example 1. In the following explanation, the data processing device 12 will be referred to as the "server" and the robot 414 as the "terminal".

[0643] Small and medium-sized enterprises (SMEs) face the challenge of implementing effective security measures with limited resources. Furthermore, traditional systems struggle with real-time anomaly detection and the rapid proposal of countermeasures based on these detections, potentially increasing security risks. Additionally, tracking past warning history and monitoring the progress of machine learning models becomes cumbersome, complicating management.

[0644] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 1 is realized by the following means.

[0645] In this invention, the server includes means for receiving information acquired from a data collection device, means for preprocessing the received information and converting information in different formats into a unified format, means for detecting anomalies based on a machine learning method using the preprocessed information, means for checking past warning history on a terminal device, and means for periodically retraining the machine learning method using new information. This enables efficient and effective resolution of security challenges faced by small and medium-sized enterprises, and allows for real-time anomaly detection and rapid response.

[0646] A "data collection device" is a device used to acquire data from various information sources, and it has the function of collecting information from network-connected information terminals, IoT devices, and other similar devices.

[0647] "Preprocessing" refers to the process of converting information in different formats into a unified, analyzable format, and includes noise reduction and removal of unnecessary data.

[0648] "Machine learning techniques" refer to algorithms that learn patterns and rules from data to detect anomalies in a target, and are primarily used to build predictive models based on past data.

[0649] Anomaly detection is the process of identifying behaviors or information that deviate from normal operating patterns, and it is a means to enable rapid security responses.

[0650] "Warning History Confirmation" is a function for tracking and managing records of warnings and alerts that have occurred in the past, and is used to identify the cause of problems and to formulate future countermeasures.

[0651] "Retraining" refers to the process of updating machine learning models with new information to keep them up-to-date, enabling flexible responses to evolving security threats.

[0652] A "terminal device" is a device with computing resources that can be directly operated by a user, and is used to receive information from security systems and to check history.

[0653] The system for implementing this invention is primarily built on the interaction between a server and terminal devices. The server is responsible for acquiring information from various networks and IoT devices via a data collection device. Since this information often arrives in an unstructured format, the server performs preprocessing to convert the information into a unified format. Data preprocessing includes noise reduction and removal of redundant information, and is mainly implemented using Python.

[0654] Subsequently, the server utilizes TensorFlow to perform anomaly detection based on machine learning techniques. This is designed to learn normal operating patterns and immediately detect deviations. When an anomaly is detected, a real-time warning is sent to the terminal device via Firebase. The terminal device has a function to check past warning history, which users can use to track the cause of problems and perform post-incident analysis.

[0655] To maintain the accuracy of machine learning models, the servers retrain the models using new information. This retraining process utilizes an ever-evolving dataset to flexibly respond to the latest security threats.

[0656] For example, if data access exceeds normal operating limits during nighttime hours, the server immediately detects the anomaly and sends a warning to the terminal device. Based on this warning, administrators can take swift action, such as blocking access.

[0657] An example of a prompt message for a generated AI model might be: "Review recent data collection logs, identify any potentially anomalous patterns, and create an endpoint to alert the affected users." Utilizing this prompt message can support the development of more advanced anomaly detection models.

[0658] The flow of a specific process in Application Example 1 will be explained using Figure 12.

[0659] Step 1:

[0660] The server receives information from data collection devices, networks, and IoT devices. It acquires raw information in various formats as input and prepares this information for preprocessing as output. Specifically, the server transfers log information and temporarily stores it in a receive buffer.

[0661] Step 2:

[0662] The server preprocesses the received information and converts it into a unified format. The input is information in various formats, and the output is information in a parseable, unified format. It performs processes to remove data noise and redundant information. Specifically, it uses a Python data processing library to perform data cleaning.

[0663] Step 3:

[0664] The server uses pre-processed information to perform anomaly detection using a machine learning model. It receives information in a unified format as input and generates anomaly detection results as output. The data is input into a TensorFlow model to detect deviations from normal operating patterns. Specifically, if an anomaly is detected, a flag is set and the data is passed to the next process.

[0665] Step 4:

[0666] The server uses Firebase to send alerts to terminal devices when an anomaly is detected. The input is the result of the anomaly detection, and the output is the sending of the warning message. Specifically, it sends a push notification to the administrator's terminal and displays a warning screen.

[0667] Step 5:

[0668] The terminal allows users to review their past warning history based on the warnings they receive. Input consists of warning data and history data, and output is a list of the history. Specifically, the history data is displayed as a list on the GUI, allowing the user to access detailed information.

[0669] Step 6:

[0670] The server periodically retrains the machine learning model using new information. It receives the latest dataset as input and an updated model as output. Specifically, it runs a periodic batch job to retrain the model using TensorFlow.

[0671] Step 7:

[0672] The user provides prompts to the generated AI model, assisting in its development. Inputs are prompts such as, "Review recent data collection logs, identify potentially anomalous patterns, and create an endpoint to alert the affected users." Outputs include the generated analysis model and suggestions. Specifically, the user creates model improvements based on the prompts and integrates them into the system.

[0673] Furthermore, an emotion engine that estimates the user's emotions may be incorporated. That is, the identification processing unit 290 may use the emotion identification model 59 to estimate the user's emotions and perform identification processing using the user's emotions.

[0674] This invention provides a system that enables more accurate security responses by considering the user's emotional state during data collection and anomaly detection. Specific embodiments are described below.

[0675] First, the server collects the necessary data from each terminal and IoT device connected to the network. This collected data includes network logs, surveillance camera footage, and door sensor recordings. Because this data exists in different formats, the server converts it into a unified format.

[0676] Next, the server analyzes the pre-processed data and uses machine learning algorithms to detect anomalies. These algorithms are designed to learn normal usage patterns and identify deviations from them or movements that could be considered cyberattacks. In this process, an emotion engine is introduced to recognize the user's emotional state, and based on the user's reactions and feedback, it optimizes the priority of security responses and notification methods.

[0677] If an anomaly is detected, the server generates an alert and notifies the user in real time. The alert includes details of the anomaly, as well as suggested countermeasures based on the user's emotional state. For example, if the emotion engine determines that the user is stressed, the alert will be made more concise and countermeasures will be suggested in a step-by-step manner.

[0678] Furthermore, the server customizes suggested countermeasures for anomalies based on information obtained by the emotion engine. This ensures that optimal security measures are implemented while taking into account the user's current emotional state. For example, if a system administrator is extremely busy, the emotion engine recognizes this and reduces their workload by prioritizing and presenting only high-priority information.

[0679] By incorporating an emotion engine in this way, flexible responses that take into account the user's situation become possible, enabling safe and efficient security management even for small and medium-sized enterprises.

[0680] The following describes the processing flow.

[0681] Step 1:

[0682] The server collects data from various terminals and IoT devices on the network. This data includes network logs, camera footage, and sensor operation information. Because this data is often sent in different formats, it is collected for subsequent processing.

[0683] Step 2:

[0684] The server preprocesses the collected data and standardizes its format. Specifically, it cleans the data and removes noise. Furthermore, it converts it into time-series data or structured data as needed and formats it into an analyzable format.

[0685] Step 3:

[0686] The server inputs pre-processed data into a machine learning algorithm to perform anomaly detection. This algorithm operates in real time, detecting anomalies and potential threats that deviate from normal patterns. The detection results are stored along with detailed information such as the type of anomaly and its scope of impact.

[0687] Step 4:

[0688] When an anomaly is detected, the server runs the emotion engine to evaluate the user's emotional state. The emotion engine analyzes user input and behavior logs to determine the current emotional state (e.g., stress level, concentration level, etc.). This information is used to prioritize and customize alerts.

[0689] Step 5:

[0690] Based on anomaly detection, the server generates and notifies the user of an alert. At this time, it considers the emotional state fed back by the emotion engine and adjusts the content and tone accordingly. For example, if the user is feeling stressed, a concise alert summarizing the key points will be delivered.

[0691] Step 6:

[0692] The server then proposes appropriate countermeasures for the detected anomalies. In doing so, it adjusts the method and order in which the countermeasures are presented based on the user's emotional state. For example, if there are multiple suggestions, they are presented in stages or as alternatives to minimize emotional burden.

[0693] Step 7:

[0694] The server periodically retrains its machine learning models with new datasets to maintain system accuracy. Retraining enables flexible responses to evolving threats and adaptation to changing user usage patterns over time.

[0695] (Example 2)

[0696] Next, we will describe Example 2. In the following description, the data processing device 12 will be referred to as the "server" and the robot 414 as the "terminal".

[0697] In recent years, the increasing complexity of information and the sophistication of cyberattacks have necessitated improved accuracy in anomaly detection systems. However, conventional systems focus solely on anomaly detection, making it difficult to provide flexible response measures that take into account the user's psychological state. Therefore, there is a need for efficient notifications and response proposals that do not cause unnecessary stress to users.

[0698] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 2 is realized by the following means.

[0699] In this invention, the server includes means for receiving information acquired from data collection means, means for preprocessing the received information and converting information of different formats into a standard format, means for analyzing the preprocessed information and recognizing anomalies based on a machine learning model, means for evaluating the user's psychological state using an emotion analysis device, means for notifying a warning based on the anomaly recognition and the user's psychological state, and means for proposing countermeasures against the anomaly and adjusting the countermeasures considering the user's psychological state. This enables not only anomaly detection but also efficient and flexible security responses that take into account the user's psychological state.

[0700] "Data collection means" refers to methods and devices for acquiring data and information from networks and various information terminals.

[0701] "Means of receiving" refers to methods or devices that take in information acquired through data collection means and convert it into a format that can be processed within the system.

[0702] "Preprocessing" refers to the process of preparing acquired raw data for easier analysis, such as converting it into a standardized format.

[0703] A "standard format" refers to a unified data structure obtained by converting data in various formats into a consistent, analyzable format.

[0704] "Means for recognizing anomalies" refer to methods and devices that use machine learning models and algorithms to identify abnormal information that deviates from normal patterns.

[0705] An "emotion analysis device" is a method or device used to analyze a user's behavior and reactions and evaluate their emotional state.

[0706] "Means of notifying warnings" refers to methods or devices for communicating warnings to users about anomalies detected by the system.

[0707] "Means for proposing countermeasures" refers to methods or devices for presenting appropriate countermeasures to users in response to detected anomalies.

[0708] "Means of adjustment based on psychological state" refers to methods or devices that optimize the information and countermeasures provided to suit the user's emotions and psychological state.

[0709] This invention is a system that centrally manages information acquired from data collection devices and performs anomaly detection and analysis of users' emotional states. Specifically, it is implemented in the following procedure.

[0710] The server first collects data such as network logs, surveillance camera footage, and sensor records from various terminals and IoT devices connected to the network. Since this data exists in various formats, the server converts it all into a unified format. Database software and data management tools are used for this purpose. Specifically, SQL databases and data format conversion libraries are used.

[0711] Next, the server uses a machine learning model to analyze this preprocessed data and identify anomalies. This machine learning model is trained to model normal usage patterns and identify anomalies that deviate from them. Here, machine learning frameworks such as TensorFlow and PyTorch are used.

[0712] Subsequently, the server evaluates the user's emotional state using an emotion analysis device. This step involves speech recognition and text feedback analysis, utilizing an emotion engine to determine the user's psychological state. Natural language processing (NLP) technology is used for emotion analysis. Specific tools used include NLTK and spaCy.

[0713] When an anomaly is detected, the server immediately generates an alert and notifies the user of the details of the anomaly. This alert includes appropriate countermeasures for the anomaly, and is tailored to the user's psychological state. For example, if the user is experiencing stress, concise and easy-to-understand content is prioritized.

[0714] For example, in an office environment, if a suspicious login attempt is detected, the server immediately notifies the administrator of the information. However, if the administrator is busy with work, only high-priority information is quickly presented based on sentiment analysis.

[0715] An example of a prompt might be a question like, "What factors does this system consider when detecting anomalies and optimizing user responses based on its emotion engine?" This would deepen engineers' understanding of the specific problems they face and help them design and improve the system.

[0716] The flow of the specific processing in Example 2 will be explained using Figure 13.

[0717] Step 1:

[0718] The server receives network logs, surveillance camera footage, sensor recordings, and other data from various terminals and IoT devices as input. Because this data exists in different formats, the server uses a data management tool to convert it all into a unified format. This conversion process, by formatting the data into formats such as JSON or CSV, facilitates subsequent analysis steps. As a result, the converted data is output.

[0719] Step 2:

[0720] Using pre-processed data as input, the server performs anomaly analysis using a machine learning model. In this step, frameworks such as TensorFlow are used to reference normal usage pattern models and detect anomalies. Specifically, it identifies unusual login attempts and fluctuations in network traffic and outputs corresponding alert information. This anomaly information is used in the next step.

[0721] Step 3:

[0722] Based on the anomaly information obtained, the server uses an emotion analysis device to evaluate the user's emotional state. The input for this step consists of the anomaly information and user feedback and behavioral data. Using NLP techniques, the psychological state is inferred from voice tone and text, and the user's emotional state is output as the analysis result. For example, the evaluation might be expressed as a numerical value called StressLevel.

[0723] Step 4:

[0724] Based on anomaly information and the user's emotional state, the server generates and notifies the user of the most appropriate warning message. The inputs here are details of the anomaly and the output of the emotional analysis. Based on this, the warning message is adjusted. Specifically, if high stress levels are detected, only concise and highly important information is provided. The output is a customized alert message for the user.

[0725] Step 5:

[0726] Finally, the user takes action based on the alert received. In this step, they use the provided countermeasures to improve the situation. The user reviews the alert content and takes specific actions, such as reporting to the system administrator or strengthening security measures, as needed. As a result, it is confirmed that appropriate security measures have been taken.

[0727] (Application Example 2)

[0728] Next, we will explain application example 2. In the following explanation, the data processing device 12 will be referred to as the "server" and the robot 414 as the "terminal".

[0729] Conventional anomaly detection systems focus solely on purely technical data analysis and lack the ability to flexibly respond to changes in the operator's emotional state. As a result, notifications and suggestions may not be efficient for recipients when they are feeling stressed. This can make decision-making more difficult, especially in busy environments, and may compromise the timeliness of security responses.

[0730] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means.

[0731] In this invention, the server includes means for receiving information acquired from data collection means, means for preprocessing the received information and converting different types of information into a unified format, and means for detecting anomalies using machine learning techniques based on the preprocessed information. This makes it possible to detect anomalies in real time while taking into account the emotional state of the operator, and to provide appropriate notifications and countermeasures.

[0732] "Data collection means" refers to devices and methods for acquiring different types of information from networks and equipment.

[0733] "Means for receiving information" refers to methods and devices for acquiring information sent from data collection means.

[0734] "Means of preprocessing and conversion" refers to processes or devices that analyze received information and convert data in different formats into a unified format.

[0735] "Machine learning techniques" are methods that use algorithms to analyze data and detect patterns and anomalies.

[0736] "Means for detecting anomalies" refer to processes or devices that use machine learning techniques to discover unusual patterns.

[0737] "Means for evaluating the emotional state of the operator" refers to methods and technologies for analyzing and evaluating the psychological state of the user in real time.

[0738] "Means for optimizing notification content" refers to processes and technologies for adjusting how anomalies are reported and how countermeasures are suggested, based on the emotional state of the operator.

[0739] A server plays a crucial role in implementing this invention. First, the server receives information from a wide variety of data collection methods. This includes network logs, video from surveillance cameras, and sensor recordings. Since the received information may be in different formats, the server preprocesses it and converts it into a unified format.

[0740] Next, the server analyzes the unified data using machine learning techniques to detect anomalies. This process also incorporates a function to evaluate the user's emotional state based on heart rate and facial expression data obtained from the user's device. This allows the server to optimize notification content and propose more appropriate countermeasures when an anomaly is detected, taking the user's emotional state into consideration.

[0741] For example, if a user is in a stressful situation, the server will adjust its notifications to be concise and offer step-by-step suggestions to reduce the user's burden. This improves usability and allows users to take quick and appropriate action.

[0742] As a concrete example, consider network problems that occur when students are taking online classes. This system reduces user stress by allowing the server to provide a concise message such as, "The network is unstable. Please try again in a few minutes."

[0743] Examples of prompts for a generative AI model include the following:

[0744] "How can we improve the content of network anomaly alerts when users are experiencing stress?"

[0745] The flow of a specific process in Application Example 2 will be explained using Figure 14.

[0746] Step 1:

[0747] The server receives network logs, video from surveillance cameras, and sensor recordings from data collection devices. Since this data is in different formats, the server performs a process to convert it to a unified format. Specifically, it converts data in different formats into a common data model and structures it to prepare for efficient analysis.

[0748] Step 2:

[0749] The server uses pre-processed data and machine learning techniques to analyze it and detect anomalies. In this analysis, a model trained on normal patterns is applied to identify deviant patterns and potential anomalies. The input is pre-processed data in a unified format, and the output includes the presence or absence of anomalies and their details.

[0750] Step 3:

[0751] The server receives heart rate and facial expression data transmitted from the user's device and evaluates the user's emotional state. During this process, an emotion recognition algorithm is used to analyze the data and identify emotions such as stress and relaxation. The system uses the user's biometric data as input and obtains the user's emotional state as output.

[0752] Step 4:

[0753] If an anomaly is detected, the server generates an optimized notification that takes the user's emotional state into account. Specifically, if the user is experiencing stress, the notification will be concise and include step-by-step countermeasures. The system uses anomaly information and emotional state as input to generate the optimal notification content to send to the user as output.

[0754] Step 5:

[0755] Ultimately, the server sends the generated notification to the user in real time. This notification includes details of the anomaly that occurred and specific actions the user should take. Based on this notification, the user can quickly and accurately take appropriate action.

[0756] The specific processing unit 290 transmits the result of the specific processing to the robot 414. In the robot 414, the control unit 46A causes the speaker 240 and the controlled object 443 to output the result of the specific processing. The microphone 238 acquires audio indicating user input for the result of the specific processing. The control unit 46A transmits the audio data indicating user input acquired by the microphone 238 to the data processing unit 12. In the data processing unit 12, the specific processing unit 290 acquires the audio data.

[0757] Data generation model 58 is a type of so-called generative AI (Artificial Intelligence). One example of data generation model 58 is ChatGPT (Internet search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search) <url: https: gemini.google.com ?hl="ja">Examples of generative AI include the following. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 is input with prompts containing instructions, and with inference data such as audio data representing speech, text data representing text, and image data representing images. The data generation model 58 infers from the input inference data according to the instructions indicated by the prompts, and outputs the inference results in data formats such as audio data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0758] In the above embodiment, an example was given in which the specific processing is performed by the data processing device 12, but the technology of this disclosure is not limited thereto, and the specific processing may also be performed by the robot 414.

[0759] Furthermore, the emotion identification model 59, acting as an emotion engine, may determine the user's emotion according to a specific mapping. Specifically, the emotion identification model 59 may determine the user's emotion according to a specific mapping, which is an emotion map (see Figure 9). Similarly, the emotion identification model 59 may also determine the robot's emotion, and the identification processing unit 290 may perform identification processing using the robot's emotion.

[0760] Figure 9 shows an emotion map 400 in which multiple emotions are mapped. In the emotion map 400, emotions are arranged in concentric circles radiating from the center. The closer to the center of the concentric circles, the more primitive the emotions are located. Further out of the concentric circles, emotions representing states and actions arising from mental states are located. Emotion is a concept that includes feelings and mental states. On the left side of the concentric circles, emotions that are generally generated from reactions occurring in the brain are located. On the right side of the concentric circles, emotions that are generally induced by situational judgment are located. Above and below the concentric circles, emotions that are generally generated from reactions occurring in the brain and induced by situational judgment are located. In addition, the emotion of "pleasure" is located on the upper side of the concentric circles, and the emotion of "displeasure" is located on the lower side. Thus, in the emotion map 400, multiple emotions are mapped based on the structure in which emotions arise, and emotions that are likely to occur simultaneously are mapped close together.

[0761] These emotions are distributed at the 3 o'clock position on the Emotion Map 400, and usually fluctuate between feelings of security and anxiety. In the right half of the Emotion Map 400, situational awareness takes precedence over internal feelings, resulting in a calm impression.

[0762] The inside of the Emotion Map 400 represents inner thoughts, while the outside represents actions. Therefore, the further you go from the outside of the Emotion Map 400, the more visible (expressed in actions) your emotions become.

[0763] Here, human emotions are based on various balances, such as posture and blood sugar levels. When these balances deviate from the ideal, it results in discomfort, and when they approach the ideal, it results in pleasure. Similarly, in robots, cars, motorcycles, etc., emotions can be created based on various balances, such as posture and battery level. When these balances deviate from the ideal, it results in discomfort, and when they approach the ideal, it results in pleasure. The emotion map can be generated, for example, based on Dr. Mitsuyoshi's emotion map (Research on a system for analyzing brain physiological signals of speech emotion recognition and emotion, Tokushima University, doctoral dissertation: https: / / ci.nii.ac.jp / naid / 500000375379). The left half of the emotion map contains emotions belonging to a region called "response," where sensation is dominant. The right half of the emotion map contains emotions belonging to a region called "situation," where situational awareness is dominant.

[0764] The emotion map defines two emotions that promote learning. One is the emotion around the middle of the negative "repentance" and "reflection" on the situation side. In other words, it is when the robot experiences negative emotions such as "I never want to feel this way again" or "I don't want to be scolded again." The other is the emotion around the positive "desire" on the reaction side. In other words, it is when the robot has positive feelings such as "I want more" or "I want to know more."

[0765] The emotion identification model 59 inputs user input into a pre-trained neural network, obtains emotion values ​​representing each emotion shown in the emotion map 400, and determines the user's emotion. This neural network is pre-trained based on multiple training data sets, which are combinations of user input and emotion values ​​representing each emotion shown in the emotion map 400. Furthermore, this neural network is trained so that emotions located close together have similar values, as shown in the emotion map 900 in Figure 10. Figure 10 shows an example where multiple emotions such as "reassured," "calm," and "confident" have similar emotion values.

[0766] The above description primarily focuses on the functions of the data processing device 12 in relation to this disclosure. However, the system related to this disclosure is not necessarily implemented on a server. The system related to this disclosure may be implemented as a general information processing system. This disclosure may be implemented, for example, as a software program that runs on a personal computer or as an application that runs on a smartphone. The method related to this disclosure may be provided to users in SaaS (Software as a Service) format.

[0767] In the above embodiment, an example was given in which a specific process is performed by a single computer 22. However, the technology of this disclosure is not limited thereto, and a distributed processing of the specific process may be performed by multiple computers, including computer 22. For example, a data generation model 58 may be provided in an external device of the data processing device 12, and the external device may generate data according to the input data.

[0768] In the above embodiment, an example was given in which the specific processing program 56 is stored in the storage 32, but the technology of this disclosure is not limited thereto. For example, the specific processing program 56 may be stored in a portable, computer-readable, non-temporary storage medium such as a USB (Universal Serial Bus) memory. The specific processing program 56 stored in the non-temporary storage medium is installed in the computer 22 of the data processing device 12. The processor 28 executes specific processing according to the specific processing program 56.

[0769] Alternatively, the specific processing program 56 may be stored in a storage device such as a server connected to the data processing device 12 via the network 54, and the specific processing program 56 may be downloaded and installed on the computer 22 in response to a request from the data processing device 12.

[0770] Furthermore, it is not necessary to store the entirety of the specific processing program 56 in a storage device such as a server connected to the data processing device 12 via the network 54, or to store the entirety of the specific processing program 56 in the storage 32; it is acceptable to store only a portion of the specific processing program 56.

[0771] The following types of processors can be used as hardware resources to perform specific processing. Examples of processors include a CPU, a general-purpose processor that functions as a hardware resource to perform specific processing by executing software, i.e., a program. Other examples of processors include dedicated electrical circuits, such as FPGAs (Field-Programmable Gate Arrays), PLDs (Programmable Logic Devices), or ASICs (Application Specific Integrated Circuits), which have circuit configurations specifically designed to perform specific processing. All of these processors have built-in or connected memory, and all of them perform specific processing by using memory.

[0772] The hardware resource that performs a specific process may consist of one of these various processors, or it may consist of a combination of two or more processors of the same or different types (for example, a combination of multiple FPGAs, or a combination of a CPU and an FPGA). Alternatively, the hardware resource that performs a specific process may consist of a single processor.

[0773] Examples of configurations using a single processor include, firstly, a configuration in which one or more CPUs and software are combined to form a single processor, and this processor functions as a hardware resource that performs a specific process. Secondly, there is a configuration using a processor that realizes the functions of the entire system, including multiple hardware resources that perform a specific process, on a single IC chip, as exemplified by SoCs (System-on-a-chip). In this way, a specific process is realized using one or more of the above types of processors as hardware resources.

[0774] Furthermore, the hardware structure of these various processors can more specifically utilize electrical circuits that combine circuit elements such as semiconductor devices. Also, the specific processing described above is merely an example. Therefore, it goes without saying that unnecessary steps can be deleted, new steps added, or the processing order rearranged, as long as it does not deviate from the main purpose.

[0775] The descriptions and illustrations presented above are detailed explanations of the technical aspects of this disclosure and are merely examples of the technical aspects. For example, the above descriptions of the structure, function, operation, and effect are examples of the structure, function, operation, and effect of the technical aspects of this disclosure. Therefore, it goes without saying that you may delete unnecessary parts, add new elements, or replace elements in the descriptions and illustrations presented above, as long as you do not deviate from the essence of the technical aspects of this disclosure. Furthermore, in order to avoid confusion and facilitate understanding of the technical aspects of this disclosure, explanations of common technical knowledge and the like that do not require special explanation to enable the implementation of the technical aspects of this disclosure have been omitted from the descriptions and illustrations presented above.

[0776] All documents, patent applications, and technical standards described herein are incorporated by reference to the same extent as if each individual document, patent application, and technical standard were specifically and individually noted to be incorporated by reference.

[0777] The following is further disclosed regarding the embodiments described above.

[0778] (Claim 1)

[0779] A means for receiving data acquired from a data collection device,

[0780] A means for preprocessing received data and converting data of different formats into a unified format,

[0781] A means for detecting anomalies based on a machine learning algorithm using preprocessed data,

[0782] A means of notifying users of alerts based on anomaly detection,

[0783] A means of proposing countermeasures for abnormalities,

[0784] A system that includes this.

[0785] (Claim 2)

[0786] The system according to claim 1, wherein the machine learning algorithm enables real-time analysis.

[0787] (Claim 3)

[0788] The system according to claim 1, further comprising means for periodically retraining the machine learning algorithm using new data.

[0789] "Example 1"

[0790] (Claim 1)

[0791] A means for receiving information acquired from a network device,

[0792] A means for preprocessing received information and converting information in different formats into a unified format,

[0793] A means for detecting anomalies based on an automatic learning function using pre-processed information,

[0794] A means of notifying users of warnings based on anomaly detection,

[0795] A means of proposing countermeasures for abnormalities,

[0796] A means to improve the accuracy of the automatic learning function through retraining,

[0797] A system that includes this.

[0798] (Claim 2)

[0799] The system according to claim 1, wherein the automatic learning function enables immediate analysis.

[0800] (Claim 3)

[0801] The system according to claim 1, further comprising means for periodically retraining the automatic learning function using new information.

[0802] "Application Example 1"

[0803] (Claim 1)

[0804] A means for receiving information acquired from a data collection device,

[0805] A means for preprocessing received information and converting information in different formats into a unified format,

[0806] A means for detecting anomalies based on machine learning techniques using preprocessed information,

[0807] A means of notifying users of warnings based on anomaly detection,

[0808] A means of proposing countermeasures for abnormalities,

[0809] A means of checking past warning history on a terminal device,

[0810] A system that includes this.

[0811] (Claim 2)

[0812] The system according to claim 1, wherein the machine learning method enables immediate analysis.

[0813] (Claim 3)

[0814] The system according to claim 1, further comprising means for periodically retraining the machine learning method using new information, and means for checking the training progress from a terminal device.

[0815] "Example 2 of combining an emotion engine"

[0816] (Claim 1)

[0817] A means for receiving information acquired from a data collection means,

[0818] A means for preprocessing received information and converting information of a different format into a standard format,

[0819] A means for analyzing pre-processed information and recognizing anomalies based on a machine learning model,

[0820] A means of evaluating the psychological state of a user using an emotion analysis device,

[0821] A means of notifying a warning based on anomaly recognition and the user's psychological state,

[0822] A means of proposing countermeasures for abnormalities and adjusting those countermeasures while considering the user's psychological state,

[0823] A system that includes this.

[0824] (Claim 2)

[0825] The system according to claim 1, wherein the machine learning model enables immediate analysis and generates dynamic output based on the user's psychological state.

[0826] (Claim 3)

[0827] The system according to claim 1, further comprising means for periodically retraining the machine learning model using new information to reflect changes in the user's psychological state.

[0828] "Application example 2 when combining with an emotional engine"

[0829] (Claim 1)

[0830] A means for receiving information acquired from a data collection means,

[0831] A means for preprocessing received information and converting different types of information into a unified format,

[0832] A means for detecting anomalies using machine learning techniques based on preprocessed information,

[0833] A means of notifying the operator based on the detection of an anomaly,

[0834] A means of proposing countermeasures for abnormalities,

[0835] A means for evaluating the operator's emotional state and optimizing notification content and response measures,

[0836] A system that includes this.

[0837] (Claim 2)

[0838] The system according to claim 1, using a machine learning method that enables real-time analysis.

[0839] (Claim 3)

[0840] The system according to claim 1, further comprising means for periodically retraining a machine learning method using new data. [Explanation of symbols]

[0841] 10, 210, 310, 410 Data Processing Systems 12 Data Processing Devices 14 Smart Devices 214 Smart Glasses 314 Headset-type terminal 414 Robots< / url:> < / url:> < / url:> < / url:>

Claims

1. A means for receiving data acquired from a data collection device, A means for preprocessing received data and converting data of different formats into a unified format, A means for detecting anomalies based on a machine learning algorithm using preprocessed data, A means of notifying users of alerts based on anomaly detection, A means of proposing countermeasures for abnormalities, A system that includes this.

2. The system according to claim 1, wherein the machine learning algorithm enables real-time analysis.

3. The system according to claim 1, further comprising means for periodically retraining the machine learning algorithm using new data.

Images