system

Abstract

We provide the system. [Solution] A means of collecting log data and converting it into a unified format, A method for analyzing collected log data in real time using AI technology to identify error logs, A means to automatically analyze the cause based on identified error logs and generate solutions, A means of automatically detecting security incidents and generating warnings, A means for automatically identifying system performance bottlenecks and generating optimization suggestions, A means of automatically updating the knowledge base with processing results and providing notifications, A system that includes this.

Description

Technical Field

[0001] The technology of the present disclosure relates to a system.

Background Art

[0002] Patent Document 1 discloses a method for controlling a persona chatbot, which is performed by at least one processor, including the steps of receiving a user utterance, adding the user utterance to a prompt including an instruction sentence related to an explanation of the chatbot's character, encoding the prompt, and inputting the encoded prompt into a language model to generate a chatbot utterance that responds to the user utterance.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] In the field of system management in enterprises and organizations, analysis of various log data, identification of error causes, detection of security incidents, and optimization of performance are necessary. However, these tasks take time and often require advanced expertise. In such a situation, there is a need to autonomously perform efficient and rapid problem-solving, security enhancement, and operation optimization without relying on human hands.

Means for Solving the Problems

[0005] This invention provides a comprehensive system utilizing generative AI technology, offering means for collecting and analyzing log data in real time, identifying error logs from the analysis results, automatically analyzing their causes, and generating solutions. Furthermore, the system includes means for automatically detecting security incidents and rapidly generating warnings, as well as means for identifying system performance bottlenecks and proposing optimizations. It also has the functionality to automatically update the analysis results in a knowledge base and notify the team of relevant information in real time, thereby enabling efficient and rapid problem solving and information sharing.

[0006] "Log data" refers to electronic data that includes operational records and status information generated from information systems and applications.

[0007] A "unified format" is a mechanism that improves the efficiency of analysis by converting log data in various formats into a standardized and consistent format.

[0008] "AI technology" is a general term for technologies that give computers the ability to learn from data and solve problems like humans do.

[0009] An "error log" is a portion of log data that indicates abnormal behavior or failures in a system or application.

[0010] A "security incident" is an event that indicates a threat or attack to the confidentiality, integrity, and availability of an information system.

[0011] A "bottleneck" is a factor or obstacle that prevents the overall improvement of a system or process's performance.

[0012] A "knowledge base" is a database or information system where information and knowledge for problem-solving are accumulated and managed.

[0013] "Real-time" refers to the immediacy with which data processing and analysis are performed, almost simultaneously with the occurrence of the data. [Brief explanation of the drawing]

[0014] [Figure 1] This is a conceptual diagram showing an example of the configuration of a data processing system according to the first embodiment. [Figure 2] This is a conceptual diagram showing an example of the essential functions of a data processing device and a smart device according to the first embodiment. [Figure 3] This is a conceptual diagram showing an example of the configuration of a data processing system according to the second embodiment. [Figure 4] This is a conceptual diagram showing an example of the main functions of a data processing device and smart glasses according to the second embodiment. [Figure 5] This is a conceptual diagram showing an example of the configuration of a data processing system according to the third embodiment. [Figure 6] This is a conceptual diagram showing an example of the main functions of a data processing device and a headset-type terminal according to the third embodiment. [Figure 7] This is a conceptual diagram showing an example of the configuration of a data processing system according to the fourth embodiment. [Figure 8] This is a conceptual diagram showing an example of the main functions of a data processing device and a robot according to the fourth embodiment. [Figure 9] This shows an emotion map where multiple emotions are mapped. [Figure 10] This shows an emotion map where multiple emotions are mapped. [Figure 11] This is a sequence diagram showing the processing flow of the data processing system in Example 1. [Figure 12] This is a sequence diagram showing the processing flow of the data processing system in Application Example 1. [Figure 13] This is a sequence diagram showing the processing flow of the data processing system in Example 2, which incorporates an emotion engine. [Figure 14] This is a sequence diagram showing the processing flow of the data processing system in Application Example 2, which combines an emotion engine. [Modes for carrying out the invention]

[0015] Hereinafter, an example of an embodiment of a system according to the technology of the present disclosure will be described with reference to the accompanying drawings.

[0016] First, the terms used in the following description will be explained.

[0017] In the following embodiments, a signed processor (hereinafter simply referred to as "processor") may be a single arithmetic unit or a combination of multiple arithmetic units. Also, the processor may be a single type of arithmetic unit or a combination of multiple types of arithmetic units. Examples of arithmetic units include a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), a GPGPU (General-Purpose computing on Graphics Processing Units), an APU (Accelerated Processing Unit), and the like.

[0018] In the following embodiments, a signed RAM (Random Access Memory) is a memory in which information is temporarily stored and is used as a work memory by the processor.

[0019] In the following embodiments, a signed storage is one or more non-volatile storage devices that store various programs and various parameters, etc. Examples of non-volatile storage devices include flash memory (SSD (Solid State Drive)), magnetic disks (e.g., hard disks), or magnetic tapes, etc.

[0020] In the following embodiments, the signed communication interface (I / F) is an interface that includes a communication processor and an antenna, etc. The communication interface manages communication between multiple computers. Examples of communication standards applicable to the communication interface include wireless communication standards such as 5G (5th Generation Mobile Communication System), Wi-Fi (registered trademark), or Bluetooth (registered trademark).

[0021] In the following embodiments, "A and / or B" is synonymous with "at least one of A and B." That is, "A and / or B" means that it may be A alone, or B alone, or a combination of A and B. Furthermore, in this specification, the same concept as "A and / or B" applies when expressing three or more things linked by "and / or."

[0022] [First Embodiment]

[0023] Figure 1 shows an example of the configuration of the data processing system 10 according to the first embodiment.

[0024] As shown in Figure 1, the data processing system 10 includes a data processing device 12 and a smart device 14. An example of the data processing device 12 is a server.

[0025] The data processing device 12 comprises a computer 22, a database 24, and a communication interface 26. The computer 22 is an example of a "computer" related to the technology of this disclosure. The computer 22 comprises a processor 28, RAM 30, and storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication interface 26 are also connected to the bus 34. The communication interface 26 is connected to a network 54. An example of the network 54 is a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0026] The smart device 14 comprises a computer 36, a reception device 38, an output device 40, a camera 42, and a communication interface 44. The computer 36 comprises a processor 46, RAM 48, and storage 50. The processor 46, RAM 48, and storage 50 are connected to a bus 52. The reception device 38, output device 40, and camera 42 are also connected to the bus 52.

[0027] The reception device 38 is equipped with a touch panel 38A and a microphone 38B, etc., and receives user input. The touch panel 38A receives user input by detecting contact with an object (e.g., a pen or finger). The microphone 38B receives user input by detecting the user's voice. The control unit 46A transmits data indicating the user input received by the touch panel 38A and microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the data indicating the user input.

[0028] The output device 40 includes a display 40A and a speaker 40B, and presents data to the user 20 by outputting the data in a form perceptible to the user 20 (e.g., audio and / or text). The display 40A displays visible information such as text and images according to instructions from the processor 46. The speaker 40B outputs audio according to instructions from the processor 46. The camera 42 is a small digital camera equipped with an optical system such as a lens, aperture, and shutter, and an image sensor such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor.

[0029] Communication interface 44 is connected to network 54. Communication interfaces 44 and 26 are responsible for the exchange of various types of information between processor 46 and processor 28 via network 54.

[0030] Figure 2 shows an example of the main functions of the data processing device 12 and the smart device 14.

[0031] As shown in Figure 2, in the data processing device 12, a specific processing is performed by the processor 28. A specific processing program 56 is stored in the storage 32. The specific processing program 56 is an example of a "program" related to the technology of this disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 according to the specific processing program 56 executed on the RAM 30.

[0032] The storage 32 stores the data generation model 58 and the emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0033] In the smart device 14, the processor 46 performs the reception output processing. The storage 50 stores the reception output program 60. The reception output program 60 is used in conjunction with a specific processing program 56 by the data processing system 10. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output processing is realized by the processor 46 operating as a control unit 46A according to the reception output program 60 executed on the RAM 48.

[0034] Next, the specific processing performed by the specific processing unit 290 of the data processing device 12 will be described. In the following description, the data processing device 12 will be referred to as the "server" and the smart device 14 as the "terminal".

[0035] This invention relates to the realization of a system that collects log data from diverse data sources and analyzes it in real time using AI technology. This system has functions to identify error logs and analyze their causes, as well as functions to quickly detect security incidents and generate warnings. Furthermore, it is possible to identify bottlenecks to optimize system performance and provide appropriate improvement suggestions.

[0036] The server first collects log data from various endpoints, including networks, hardware devices, and software applications. Since this log data often has different formats, the server converts the collected data into a unified format. Next, the server uses AI technology to analyze this converted data, initiating a process of classifying and identifying error logs.

[0037] System administrators and DevOps engineers, acting as users, can leverage analysis results provided by the server to quickly identify and resolve problems. For example, if a terminal crashes while using a specific application, the server analyzes the logs related to the crash and identifies the root cause: insufficient resources. Based on this information, the server then suggests an appropriate reallocation of memory, helping to resolve the problem.

[0038] Furthermore, the servers are also used to detect security incidents. They can immediately identify behaviors that raise security concerns, such as unusual login attempts or an increase in suspicious packets, and warn users. In this way, they play a role in protecting the system from potential security threats.

[0039] All analysis results are automatically added to the knowledge base, allowing users to access it and learn from and improve their strategies for dealing with past problems. This automatic update and notification feature enables efficient information sharing across the entire team, improving overall operational efficiency.

[0040] By utilizing this invention, it becomes possible to quickly identify and resolve error logs, thereby improving the stability and efficiency of the IT infrastructure of companies and organizations through enhanced security measures and optimized system performance.

[0041] The following describes the processing flow.

[0042] Step 1:

[0043] The server initiates the process of acquiring log data from each endpoint within the system. This log data contains a variety of information, including application events, system errors, and network traffic. The server efficiently aggregates this data using separate collection scripts or APIs for each of these data sources.

[0044] Step 2:

[0045] The server converts the acquired log data into a unified, parseable format. This process utilizes regular expressions and data mining techniques to standardize different log formats. Format conversion makes it easier for the analysis engine to process the data.

[0046] Step 3:

[0047] The server uses AI technology to analyze the converted log data. During this analysis phase, natural language processing techniques are used to extract error logs, understand their content, and classify them. The server also consults a knowledge base to see if similar problems have occurred in the past.

[0048] Step 4:

[0049] The server automatically analyzes the cause of error logs and generates possible solutions. In this process, the AI ​​refers to past cases and best practices to make suggestions to the system administrator. For example, if a particular error log is determined to be due to CPU overload, solutions such as adjusting process priorities will be suggested.

[0050] Step 5:

[0051] The server monitors security incidents in real time and immediately identifies anomalous patterns. This monitoring uses anomaly detection algorithms to learn normal operation and identify behaviors that deviate from it. When suspicious activity is detected, the server sends an alert to the security team.

[0052] Step 6:

[0053] The server analyzes system-wide performance data to identify bottlenecks. This process identifies delays in API calls and abnormal resource consumption, and analyzes their causes. Based on the results, the server makes suggestions for improvements, such as process optimization and resource reallocation.

[0054] Step 7:

[0055] The server automatically registers all analysis results in the knowledge base and notifies relevant team members in real time. System administrators, acting as users, can then build future countermeasures based on the newly generated knowledge, enabling rapid responses across the entire team.

[0056] (Example 1)

[0057] Next, we will describe Example 1. In the following description, the data processing device 12 will be referred to as the "server," and the smart device 14 will be referred to as the "terminal."

[0058] This invention aims to provide a method for quickly and automatically identifying errors and security incidents occurring in a system by collecting and analyzing log data obtained from diverse sources. Furthermore, it enables the identification of system performance bottlenecks and the provision of practical suggestions for optimization. Conventional methods require manual analysis and response, which is time-consuming and labor-intensive; this invention aims to solve this problem.

[0059] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 1 is realized by the following means.

[0060] In this invention, the server includes means for collecting information and converting it into a unified format, means for processing it immediately using advanced analysis techniques and extracting error information, and means for automatically analyzing the cause based on the extracted error information and providing a solution. This enables efficient management of diverse log data and rapid problem identification and solution provision.

[0061] "Means of collecting information and converting it into a unified format" refers to technologies or devices for acquiring data from multiple different sources and converting them into an analyzable format.

[0062] "Means of processing data immediately using advanced analytical techniques and extracting error information" refers to algorithms and models that analyze collected data in real time and detect errors and anomalies.

[0063] "A means of automatically analyzing the cause based on extracted error information and providing a solution" refers to a technology or process that analyzes the cause behind an error and proposes actions to correct it.

[0064] "Means for automatically detecting protection-related events and generating warnings" refers to technologies that have the function of detecting unauthorized access or suspicious activity within a system and issuing immediate warnings.

[0065] "Means for automatically identifying computing resource constraints and providing improvement suggestions" refers to technologies or tools that detect system performance failures and provide specific suggestions for improvement.

[0066] "A means of automatically updating and notifying a collection of knowledge" refers to a technology that adds newly acquired knowledge to a database or knowledge base and notifies relevant parties of this information.

[0067] This invention provides a method for collecting log data in real time from various data sources through a server-based system, converting it into a unified format, and analyzing it. This system consists of a server, terminals, and users.

[0068] The server collects log data from various endpoints, including network devices, hardware components, and software applications, via sensors and agents. Since this data often comes in different formats, the server automatically converts it into a unified, parseable format.

[0069] The server also utilizes advanced analytical techniques, particularly generative AI models, to analyze the transformed data in real time. This analysis identifies error logs, detects anomalies, and automatically generates root cause analysis and suggested solutions based on these findings. For example, if an application frequently crashes due to insufficient memory, the server analyzes the crash logs and suggests an optimal memory reallocation.

[0070] This system can also be applied to security, allowing servers to detect unusual login attempts and suspicious network traffic, and issue immediate warnings. This enables a rapid response to potential threats.

[0071] All analysis results and improvement suggestions are automatically added to the knowledge base by the server and notified to the user. Based on this information, the user can learn from solutions to past problems and apply them to future actions.

[0072] For example, if a system administrator notices that an application is slow on a particular terminal, the server can analyze the terminal's log data to identify sudden spikes in CPU usage or disk I / O bottlenecks. Based on this information, the server can suggest workload distribution or process adjustments.

[0073] As an example of a prompt, inputting a message in the format of "Identify the cause of the application crash on a specific device and suggest a solution" into the AI ​​model allows you to obtain analysis results and improvement suggestions. This enables users to efficiently identify and resolve problems, improving the overall reliability and efficiency of the system.

[0074] The flow of the specific processing in Example 1 will be explained using Figure 11.

[0075] Step 1:

[0076] The server collects log data from network devices, hardware, and software applications. To do this, the server deploys agents or sensors and configures them to periodically send log information to the server. The input is raw log data from each endpoint, and the output is raw log data aggregated on the server. This data includes system calls, network traffic, and other similar information.

[0077] Step 2:

[0078] Because the collected log data is in different formats, the server uses a data parser to convert them to a unified format. The input is log data in different formats, and the output is log data in a unified format suitable for analysis. At this stage, the data parser performs syntactic analysis and maps the necessary information to a standard template.

[0079] Step 3:

[0080] The server uses an AI model to analyze log data converted to a unified format in real time. The input is log data in a unified format, and the output is identified error logs and abnormal events. The AI ​​model compares these with past log patterns to find regularities and detect abnormal behavior. Specifically, it extracts the frequency of error messages and behavioral patterns that pose a high security risk.

[0081] Step 4:

[0082] The server analyzes the causes of extracted errors so that users can receive the analysis results and take quick action based on the error logs. The input is the data from the error logs, and the output is the root cause analysis and solutions based on that data. This analysis provides automatically generated suggestions based on resource usage and similar past events. For example, if high CPU load is identified as a problem, it will suggest how to reallocate resources to address it.

[0083] Step 5:

[0084] The server monitors security incidents and operates a function to automatically detect anomalies. Inputs include network traffic and login attempt data, while outputs are warning messages based on anomaly detection. Here, the server compares abnormal access patterns and malicious behavior to a baseline and can immediately notify the user.

[0085] Step 6:

[0086] The server adds the analysis results and generated improvement suggestions to the knowledge base. The input is the data of the analysis results and improvement suggestions, and the output is the updated knowledge base. In this step, newly discovered knowledge is automatically and periodically recorded in the database, and the user is notified as needed. An example of a prompt message would be to ask the AI, "What are the most frequent error logs that occurred this week?", and then take follow-up actions based on the knowledge base.

[0087] (Application Example 1)

[0088] Next, we will explain Application Example 1. In the following explanation, the data processing device 12 will be referred to as the "server," and the smart device 14 will be referred to as the "terminal."

[0089] In today's information technology environment, rapidly identifying and responding to failures and security incidents in data centers is challenging. Vast amounts of log data are generated in diverse formats, requiring immediate extraction of meaningful information and appropriate responses. However, traditional methods struggle with real-time analysis and efficient notification. Furthermore, technologies are needed to ensure proper management even when operations managers are away from the site.

[0090] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 1 is realized by the following means.

[0091] In this invention, the server includes means for acquiring log data and converting it to a standard format, means for immediately analyzing the acquired log data using machine learning technology to identify fault logs, and means for the operations manager to receive the analysis results from a mobile device via a user interface. This enables the operations manager to identify data center failures and security incidents in real time, even from a remote location, and to respond quickly.

[0092] "Log data" refers to records of activity generated by computer systems and network devices.

[0093] A "standard format" is a format used to unify different data formats and bring them together according to a common standard.

[0094] "Machine learning techniques" are algorithms and methods that allow computers to learn patterns from data and perform predictions and classifications.

[0095] A "failure log" is a log that records information about errors and malfunctions that occur in a system or application.

[0096] An "information security incident" is an activity or situation that could potentially affect the security of a system or network.

[0097] A "warning" is a notification or message that indicates a system malfunction.

[0098] The "system efficiency limit" is an indicator that shows the limit of the load at which a system's performance or throughput begins to decline.

[0099] An "improvement suggestion" is a specific measure to optimize the operation of the current system and improve its performance.

[0100] A "knowledge base" is a collection of data that accumulates and makes accessible past cases and solutions.

[0101] A "user interface" is a means or screen through which a user interacts with a system and inputs or receives information.

[0102] An "operations manager" is a person responsible for monitoring, maintaining, and troubleshooting systems and networks.

[0103] A "personal digital assistant" (PDA) is a portable device equipped with communication capabilities, such as a smartphone or tablet.

[0104] As an embodiment of this invention, a system for streamlining the management of log data within a data center is described. This system is based on the premise that multiple servers operate in cooperation. The servers acquire log data from various terminals and devices within the network, convert it to a standard format, and store it. Log data is important for accurate and rapid identification of failures and events.

[0105] The acquired data is analyzed in real time using machine learning technology. For example, AI platforms such as TENSORFLOW® and SageMaker are used to perform pattern recognition and anomaly detection on the data. This allows the server to identify failure logs and information security incidents and immediately notify the operations manager. Notifications are made using mobile devices such as smartphones and tablets, enabling rapid responses tailored to business needs.

[0106] Furthermore, it identifies the limits of system efficiency and generates improvement suggestions to optimize performance. These suggested improvements are stored in a knowledge base, allowing operations managers to make optimal decisions based on this knowledge. Throughout this entire process, the security and efficiency of the data center can be improved.

[0107] A concrete example is log analysis to maintain the performance of a website experiencing a surge in traffic during an event. This allows for rapid adjustment of resource allocation within the data center and ensures service quality. An example of a prompt would be, "Analyze the following log dataset to identify errors and generate improvement suggestions: <log data>".

[0108] In this way, the system aims to achieve efficient and reliable operation and significantly improve data center management.

[0109] The flow of a specific process in Application Example 1 will be explained using Figure 12.

[0110] Step 1:

[0111] The server acquires log data from various terminals and devices within the network. The input is log data transmitted from each endpoint, and the output is log data converted to a standard format. The server first unifies this log data into a standard format, enabling efficient data analysis in subsequent processing steps.

[0112] Step 2:

[0113] The server analyzes standardized log data in real time using machine learning techniques. The input is log data in a unified format obtained in the previous step, and the output is detected failure logs and information security events. The server uses AI platforms such as TensorFlow to extract anomalous data patterns and specific events.

[0114] Step 3:

[0115] The server identifies fault logs and suspicious security incidents based on the analysis results and notifies the system administrator. The input is the log data where anomalies were detected, and the output is a warning message to the system administrator. This allows administrators to understand problems in real time via their mobile devices.

[0116] Step 4:

[0117] The server identifies the limits of system efficiency and generates improvement suggestions to optimize performance. The input is system performance metrics derived from log data, and the output is improvement suggestions. Users can access the knowledge base to tune performance based on these suggestions.

[0118] Step 5:

[0119] Users implement the proposed improvements using their mobile devices to optimize the system. The input is the improvements provided by the server, and the output is the stable system operation status after the adjustments. Optimization is carried out manually or automatically according to specific operating instructions to maintain the stable operation of the data center.

[0120] Furthermore, an emotion engine that estimates the user's emotions may be incorporated. That is, the identification processing unit 290 may use the emotion identification model 59 to estimate the user's emotions and perform identification processing using the user's emotions.

[0121] This invention is a log analysis system incorporating an emotion engine that recognizes user emotions. In addition to conventional log data analysis and system optimization functions, it aims to improve the user experience. This system has the ability to monitor each user's interaction and identify their emotional state at that time.

[0122] The server first collects log data as before and converts it into a unified format. After conversion, it uses AI technology to perform real-time analysis, identifying error logs and automatically analyzing their causes. In parallel, the emotion engine monitors user actions and inputs, and estimates emotions from voice, text, and behavior. This function is achieved by combining natural language processing algorithms and emotion recognition models.

[0123] When the user's emotional state is recognized, the server uses that information to optimize the analysis results and system interface. For example, if a user is experiencing stress during operation, the server will provide simpler instructions and support information tailored to that user. The emotion engine aims to mitigate unpleasant experiences and recommend actions to increase user satisfaction.

[0124] Notifications and warnings displayed on the device are also adjusted to the user's emotions. For example, if a security incident warning is deemed likely to cause anxiety to the user, the server replaces it with a notification that clearly explains the corrective actions.

[0125] The recognized emotional information, along with the analysis results, is recorded in the knowledge base and used for future system improvements. This data functions as feedback information to enhance the overall user experience.

[0126] As a concrete example, consider a scenario where a user begins using a new software feature, and the device uses an emotion engine to detect the user's anxiety. In this case, the server provides an appropriate tutorial and offers support to alleviate the user's questions and anxieties. In this way, sophisticated interaction that takes the user's emotions into account is achieved.

[0127] This invention enables log analysis systems to go beyond the conventional scope of problem-solving and provide services that even extend to the comfort of the end user.

[0128] The following describes the processing flow.

[0129] Step 1:

[0130] The server collects log data from across the entire system. This stage includes a wide range of information, such as application events, system errors, and network data. The server then integrates this data and converts it into a parseable format.

[0131] Step 2:

[0132] The terminal monitors how the user interacts with the system in real time. This includes tracking entered text, click patterns, mouse movements, and voice commands. The terminal sends this data to an emotion engine to estimate the user's emotional state.

[0133] Step 3:

[0134] The server uses AI technology to analyze collected log data. The analysis process identifies error logs, analyzes their associated causes, and automatically generates possible solutions. Security incidents detected during the analysis are immediately alerted.

[0135] Step 4:

[0136] The emotion engine recognizes the user's emotions in real time and sends that information to the server. This information is used to improve the user experience. For example, if a user expresses dissatisfaction, the server provides flexible responses and support to alleviate the situation.

[0137] Step 5:

[0138] The server dynamically adjusts the system interface and notification content based on the recognized user's emotions. For example, if a warning message is expected to be stressful for the user, the explanation will be simplified and reassuring language will be used.

[0139] Step 6:

[0140] The server automatically records analysis results and sentiment data in a knowledge base. This record accumulates past incidents and user reactions, which can be referenced for future improvements. User feedback is also integrated, enabling continuous system improvement.

[0141] Step 7:

[0142] Users receive analysis results and personalized notifications from the system, allowing them to respond quickly and appropriately. As a result, the quality of the user experience is significantly improved, and the overall efficiency of the system is also enhanced.

[0143] (Example 2)

[0144] Next, we will describe Example 2. In the following description, the data processing device 12 will be referred to as the "server" and the smart device 14 as the "terminal".

[0145] In modern information systems, rapid analysis of log data and identification of error logs are crucial. However, conventional technologies required considerable time to analyze the root cause of error logs, making it difficult to quickly provide solutions. Furthermore, it was difficult to provide support that considered the user's emotions during operation and to optimize the system, making improving the user experience a challenge.

[0146] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 2 is realized by the following means.

[0147] In this invention, the server includes means for collecting log data and converting it into a unified format, means for analyzing the collected log data in real time using AI technology to identify error logs, and means for identifying the emotional state using user input data. This enables rapid analysis of error logs and automatic analysis of their causes, as well as real-time identification of the user's emotions and optimization of the system interface based on these emotions.

[0148] "Log data" refers to a series of data generated or acquired by the system, such as user operation history and system error messages.

[0149] A "unified format" refers to a method or result of converting multiple different data formats into a consistent format.

[0150] "AI technology" refers to technologies that use artificial intelligence to perform data analysis and pattern recognition.

[0151] An "error log" is data that records errors and anomalies that occur within a system.

[0152] "Cause analysis" is the process of automatically identifying and analyzing the factors that cause identified problems or errors.

[0153] A "solution" refers to the means or methods used to correct or improve an identified problem.

[0154] A "security incident" refers to an event or occurrence that threatens the security of a system.

[0155] A "bottleneck" is a factor that hinders the performance or flow of a system.

[0156] A "knowledge base" is a collection of information that serves as a standard for future decision-making, accumulating analytical results and important data.

[0157] "Emotional state" refers to the psychological state or emotions of the user while they are using the service.

[0158] "Optimization" is the process of improving a system or process to make it more efficient or user-friendly.

[0159] "Natural language processing technology" is a technology that enables computers to understand and process human language.

[0160] This system aims to improve the user experience by recognizing user emotions in real time using user interaction data. The server first collects a wide range of log data and converts it into a unified format. Common data format conversion tools are used for this process. Furthermore, the server uses AI technology to perform real-time log analysis, enabling rapid identification of error logs. For this purpose, open-source tools known as machine learning libraries are utilized.

[0161] Furthermore, the server processes input data obtained from the user's terminal and runs an emotion engine for emotion recognition. This emotion engine combines natural language processing techniques and emotion recognition models to identify the user's emotional state. For this reason, algorithms specialized in natural language processing are used.

[0162] The terminal plays a role in providing personalized support information and visual interfaces to each user based on analytical and emotional information sent from the server. For example, if a user may show anxiety when using a new feature, the server detects that emotion and provides a tutorial appropriate for the user. Another feature is that notifications and warnings are appropriately adjusted according to the user's emotions.

[0163] This system can be continuously improved based on feedback obtained from past data and user interactions. An example of a prompt might be, "Design an AI model that can detect when a user is likely to show anxiety when trying out a new feature and suggest support information to provide."

[0164] In this way, dynamic information exchange can be performed between the server, terminal, and user, maximizing the user experience.

[0165] The flow of the specific processing in Example 2 will be explained using Figure 13.

[0166] Step 1:

[0167] The server collects log data based on user actions from terminals or sensor devices. The input consists of raw operation history and system error messages. This data is then converted to a unified format using a data format conversion tool. The output is the log data converted into a parseable format.

[0168] Step 2:

[0169] The server uses log data converted into a unified format and employs AI technology to perform real-time analysis. The input is the log data converted in Step 1. A machine learning library is used to identify error logs and analyze their causes. The output is the identified error logs and their corresponding cause information.

[0170] Step 3:

[0171] The server uses user voice, text, and operation logs obtained from the terminal as input data to operate the emotion engine. Specifically, it uses a natural language processing algorithm and an emotion recognition model to estimate the user's emotional state. The output is information about the user's emotional state.

[0172] Step 4:

[0173] Based on the analysis results and sentiment information, the server optimizes the system interface and operating instructions to match the user's emotions. The input is information from steps 2 and 3. The output is the user-optimized interface and support information. Specifically, if the user expresses anxiety, the server provides a detailed tutorial.

[0174] Step 5:

[0175] The device adjusts notifications and warnings to match the user's emotions based on optimization information provided by the server. The input is the instruction information from step 4. The output is notification and warning messages that respond immediately to the user's emotions. Specifically, it replaces warning content that might cause anxiety in the user with simpler and easier-to-understand content.

[0176] Step 6:

[0177] The server records the final analysis results and sentiment information in a knowledge base. The input is the combined information obtained from each processing step. The output is feedback data that can be used for future system improvements. Specifically, it is accumulated as a data set based on past experience, supporting continuous system improvement.

[0178] (Application Example 2)

[0179] Next, we will explain application example 2. In the following explanation, the data processing device 12 will be referred to as the "server," and the smart device 14 will be referred to as the "terminal."

[0180] In modern information processing systems, technical optimization through the analysis of log information is required, but there are limitations to adjusting the interface to reflect user emotions or making suggestions to reduce user psychological stress. As a result, overall end-user satisfaction may decrease, and this needs to be addressed.

[0181] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means.

[0182] In this invention, the server includes means for converting log information into a unified structure, means for identifying error information using machine learning techniques, and means for identifying the user's emotional state and adjusting the interface. This enables dynamic adjustment of the interface according to the user's emotions and optimization to alleviate psychological stress.

[0183] "Log information" refers to data that records the activity history of a system or application.

[0184] "Means of converting to a unified structure" refers to the process of consolidating log information recorded in different formats into a consistent format.

[0185] "Machine learning technology" is a field of artificial intelligence that learns patterns and rules from data to perform predictions and classifications.

[0186] "Error information" refers to data that details malfunctions or problems that have occurred in a system or application.

[0187] "Means for identifying a user's emotional state" refers to technologies for estimating a user's current emotions from their facial expressions, voice, text, etc.

[0188] "Means of adjusting the interface" refers to functions that dynamically change the user's operating screen and the way information is provided.

[0189] "Optimization to alleviate psychological stress" refers to improvements that reduce user stress by adjusting the system according to the user's emotional state.

[0190] To implement this invention, it is necessary to build a system that recognizes the user's emotions in real time and dynamically adjusts the interface based on those emotions. Specifically, a home assistant robot will be equipped with an emotion recognition engine, and the user's emotional state will be analyzed by collecting the user's voice and video data. This will involve using hardware such as a voice recognition microphone and camera, as well as an emotion recognition algorithm using TensorFlow.

[0191] The server first converts log information into a unified structure and uses machine learning techniques to identify error information. Then, it identifies the user's emotional state and optimizes the interface to alleviate psychological stress. By utilizing natural language processing technology, it estimates user emotions from voice and text data, enabling dynamic responses as needed.

[0192] For example, if an assistant robot detects stress while a family member is getting ready in the morning, it can play relaxing music to facilitate conversation. This can make the home environment more comfortable. Furthermore, the system's response can be further improved by generating prompts for the AI ​​model, such as "What kind of support should be provided if the user is feeling anxious?"

[0193] The flow of a specific process in Application Example 2 will be explained using Figure 14.

[0194] Step 1:

[0195] The server collects user voice input and video data from sensing devices (microphones and cameras). The input consists of audio signals and image data, which are converted into digital format and passed on to the next processing step.

[0196] Step 2:

[0197] The server inputs collected audio and video data into a machine learning model, combining natural language processing and facial recognition techniques to estimate the user's emotional state. It analyzes the voice tone and facial expressions as input and obtains emotional labels such as joy, sadness, anger, and surprise as output.

[0198] Step 3:

[0199] The server determines whether the user interface needs adjustment based on the emotion labels obtained. In this step, if the emotion labels indicate stress or anxiety, it generates data to instruct the interface to make specification changes.

[0200] Step 4:

[0201] The terminal, upon receiving instructions from the server, dynamically adjusts the user interface to reflect the user's emotions. Specifically, it changes the color tone on the screen, reconfigures button placement, and provides support information, and the output is the adjusted user interface.

[0202] Step 5:

[0203] When a user begins interacting with a new interface, the device again collects the results as log information. This log includes the user's operation history and responses, and is sent to the server for optimization in the future.

[0204] Step 6:

[0205] The server stores newly obtained log information in a knowledge base and uses it to improve the system and enhance the user experience in the future. In this process, important patterns and trends are extracted, and based on this, subsequent actions are further refined.

[0206] The specific processing unit 290 transmits the result of the specific processing to the smart device 14. In the smart device 14, the control unit 46A causes the output device 40 to output the result of the specific processing. The microphone 38B acquires audio indicating user input for the result of the specific processing. The control unit 46A transmits the audio data indicating user input acquired by the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0207] Data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of data generation model 58 is ChatGPT (registered trademark) (Internet search).<URL: https: / / openai.com / blog / chatgpt> ), Gemini (registered trademark) (Internet search) <url: https: gemini.google.com ?hl="ja">Examples of generative AI include the following. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 is input with prompts containing instructions, and with inference data such as audio data representing speech, text data representing text, and image data representing images. The data generation model 58 infers from the input inference data according to the instructions indicated by the prompts, and outputs the inference results in data formats such as audio data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0208] In the above embodiment, an example was given in which specific processing is performed by the data processing device 12, but the technology of this disclosure is not limited thereto, and the specific processing may also be performed by the smart device 14.

[0209] [Second Embodiment]

[0210] Figure 3 shows an example of the configuration of the data processing system 210 according to the second embodiment.

[0211] As shown in Figure 3, the data processing system 210 includes a data processing device 12 and smart glasses 214. An example of the data processing device 12 is a server.

[0212] The data processing device 12 comprises a computer 22, a database 24, and a communication interface 26. The computer 22 is an example of a "computer" related to the technology of this disclosure. The computer 22 comprises a processor 28, RAM 30, and storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication interface 26 are also connected to the bus 34. The communication interface 26 is connected to a network 54. An example of the network 54 is a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0213] The smart glasses 214 include a computer 36, a microphone 238, a speaker 240, a camera 42, and a communication interface 44. The computer 36 includes a processor 46, RAM 48, and storage 50. The processor 46, RAM 48, and storage 50 are connected to a bus 52. The microphone 238, speaker 240, and camera 42 are also connected to the bus 52.

[0214] The microphone 238 receives voice signals from the user 20 and receives instructions from the user 20. The microphone 238 captures the voice signals from the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to the instructions from the processor 46.

[0215] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an image sensor such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the area around the user 20 (for example, an imaging range defined by a field of view equivalent to the width of a typical healthy person's field of vision).

[0216] Communication interface 44 is connected to network 54. Communication interfaces 44 and 26 are responsible for the exchange of various information between processor 46 and processor 28 via network 54. The exchange of various information between processor 46 and processor 28 using communication interfaces 44 and 26 is performed in a secure manner.

[0217] Figure 4 shows an example of the main functions of the data processing device 12 and the smart glasses 214. As shown in Figure 4, the data processing device 12 performs specific processing using the processor 28. The storage 32 stores the specific processing program 56.

[0218] The specific processing program 56 is an example of a "program" relating to the technology of this disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0219] The storage 32 stores the data generation model 58 and the emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0220] In the smart glasses 214, the processor 46 performs the reception output processing. The storage 50 stores the reception output program 60. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output processing is realized by the processor 46 operating as a control unit 46A according to the reception output program 60 executed on the RAM 48.

[0221] Next, the identification processing performed by the identification processing unit 290 of the data processing device 12 will be described. In the following description, the data processing device 12 will be referred to as the "server" and the smart glasses 214 will be referred to as the "terminal".

[0222] This invention relates to the realization of a system that collects log data from diverse data sources and analyzes it in real time using AI technology. This system has functions to identify error logs and analyze their causes, as well as functions to quickly detect security incidents and generate warnings. Furthermore, it is possible to identify bottlenecks to optimize system performance and provide appropriate improvement suggestions.

[0223] The server first collects log data from various endpoints, including networks, hardware devices, and software applications. Since this log data often has different formats, the server converts the collected data into a unified format. Next, the server uses AI technology to analyze this converted data, initiating a process of classifying and identifying error logs.

[0224] System administrators and DevOps engineers, acting as users, can leverage analysis results provided by the server to quickly identify and resolve problems. For example, if a terminal crashes while using a specific application, the server analyzes the logs related to the crash and identifies the root cause: insufficient resources. Based on this information, the server then suggests an appropriate reallocation of memory, helping to resolve the problem.

[0225] Furthermore, the servers are also used to detect security incidents. They can immediately identify behaviors that raise security concerns, such as unusual login attempts or an increase in suspicious packets, and warn users. In this way, they play a role in protecting the system from potential security threats.

[0226] All analysis results are automatically added to the knowledge base, allowing users to access it and learn from and improve their strategies for dealing with past problems. This automatic update and notification feature enables efficient information sharing across the entire team, improving overall operational efficiency.

[0227] By utilizing this invention, it becomes possible to quickly identify and resolve error logs, thereby improving the stability and efficiency of the IT infrastructure of companies and organizations through enhanced security measures and optimized system performance.

[0228] The following describes the processing flow.

[0229] Step 1:

[0230] The server initiates the process of acquiring log data from each endpoint within the system. This log data contains a variety of information, including application events, system errors, and network traffic. The server efficiently aggregates this data using separate collection scripts or APIs for each of these data sources.

[0231] Step 2:

[0232] The server converts the acquired log data into a unified, parseable format. This process utilizes regular expressions and data mining techniques to standardize different log formats. Format conversion makes it easier for the analysis engine to process the data.

[0233] Step 3:

[0234] The server uses AI technology to analyze the converted log data. During this analysis phase, natural language processing techniques are used to extract error logs, understand their content, and classify them. The server also consults a knowledge base to see if similar problems have occurred in the past.

[0235] Step 4:

[0236] The server automatically analyzes the cause of error logs and generates possible solutions. In this process, the AI ​​refers to past cases and best practices to make suggestions to the system administrator. For example, if a particular error log is determined to be due to CPU overload, solutions such as adjusting process priorities will be suggested.

[0237] Step 5:

[0238] The server monitors security incidents in real time and immediately identifies anomalous patterns. This monitoring uses anomaly detection algorithms to learn normal operation and identify behaviors that deviate from it. When suspicious activity is detected, the server sends an alert to the security team.

[0239] Step 6:

[0240] The server analyzes system-wide performance data to identify bottlenecks. This process identifies delays in API calls and abnormal resource consumption, and analyzes their causes. Based on the results, the server makes suggestions for improvements, such as process optimization and resource reallocation.

[0241] Step 7:

[0242] The server automatically registers all analysis results in the knowledge base and notifies relevant team members in real time. System administrators, acting as users, can then build future countermeasures based on the newly generated knowledge, enabling rapid responses across the entire team.

[0243] (Example 1)

[0244] Next, we will describe Example 1. In the following description, the data processing device 12 will be referred to as the "server," and the smart glasses 214 will be referred to as the "terminal."

[0245] This invention aims to provide a method for quickly and automatically identifying errors and security incidents occurring in a system by collecting and analyzing log data obtained from diverse sources. Furthermore, it enables the identification of system performance bottlenecks and the provision of practical suggestions for optimization. Conventional methods require manual analysis and response, which is time-consuming and labor-intensive; this invention aims to solve this problem.

[0246] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 1 is realized by the following means.

[0247] In this invention, the server includes means for collecting information and converting it into a unified format, means for processing it immediately using advanced analysis techniques and extracting error information, and means for automatically analyzing the cause based on the extracted error information and providing a solution. This enables efficient management of diverse log data and rapid problem identification and solution provision.

[0248] "Means of collecting information and converting it into a unified format" refers to technologies or devices for acquiring data from multiple different sources and converting them into an analyzable format.

[0249] "Means of processing data immediately using advanced analytical techniques and extracting error information" refers to algorithms and models that analyze collected data in real time and detect errors and anomalies.

[0250] "A means of automatically analyzing the cause based on extracted error information and providing a solution" refers to a technology or process that analyzes the cause behind an error and proposes actions to correct it.

[0251] "Means for automatically detecting protection-related events and generating warnings" refers to technologies that have the function of detecting unauthorized access or suspicious activity within a system and issuing immediate warnings.

[0252] "Means for automatically identifying computing resource constraints and providing improvement suggestions" refers to technologies or tools that detect system performance failures and provide specific suggestions for improvement.

[0253] "A means of automatically updating and notifying a collection of knowledge" refers to a technology that adds newly acquired knowledge to a database or knowledge base and notifies relevant parties of this information.

[0254] This invention provides a method for collecting log data in real time from various data sources through a server-based system, converting it into a unified format, and analyzing it. This system consists of a server, terminals, and users.

[0255] The server collects log data from various endpoints, including network devices, hardware components, and software applications, via sensors and agents. Since this data often comes in different formats, the server automatically converts it into a unified, parseable format.

[0256] The server also utilizes advanced analytical techniques, particularly generative AI models, to analyze the transformed data in real time. This analysis identifies error logs, detects anomalies, and automatically generates root cause analysis and suggested solutions based on these findings. For example, if an application frequently crashes due to insufficient memory, the server analyzes the crash logs and suggests an optimal memory reallocation.

[0257] This system can also be applied to security, allowing servers to detect unusual login attempts and suspicious network traffic, and issue immediate warnings. This enables a rapid response to potential threats.

[0258] All analysis results and improvement suggestions are automatically added to the knowledge base by the server and notified to the user. Based on this information, the user can learn from solutions to past problems and apply them to future actions.

[0259] For example, if a system administrator notices that an application is slow on a particular terminal, the server can analyze the terminal's log data to identify sudden spikes in CPU usage or disk I / O bottlenecks. Based on this information, the server can suggest workload distribution or process adjustments.

[0260] As an example of a prompt, inputting a message in the format of "Identify the cause of the application crash on a specific device and suggest a solution" into the AI ​​model allows you to obtain analysis results and improvement suggestions. This enables users to efficiently identify and resolve problems, improving the overall reliability and efficiency of the system.

[0261] The flow of the specific processing in Example 1 will be explained using Figure 11.

[0262] Step 1:

[0263] The server collects log data from network devices, hardware, and software applications. To do this, the server deploys agents or sensors and configures them to periodically send log information to the server. The input is raw log data from each endpoint, and the output is raw log data aggregated on the server. This data includes system calls, network traffic, and other similar information.

[0264] Step 2:

[0265] Because the collected log data is in different formats, the server uses a data parser to convert them to a unified format. The input is log data in different formats, and the output is log data in a unified format suitable for analysis. At this stage, the data parser performs syntactic analysis and maps the necessary information to a standard template.

[0266] Step 3:

[0267] The server uses an AI model to analyze log data converted to a unified format in real time. The input is log data in a unified format, and the output is identified error logs and abnormal events. The AI ​​model compares these with past log patterns to find regularities and detect abnormal behavior. Specifically, it extracts the frequency of error messages and behavioral patterns that pose a high security risk.

[0268] Step 4:

[0269] The server analyzes the causes of extracted errors so that users can receive the analysis results and take quick action based on the error logs. The input is the data from the error logs, and the output is the root cause analysis and solutions based on that data. This analysis provides automatically generated suggestions based on resource usage and similar past events. For example, if high CPU load is identified as a problem, it will suggest how to reallocate resources to address it.

[0270] Step 5:

[0271] The server monitors security incidents and operates a function to automatically detect anomalies. Inputs include network traffic and login attempt data, while outputs are warning messages based on anomaly detection. Here, the server compares abnormal access patterns and malicious behavior to a baseline and can immediately notify the user.

[0272] Step 6:

[0273] The server adds the analysis results and generated improvement suggestions to the knowledge base. The input is the data of the analysis results and improvement suggestions, and the output is the updated knowledge base. In this step, newly discovered knowledge is automatically and periodically recorded in the database, and the user is notified as needed. An example of a prompt message would be to ask the AI, "What are the most frequent error logs that occurred this week?", and then take follow-up actions based on the knowledge base.

[0274] (Application Example 1)

[0275] Next, we will explain Application Example 1. In the following explanation, the data processing device 12 will be referred to as the "server," and the smart glasses 214 will be referred to as the "terminal."

[0276] In today's information technology environment, rapidly identifying and responding to failures and security incidents in data centers is challenging. Vast amounts of log data are generated in diverse formats, requiring immediate extraction of meaningful information and appropriate responses. However, traditional methods struggle with real-time analysis and efficient notification. Furthermore, technologies are needed to ensure proper management even when operations managers are away from the site.

[0277] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 1 is realized by the following means.

[0278] In this invention, the server includes means for acquiring log data and converting it to a standard format, means for immediately analyzing the acquired log data using machine learning technology to identify fault logs, and means for the operations manager to receive the analysis results from a mobile device via a user interface. This enables the operations manager to identify data center failures and security incidents in real time, even from a remote location, and to respond quickly.

[0279] "Log data" refers to records of activity generated by computer systems and network devices.

[0280] A "standard format" is a format used to unify different data formats and bring them together according to a common standard.

[0281] "Machine learning techniques" are algorithms and methods that allow computers to learn patterns from data and perform predictions and classifications.

[0282] A "fault log" is a log that records information about errors and malfunctions that occur in a system or application.

[0283] An "information security incident" is an activity or situation that may affect the security of a system or network.

[0284] A "warning" is a notification or message that informs of an abnormality in the system.

[0285] A "system efficiency limit point" is an indicator that shows the limit of the load at which the performance and throughput of a system begin to decline.

[0286] An "improvement proposal" is a specific measure to optimize the operation of the current system and improve performance.

[0287] A "knowledge base" is an accumulation of data that stores past cases and solutions and makes them accessible.

[0288] A "user interface" is a means or screen through which a user interacts with a system and inputs or receives information.

[0289] An "operation manager" is a person in charge of monitoring, maintaining, and resolving problems in a system or network.

[0290] A "portable information terminal" is a device such as a smartphone or tablet that is portable and has a communication function.

[0291] As a form of implementing this invention, a system for efficiently managing log data in a data center will be described. This system is premised on the coordinated operation of multiple servers. The servers acquire log data from various terminals and devices in the network, convert it into a standard format, and store it. Log data is important for accurately and quickly identifying faults and incidents.

[0292] The acquired data is analyzed in real time using machine learning techniques. For example, AI platforms such as TensorFlow and SageMaker are used to perform pattern recognition and anomaly detection on the data. This allows the server to identify failure logs and information security incidents and immediately notify the operations manager. Notifications are made using mobile devices such as smartphones and tablets, enabling rapid responses tailored to business needs.

[0293] Furthermore, it identifies the limits of system efficiency and generates improvement suggestions to optimize performance. These suggested improvements are stored in a knowledge base, allowing operations managers to make optimal decisions based on this knowledge. Throughout this entire process, the security and efficiency of the data center can be improved.

[0294] A concrete example is log analysis to maintain the performance of a website experiencing a surge in traffic during an event. This allows for rapid adjustment of resource allocation within the data center and ensures service quality. An example of a prompt would be, "Analyze the following log dataset to identify errors and generate improvement suggestions: <log data>".

[0295] In this way, the system aims to achieve efficient and reliable operation and significantly improve data center management.

[0296] The flow of a specific process in Application Example 1 will be explained using Figure 12.

[0297] Step 1:

[0298] The server acquires log data from various terminals and devices within the network. The input is log data transmitted from each endpoint, and the output is log data converted to a standard format. The server first unifies this log data into a standard format, enabling efficient data analysis in subsequent processing steps.

[0299] Step 2:

[0300] The server analyzes standardized log data in real time using machine learning techniques. The input is log data in a unified format obtained in the previous step, and the output is detected failure logs and information security events. The server uses AI platforms such as TensorFlow to extract anomalous data patterns and specific events.

[0301] Step 3:

[0302] The server identifies fault logs and suspicious security incidents based on the analysis results and notifies the system administrator. The input is the log data where anomalies were detected, and the output is a warning message to the system administrator. This allows administrators to understand problems in real time via their mobile devices.

[0303] Step 4:

[0304] The server identifies the limits of system efficiency and generates improvement suggestions to optimize performance. The input is system performance metrics derived from log data, and the output is improvement suggestions. Users can access the knowledge base to tune performance based on these suggestions.

[0305] Step 5:

[0306] Users implement the proposed improvements using their mobile devices to optimize the system. The input is the improvements provided by the server, and the output is the stable system operation status after the adjustments. Optimization is carried out manually or automatically according to specific operating instructions to maintain the stable operation of the data center.

[0307] Furthermore, an emotion engine that estimates the user's emotions may be incorporated. That is, the identification processing unit 290 may use the emotion identification model 59 to estimate the user's emotions and perform identification processing using the user's emotions.

[0308] The present invention is a log analysis system incorporating an emotion engine that recognizes the emotions of users, aiming to improve the user experience in addition to the conventional log data analysis and system optimization functions. This system has the ability to monitor the interactions of each user and identify the emotional state at that time.

[0309] First, the server collects log data as in the conventional manner and converts it into a unified format. After conversion, real-time analysis is performed using AI technology to identify error logs and automatically analyze the causes. In parallel with this, the emotion engine monitors the operations and inputs of the users and estimates emotions from voice, text, actions, etc. This function is realized by combining natural language processing algorithms and emotion recognition models.

[0310] When the emotional state of the user is recognized, the server optimizes the analysis results and the system interface based on that information. For example, when a user feels stressed during an operation, the server presents simpler operation instructions and support information for that user. The emotion engine aims to reduce unpleasant experiences and recommends actions to improve user satisfaction.

[0311] Notifications and warnings displayed on the terminal are also adjusted according to the emotions of the user. For example, if it is determined that a security incident warning may cause anxiety to the user, the server replaces it with a notification that clearly explains the countermeasure procedure.

[0312] The recognized emotion information is recorded in the knowledge base together with the analysis results and utilized for future system improvement. This data functions as feedback information for improving the overall experience value of the user.

[0313] As a concrete example, consider a scenario where a user begins using a new software feature, and the device uses an emotion engine to detect the user's anxiety. In this case, the server provides an appropriate tutorial and offers support to alleviate the user's questions and anxieties. In this way, sophisticated interaction that takes the user's emotions into account is achieved.

[0314] This invention enables log analysis systems to go beyond the conventional scope of problem-solving and provide services that even extend to the comfort of the end user.

[0315] The following describes the processing flow.

[0316] Step 1:

[0317] The server collects log data from across the entire system. This stage includes a wide range of information, such as application events, system errors, and network data. The server then integrates this data and converts it into a parseable format.

[0318] Step 2:

[0319] The terminal monitors how the user interacts with the system in real time. This includes tracking entered text, click patterns, mouse movements, and voice commands. The terminal sends this data to an emotion engine to estimate the user's emotional state.

[0320] Step 3:

[0321] The server uses AI technology to analyze collected log data. The analysis process identifies error logs, analyzes their associated causes, and automatically generates possible solutions. Security incidents detected during the analysis are immediately alerted.

[0322] Step 4:

[0323] The emotion engine recognizes the user's emotions in real time and sends that information to the server. This information is used to improve the user experience. For example, if a user expresses dissatisfaction, the server provides flexible responses and support to alleviate the situation.

[0324] Step 5:

[0325] The server dynamically adjusts the system interface and notification content based on the recognized user's emotions. For example, if a warning message is expected to be stressful for the user, the explanation will be simplified and reassuring language will be used.

[0326] Step 6:

[0327] The server automatically records analysis results and sentiment data in a knowledge base. This record accumulates past incidents and user reactions, which can be referenced for future improvements. User feedback is also integrated, enabling continuous system improvement.

[0328] Step 7:

[0329] Users receive analysis results and personalized notifications from the system, allowing them to respond quickly and appropriately. As a result, the quality of the user experience is significantly improved, and the overall efficiency of the system is also enhanced.

[0330] (Example 2)

[0331] Next, we will describe Example 2. In the following description, the data processing device 12 will be referred to as the "server" and the smart glasses 214 will be referred to as the "terminal".

[0332] In modern information systems, rapid analysis of log data and identification of error logs are crucial. However, conventional technologies required considerable time to analyze the root cause of error logs, making it difficult to quickly provide solutions. Furthermore, it was difficult to provide support that considered the user's emotions during operation and to optimize the system, making improving the user experience a challenge.

[0333] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 2 is realized by the following means.

[0334] In this invention, the server includes means for collecting log data and converting it into a unified format, means for analyzing the collected log data in real time using AI technology to identify error logs, and means for identifying the emotional state using user input data. This enables rapid analysis of error logs and automatic analysis of their causes, as well as real-time identification of the user's emotions and optimization of the system interface based on these emotions.

[0335] "Log data" refers to a series of data generated or acquired by the system, such as user operation history and system error messages.

[0336] A "unified format" refers to a method or result of converting multiple different data formats into a consistent format.

[0337] "AI technology" refers to technologies that use artificial intelligence to perform data analysis and pattern recognition.

[0338] An "error log" is data that records errors and anomalies that occur within a system.

[0339] "Cause analysis" is the process of automatically identifying and analyzing the factors that cause identified problems or errors.

[0340] A "solution" refers to the means or methods used to correct or improve an identified problem.

[0341] A "security incident" refers to an event or occurrence that threatens the security of a system.

[0342] A "bottleneck" is a factor that hinders the performance or flow of a system.

[0343] A "knowledge base" is a collection of information that serves as a standard for future decision-making, accumulating analytical results and important data.

[0344] "Emotional state" refers to the psychological state or emotions of the user while they are using the service.

[0345] "Optimization" is the process of improving a system or process to make it more efficient or user-friendly.

[0346] "Natural language processing technology" is a technology that enables computers to understand and process human language.

[0347] This system aims to improve the user experience by recognizing user emotions in real time using user interaction data. The server first collects a wide range of log data and converts it into a unified format. Common data format conversion tools are used for this process. Furthermore, the server uses AI technology to perform real-time log analysis, enabling rapid identification of error logs. For this purpose, open-source tools known as machine learning libraries are utilized.

[0348] Furthermore, the server processes input data obtained from the user's terminal and runs an emotion engine for emotion recognition. This emotion engine combines natural language processing techniques and emotion recognition models to identify the user's emotional state. For this reason, algorithms specialized in natural language processing are used.

[0349] The terminal plays a role in providing personalized support information and visual interfaces to each user based on analytical and emotional information sent from the server. For example, if a user may show anxiety when using a new feature, the server detects that emotion and provides a tutorial appropriate for the user. Another feature is that notifications and warnings are appropriately adjusted according to the user's emotions.

[0350] This system can be continuously improved based on feedback obtained from past data and user interactions. An example of a prompt might be, "Design an AI model that can detect when a user is likely to show anxiety when trying out a new feature and suggest support information to provide."

[0351] In this way, dynamic information exchange can be performed between the server, terminal, and user, maximizing the user experience.

[0352] The flow of the specific processing in Example 2 will be explained using Figure 13.

[0353] Step 1:

[0354] The server collects log data based on user actions from terminals or sensor devices. The input consists of raw operation history and system error messages. This data is then converted to a unified format using a data format conversion tool. The output is the log data converted into a parseable format.

[0355] Step 2:

[0356] The server uses log data converted into a unified format and employs AI technology to perform real-time analysis. The input is the log data converted in Step 1. A machine learning library is used to identify error logs and analyze their causes. The output is the identified error logs and their corresponding cause information.

[0357] Step 3:

[0358] The server uses user voice, text, and operation logs obtained from the terminal as input data to operate the emotion engine. Specifically, it uses a natural language processing algorithm and an emotion recognition model to estimate the user's emotional state. The output is information about the user's emotional state.

[0359] Step 4:

[0360] Based on the analysis results and sentiment information, the server optimizes the system interface and operating instructions to match the user's emotions. The input is information from steps 2 and 3. The output is the user-optimized interface and support information. Specifically, if the user expresses anxiety, the server provides a detailed tutorial.

[0361] Step 5:

[0362] The device adjusts notifications and warnings to match the user's emotions based on optimization information provided by the server. The input is the instruction information from step 4. The output is notification and warning messages that respond immediately to the user's emotions. Specifically, it replaces warning content that might cause anxiety in the user with simpler and easier-to-understand content.

[0363] Step 6:

[0364] The server records the final analysis results and sentiment information in a knowledge base. The input is the combined information obtained from each processing step. The output is feedback data that can be used for future system improvements. Specifically, it is accumulated as a data set based on past experience, supporting continuous system improvement.

[0365] (Application Example 2)

[0366] Next, we will explain application example 2. In the following explanation, the data processing device 12 will be referred to as the "server," and the smart glasses 214 will be referred to as the "terminal."

[0367] In modern information processing systems, technical optimization through the analysis of log information is required, but there are limitations to adjusting the interface to reflect user emotions or making suggestions to reduce user psychological stress. As a result, overall end-user satisfaction may decrease, and this needs to be addressed.

[0368] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means.

[0369] In this invention, the server includes means for converting log information into a unified structure, means for identifying error information using machine learning techniques, and means for identifying the user's emotional state and adjusting the interface. This enables dynamic adjustment of the interface according to the user's emotions and optimization to alleviate psychological stress.

[0370] "Log information" refers to data that records the activity history of a system or application.

[0371] "Means of converting to a unified structure" refers to the process of consolidating log information recorded in different formats into a consistent format.

[0372] "Machine learning technology" is a field of artificial intelligence that learns patterns and rules from data to perform predictions and classifications.

[0373] "Error information" refers to data that details malfunctions or problems that have occurred in a system or application.

[0374] "Means for identifying a user's emotional state" refers to technologies for estimating a user's current emotions from their facial expressions, voice, text, etc.

[0375] "Means of adjusting the interface" refers to functions that dynamically change the user's operating screen and the way information is provided.

[0376] "Optimization to alleviate psychological stress" refers to improvements that reduce user stress by adjusting the system according to the user's emotional state.

[0377] To implement this invention, it is necessary to build a system that recognizes the user's emotions in real time and dynamically adjusts the interface based on those emotions. Specifically, a home assistant robot will be equipped with an emotion recognition engine, and the user's emotional state will be analyzed by collecting the user's voice and video data. This will involve using hardware such as a voice recognition microphone and camera, as well as an emotion recognition algorithm using TensorFlow.

[0378] The server first converts log information into a unified structure and uses machine learning techniques to identify error information. Then, it identifies the user's emotional state and optimizes the interface to alleviate psychological stress. By utilizing natural language processing technology, it estimates user emotions from voice and text data, enabling dynamic responses as needed.

[0379] For example, if an assistant robot detects stress while a family member is getting ready in the morning, it can play relaxing music to facilitate conversation. This can make the home environment more comfortable. Furthermore, the system's response can be further improved by generating prompts for the AI ​​model, such as "What kind of support should be provided if the user is feeling anxious?"

[0380] The flow of a specific process in Application Example 2 will be explained using Figure 14.

[0381] Step 1:

[0382] The server collects user voice input and video data from sensing devices (microphones and cameras). The input consists of audio signals and image data, which are converted into digital format and passed on to the next processing step.

[0383] Step 2:

[0384] The server inputs collected audio and video data into a machine learning model, combining natural language processing and facial recognition techniques to estimate the user's emotional state. It analyzes the voice tone and facial expressions as input and obtains emotional labels such as joy, sadness, anger, and surprise as output.

[0385] Step 3:

[0386] The server determines whether the user interface needs adjustment based on the emotion labels obtained. In this step, if the emotion labels indicate stress or anxiety, it generates data to instruct the interface to make specification changes.

[0387] Step 4:

[0388] The terminal, upon receiving instructions from the server, dynamically adjusts the user interface to reflect the user's emotions. Specifically, it changes the color tone on the screen, reconfigures button placement, and provides support information, and the output is the adjusted user interface.

[0389] Step 5:

[0390] When a user begins interacting with a new interface, the device again collects the results as log information. This log includes the user's operation history and responses, and is sent to the server for optimization in the future.

[0391] Step 6:

[0392] The server stores newly obtained log information in a knowledge base and uses it to improve the system and enhance the user experience in the future. In this process, important patterns and trends are extracted, and based on this, subsequent actions are further refined.

[0393] The specific processing unit 290 transmits the result of the specific processing to the smart glasses 214. In the smart glasses 214, the control unit 46A causes the speaker 240 to output the result of the specific processing. The microphone 238 acquires audio indicating user input for the result of the specific processing. The control unit 46A transmits the audio data indicating user input acquired by the microphone 238 to the data processing unit 12. In the data processing unit 12, the specific processing unit 290 acquires the audio data.

[0394] Data generation model 58 is a type of so-called generative AI (Artificial Intelligence). An example of data generation model 58 is ChatGPT (Internet Search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search) <url: https: gemini.google.com ?hl="ja">Examples of generative AI include the following. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 is input with prompts containing instructions, and with inference data such as audio data representing speech, text data representing text, and image data representing images. The data generation model 58 infers from the input inference data according to the instructions indicated by the prompts, and outputs the inference results in data formats such as audio data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0395] In the above embodiment, an example was given in which specific processing is performed by the data processing device 12, but the technology of this disclosure is not limited thereto, and the specific processing may also be performed by the smart glasses 214.

[0396] [Third Embodiment]

[0397] Figure 5 shows an example of the configuration of the data processing system 310 according to the third embodiment.

[0398] As shown in Figure 5, the data processing system 310 includes a data processing device 12 and a headset terminal 314. An example of the data processing device 12 is a server.

[0399] The data processing device 12 comprises a computer 22, a database 24, and a communication interface 26. The computer 22 is an example of a "computer" related to the technology of this disclosure. The computer 22 comprises a processor 28, RAM 30, and storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication interface 26 are also connected to the bus 34. The communication interface 26 is connected to a network 54. An example of the network 54 is a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0400] The headset terminal 314 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication interface 44, and a display 343. The computer 36 includes a processor 46, RAM 48, and storage 50. The processor 46, RAM 48, and storage 50 are connected to a bus 52. The microphone 238, speaker 240, camera 42, and display 343 are also connected to the bus 52.

[0401] The microphone 238 receives voice signals from the user 20 and receives instructions from the user 20. The microphone 238 captures the voice signals from the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to the instructions from the processor 46.

[0402] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an image sensor such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the area around the user 20 (for example, an imaging range defined by a field of view equivalent to the width of a typical healthy person's field of vision).

[0403] Communication interface 44 is connected to network 54. Communication interfaces 44 and 26 are responsible for the exchange of various information between processor 46 and processor 28 via network 54. The exchange of various information between processor 46 and processor 28 using communication interfaces 44 and 26 is performed in a secure manner.

[0404] Figure 6 shows an example of the main functions of the data processing device 12 and the headset terminal 314. As shown in Figure 6, the data processing device 12 performs specific processing using the processor 28. The storage 32 stores the specific processing program 56.

[0405] The specific processing program 56 is an example of a "program" relating to the technology of this disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0406] The storage 32 stores the data generation model 58 and the emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0407] In the headset terminal 314, the processor 46 performs the reception output processing. The storage 50 stores the reception output program 60. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output processing is realized by the processor 46 operating as a control unit 46A according to the reception output program 60 executed on the RAM 48.

[0408] Next, the specific processing performed by the specific processing unit 290 of the data processing device 12 will be described. In the following description, the data processing device 12 will be referred to as the "server" and the headset terminal 314 will be referred to as the "terminal".

[0409] This invention relates to the realization of a system that collects log data from diverse data sources and analyzes it in real time using AI technology. This system has functions to identify error logs and analyze their causes, as well as functions to quickly detect security incidents and generate warnings. Furthermore, it is possible to identify bottlenecks to optimize system performance and provide appropriate improvement suggestions.

[0410] The server first collects log data from various endpoints, including networks, hardware devices, and software applications. Since this log data often has different formats, the server converts the collected data into a unified format. Next, the server uses AI technology to analyze this converted data, initiating a process of classifying and identifying error logs.

[0411] System administrators and DevOps engineers, acting as users, can leverage analysis results provided by the server to quickly identify and resolve problems. For example, if a terminal crashes while using a specific application, the server analyzes the logs related to the crash and identifies the root cause: insufficient resources. Based on this information, the server then suggests an appropriate reallocation of memory, helping to resolve the problem.

[0412] Furthermore, the servers are also used to detect security incidents. They can immediately identify behaviors that raise security concerns, such as unusual login attempts or an increase in suspicious packets, and warn users. In this way, they play a role in protecting the system from potential security threats.

[0413] All analysis results are automatically added to the knowledge base, allowing users to access it and learn from and improve their strategies for dealing with past problems. This automatic update and notification feature enables efficient information sharing across the entire team, improving overall operational efficiency.

[0414] By utilizing this invention, it becomes possible to quickly identify and resolve error logs, thereby improving the stability and efficiency of the IT infrastructure of companies and organizations through enhanced security measures and optimized system performance.

[0415] The following describes the processing flow.

[0416] Step 1:

[0417] The server initiates the process of acquiring log data from each endpoint within the system. This log data contains a variety of information, including application events, system errors, and network traffic. The server efficiently aggregates this data using separate collection scripts or APIs for each of these data sources.

[0418] Step 2:

[0419] The server converts the acquired log data into a unified, parseable format. This process utilizes regular expressions and data mining techniques to standardize different log formats. Format conversion makes it easier for the analysis engine to process the data.

[0420] Step 3:

[0421] The server uses AI technology to analyze the converted log data. During this analysis phase, natural language processing techniques are used to extract error logs, understand their content, and classify them. The server also consults a knowledge base to see if similar problems have occurred in the past.

[0422] Step 4:

[0423] The server automatically analyzes the cause of error logs and generates possible solutions. In this process, the AI ​​refers to past cases and best practices to make suggestions to the system administrator. For example, if a particular error log is determined to be due to CPU overload, solutions such as adjusting process priorities will be suggested.

[0424] Step 5:

[0425] The server monitors security incidents in real time and immediately identifies anomalous patterns. This monitoring uses anomaly detection algorithms to learn normal operation and identify behaviors that deviate from it. When suspicious activity is detected, the server sends an alert to the security team.

[0426] Step 6:

[0427] The server analyzes system-wide performance data to identify bottlenecks. This process identifies delays in API calls and abnormal resource consumption, and analyzes their causes. Based on the results, the server makes suggestions for improvements, such as process optimization and resource reallocation.

[0428] Step 7:

[0429] The server automatically registers all analysis results in the knowledge base and notifies relevant team members in real time. System administrators, acting as users, can then build future countermeasures based on the newly generated knowledge, enabling rapid responses across the entire team.

[0430] (Example 1)

[0431] Next, we will describe Example 1. In the following description, the data processing device 12 will be referred to as the "server," and the headset-type terminal 314 will be referred to as the "terminal."

[0432] This invention aims to provide a method for quickly and automatically identifying errors and security incidents occurring in a system by collecting and analyzing log data obtained from diverse sources. Furthermore, it enables the identification of system performance bottlenecks and the provision of practical suggestions for optimization. Conventional methods require manual analysis and response, which is time-consuming and labor-intensive; this invention aims to solve this problem.

[0433] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 1 is realized by the following means.

[0434] In this invention, the server includes means for collecting information and converting it into a unified format, means for processing it immediately using advanced analysis techniques and extracting error information, and means for automatically analyzing the cause based on the extracted error information and providing a solution. This enables efficient management of diverse log data and rapid problem identification and solution provision.

[0435] "Means of collecting information and converting it into a unified format" refers to technologies or devices for acquiring data from multiple different sources and converting them into an analyzable format.

[0436] "Means of processing data immediately using advanced analytical techniques and extracting error information" refers to algorithms and models that analyze collected data in real time and detect errors and anomalies.

[0437] "A means of automatically analyzing the cause based on extracted error information and providing a solution" refers to a technology or process that analyzes the cause behind an error and proposes actions to correct it.

[0438] "Means for automatically detecting protection-related events and generating warnings" refers to technologies that have the function of detecting unauthorized access or suspicious activity within a system and issuing immediate warnings.

[0439] "Means for automatically identifying computing resource constraints and providing improvement suggestions" refers to technologies or tools that detect system performance failures and provide specific suggestions for improvement.

[0440] "A means of automatically updating and notifying a collection of knowledge" refers to a technology that adds newly acquired knowledge to a database or knowledge base and notifies relevant parties of this information.

[0441] This invention provides a method for collecting log data in real time from various data sources through a server-based system, converting it into a unified format, and analyzing it. This system consists of a server, terminals, and users.

[0442] The server collects log data from various endpoints, including network devices, hardware components, and software applications, via sensors and agents. Since this data often comes in different formats, the server automatically converts it into a unified, parseable format.

[0443] The server also utilizes advanced analytical techniques, particularly generative AI models, to analyze the transformed data in real time. This analysis identifies error logs, detects anomalies, and automatically generates root cause analysis and suggested solutions based on these findings. For example, if an application frequently crashes due to insufficient memory, the server analyzes the crash logs and suggests an optimal memory reallocation.

[0444] This system can also be applied to security, allowing servers to detect unusual login attempts and suspicious network traffic, and issue immediate warnings. This enables a rapid response to potential threats.

[0445] All analysis results and improvement suggestions are automatically added to the knowledge base by the server and notified to the user. Based on this information, the user can learn from solutions to past problems and apply them to future actions.

[0446] For example, if a system administrator notices that an application is slow on a particular terminal, the server can analyze the terminal's log data to identify sudden spikes in CPU usage or disk I / O bottlenecks. Based on this information, the server can suggest workload distribution or process adjustments.

[0447] As an example of a prompt, inputting a message in the format of "Identify the cause of the application crash on a specific device and suggest a solution" into the AI ​​model allows you to obtain analysis results and improvement suggestions. This enables users to efficiently identify and resolve problems, improving the overall reliability and efficiency of the system.

[0448] The flow of the specific processing in Example 1 will be explained using Figure 11.

[0449] Step 1:

[0450] The server collects log data from network devices, hardware, and software applications. To do this, the server deploys agents or sensors and configures them to periodically send log information to the server. The input is raw log data from each endpoint, and the output is raw log data aggregated on the server. This data includes system calls, network traffic, and other similar information.

[0451] Step 2:

[0452] Because the collected log data is in different formats, the server uses a data parser to convert them to a unified format. The input is log data in different formats, and the output is log data in a unified format suitable for analysis. At this stage, the data parser performs syntactic analysis and maps the necessary information to a standard template.

[0453] Step 3:

[0454] The server uses an AI model to analyze log data converted to a unified format in real time. The input is log data in a unified format, and the output is identified error logs and abnormal events. The AI ​​model compares these with past log patterns to find regularities and detect abnormal behavior. Specifically, it extracts the frequency of error messages and behavioral patterns that pose a high security risk.

[0455] Step 4:

[0456] The server analyzes the causes of extracted errors so that users can receive the analysis results and take quick action based on the error logs. The input is the data from the error logs, and the output is the root cause analysis and solutions based on that data. This analysis provides automatically generated suggestions based on resource usage and similar past events. For example, if high CPU load is identified as a problem, it will suggest how to reallocate resources to address it.

[0457] Step 5:

[0458] The server monitors security incidents and operates a function to automatically detect anomalies. Inputs include network traffic and login attempt data, while outputs are warning messages based on anomaly detection. Here, the server compares abnormal access patterns and malicious behavior to a baseline and can immediately notify the user.

[0459] Step 6:

[0460] The server adds the analysis results and generated improvement suggestions to the knowledge base. The input is the data of the analysis results and improvement suggestions, and the output is the updated knowledge base. In this step, newly discovered knowledge is automatically and periodically recorded in the database, and the user is notified as needed. An example of a prompt message would be to ask the AI, "What are the most frequent error logs that occurred this week?", and then take follow-up actions based on the knowledge base.

[0461] (Application Example 1)

[0462] Next, we will explain Application Example 1. In the following explanation, the data processing device 12 will be referred to as the "server," and the headset-type terminal 314 will be referred to as the "terminal."

[0463] In today's information technology environment, rapidly identifying and responding to failures and security incidents in data centers is challenging. Vast amounts of log data are generated in diverse formats, requiring immediate extraction of meaningful information and appropriate responses. However, traditional methods struggle with real-time analysis and efficient notification. Furthermore, technologies are needed to ensure proper management even when operations managers are away from the site.

[0464] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 1 is realized by the following means.

[0465] In this invention, the server includes means for acquiring log data and converting it to a standard format, means for immediately analyzing the acquired log data using machine learning technology to identify fault logs, and means for the operations manager to receive the analysis results from a mobile device via a user interface. This enables the operations manager to identify data center failures and security incidents in real time, even from a remote location, and to respond quickly.

[0466] "Log data" refers to records of activity generated by computer systems and network devices.

[0467] A "standard format" is a format used to unify different data formats and bring them together according to a common standard.

[0468] "Machine learning techniques" are algorithms and methods that allow computers to learn patterns from data and perform predictions and classifications.

[0469] A "failure log" is a log that records information about errors and malfunctions that occur in a system or application.

[0470] An "information security incident" is an activity or situation that could potentially affect the security of a system or network.

[0471] A "warning" is a notification or message that indicates a system malfunction.

[0472] The "system efficiency limit" is an indicator that shows the limit of the load at which a system's performance or throughput begins to decline.

[0473] An "improvement suggestion" is a specific measure to optimize the operation of the current system and improve its performance.

[0474] A "knowledge base" is a collection of data that accumulates and makes accessible past cases and solutions.

[0475] A "user interface" is a means or screen through which a user interacts with a system and inputs or receives information.

[0476] An "operations manager" is a person responsible for monitoring, maintaining, and troubleshooting systems and networks.

[0477] A "personal digital assistant" (PDA) is a portable device equipped with communication capabilities, such as a smartphone or tablet.

[0478] As an embodiment of this invention, a system for streamlining the management of log data within a data center is described. This system is based on the premise that multiple servers operate in cooperation. The servers acquire log data from various terminals and devices within the network, convert it to a standard format, and store it. Log data is important for accurate and rapid identification of failures and events.

[0479] The acquired data is analyzed in real time using machine learning techniques. For example, AI platforms such as TensorFlow and SageMaker are used to perform pattern recognition and anomaly detection on the data. This allows the server to identify failure logs and information security incidents and immediately notify the operations manager. Notifications are made using mobile devices such as smartphones and tablets, enabling rapid responses tailored to business needs.

[0480] Furthermore, it identifies the limits of system efficiency and generates improvement suggestions to optimize performance. These suggested improvements are stored in a knowledge base, allowing operations managers to make optimal decisions based on this knowledge. Throughout this entire process, the security and efficiency of the data center can be improved.

[0481] A concrete example is log analysis to maintain the performance of a website experiencing a surge in traffic during an event. This allows for rapid adjustment of resource allocation within the data center and ensures service quality. An example of a prompt would be, "Analyze the following log dataset to identify errors and generate improvement suggestions: <log data>".

[0482] In this way, the system aims to achieve efficient and reliable operation and significantly improve data center management.

[0483] The flow of a specific process in Application Example 1 will be explained using Figure 12.

[0484] Step 1:

[0485] The server acquires log data from various terminals and devices within the network. The input is log data transmitted from each endpoint, and the output is log data converted to a standard format. The server first unifies this log data into a standard format, enabling efficient data analysis in subsequent processing steps.

[0486] Step 2:

[0487] The server analyzes standardized log data in real time using machine learning techniques. The input is log data in a unified format obtained in the previous step, and the output is detected failure logs and information security events. The server uses AI platforms such as TensorFlow to extract anomalous data patterns and specific events.

[0488] Step 3:

[0489] The server identifies fault logs and suspicious security incidents based on the analysis results and notifies the system administrator. The input is the log data where anomalies were detected, and the output is a warning message to the system administrator. This allows administrators to understand problems in real time via their mobile devices.

[0490] Step 4:

[0491] The server identifies the limits of system efficiency and generates improvement suggestions to optimize performance. The input is system performance metrics derived from log data, and the output is improvement suggestions. Users can access the knowledge base to tune performance based on these suggestions.

[0492] Step 5:

[0493] Users implement the proposed improvements using their mobile devices to optimize the system. The input is the improvements provided by the server, and the output is the stable system operation status after the adjustments. Optimization is carried out manually or automatically according to specific operating instructions to maintain the stable operation of the data center.

[0494] Furthermore, an emotion engine that estimates the user's emotions may be incorporated. That is, the identification processing unit 290 may use the emotion identification model 59 to estimate the user's emotions and perform identification processing using the user's emotions.

[0495] This invention is a log analysis system incorporating an emotion engine that recognizes user emotions. In addition to conventional log data analysis and system optimization functions, it aims to improve the user experience. This system has the ability to monitor each user's interaction and identify their emotional state at that time.

[0496] The server first collects log data as before and converts it into a unified format. After conversion, it uses AI technology to perform real-time analysis, identifying error logs and automatically analyzing their causes. In parallel, the emotion engine monitors user actions and inputs, and estimates emotions from voice, text, and behavior. This function is achieved by combining natural language processing algorithms and emotion recognition models.

[0497] When the user's emotional state is recognized, the server uses that information to optimize the analysis results and system interface. For example, if a user is experiencing stress during operation, the server will provide simpler instructions and support information tailored to that user. The emotion engine aims to mitigate unpleasant experiences and recommend actions to increase user satisfaction.

[0498] Notifications and warnings displayed on the device are also adjusted to match the user's emotions. For example, if a security incident warning is deemed likely to cause anxiety to the user, the server replaces it with a notification that clearly explains the corrective actions.

[0499] The recognized emotional information, along with the analysis results, is recorded in the knowledge base and used for future system improvements. This data functions as feedback information to enhance the overall user experience.

[0500] As a concrete example, consider a scenario where a user begins using a new software feature, and the device uses an emotion engine to detect the user's anxiety. In this case, the server provides an appropriate tutorial and offers support to alleviate the user's questions and anxieties. In this way, sophisticated interaction that takes the user's emotions into account is achieved.

[0501] This invention enables log analysis systems to go beyond the conventional scope of problem-solving and provide services that even extend to the comfort of the end user.

[0502] The following describes the processing flow.

[0503] Step 1:

[0504] The server collects log data from across the entire system. This stage includes a wide range of information, such as application events, system errors, and network data. The server then integrates this data and converts it into a parseable format.

[0505] Step 2:

[0506] The terminal monitors how the user interacts with the system in real time. This includes tracking entered text, click patterns, mouse movements, and voice commands. The terminal sends this data to an emotion engine to estimate the user's emotional state.

[0507] Step 3:

[0508] The server uses AI technology to analyze collected log data. The analysis process identifies error logs, analyzes their associated causes, and automatically generates possible solutions. Security incidents detected during the analysis are immediately alerted.

[0509] Step 4:

[0510] The emotion engine recognizes the user's emotions in real time and sends that information to the server. This information is used to improve the user experience. For example, if a user expresses dissatisfaction, the server provides flexible responses and support to alleviate the situation.

[0511] Step 5:

[0512] The server dynamically adjusts the system interface and notification content based on the recognized user's emotions. For example, if a warning message is expected to be stressful for the user, the explanation will be simplified and reassuring language will be used.

[0513] Step 6:

[0514] The server automatically records analysis results and sentiment data in a knowledge base. This record accumulates past incidents and user reactions, which can be referenced for future improvements. User feedback is also integrated, enabling continuous system improvement.

[0515] Step 7:

[0516] Users receive analysis results and personalized notifications from the system, allowing them to respond quickly and appropriately. As a result, the quality of the user experience is significantly improved, and the overall efficiency of the system is also enhanced.

[0517] (Example 2)

[0518] Next, we will describe Example 2. In the following description, the data processing device 12 will be referred to as the "server," and the headset-type terminal 314 will be referred to as the "terminal."

[0519] In modern information systems, rapid analysis of log data and identification of error logs are crucial. However, conventional technologies required considerable time to analyze the root cause of error logs, making it difficult to quickly provide solutions. Furthermore, it was difficult to provide support that considered the user's emotions during operation and to optimize the system, making improving the user experience a challenge.

[0520] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 2 is realized by the following means.

[0521] In this invention, the server includes means for collecting log data and converting it into a unified format, means for analyzing the collected log data in real time using AI technology to identify error logs, and means for identifying the emotional state using user input data. This enables rapid analysis of error logs and automatic analysis of their causes, as well as real-time identification of the user's emotions and optimization of the system interface based on these emotions.

[0522] "Log data" refers to a series of data generated or acquired by the system, such as user operation history and system error messages.

[0523] A "unified format" refers to a method or result of converting multiple different data formats into a consistent format.

[0524] "AI technology" refers to technologies that use artificial intelligence to perform data analysis and pattern recognition.

[0525] An "error log" is data that records errors and anomalies that occur within a system.

[0526] "Cause analysis" is the process of automatically identifying and analyzing the factors that cause identified problems or errors.

[0527] A "solution" refers to the means or methods used to correct or improve an identified problem.

[0528] A "security incident" refers to an event or occurrence that threatens the security of a system.

[0529] A "bottleneck" is a factor that hinders the performance or flow of a system.

[0530] A "knowledge base" is a collection of information that serves as a standard for future decision-making, accumulating analytical results and important data.

[0531] "Emotional state" refers to the psychological state or emotions of the user while they are using the service.

[0532] "Optimization" is the process of improving a system or process to make it more efficient or user-friendly.

[0533] "Natural language processing technology" is a technology that enables computers to understand and process human language.

[0534] This system aims to improve the user experience by recognizing user emotions in real time using user interaction data. The server first collects a wide range of log data and converts it into a unified format. Common data format conversion tools are used for this process. Furthermore, the server uses AI technology to perform real-time log analysis, enabling rapid identification of error logs. For this purpose, open-source tools known as machine learning libraries are utilized.

[0535] Furthermore, the server processes input data obtained from the user's terminal and runs an emotion engine for emotion recognition. This emotion engine combines natural language processing techniques and emotion recognition models to identify the user's emotional state. For this reason, algorithms specialized in natural language processing are used.

[0536] The terminal plays a role in providing personalized support information and visual interfaces to each user based on analytical and emotional information sent from the server. For example, if a user may show anxiety when using a new feature, the server detects that emotion and provides a tutorial appropriate for the user. Another feature is that notifications and warnings are appropriately adjusted according to the user's emotions.

[0537] This system can be continuously improved based on feedback obtained from past data and user interactions. An example of a prompt might be, "Design an AI model that can detect when a user is likely to show anxiety when trying out a new feature and suggest support information to provide."

[0538] In this way, dynamic information exchange can be performed between the server, terminal, and user, maximizing the user experience.

[0539] The flow of the specific processing in Example 2 will be explained using Figure 13.

[0540] Step 1:

[0541] The server collects log data based on user actions from terminals or sensor devices. The input consists of raw operation history and system error messages. This data is then converted to a unified format using a data format conversion tool. The output is the log data converted into a parseable format.

[0542] Step 2:

[0543] The server uses log data converted into a unified format and employs AI technology to perform real-time analysis. The input is the log data converted in Step 1. A machine learning library is used to identify error logs and analyze their causes. The output is the identified error logs and their corresponding cause information.

[0544] Step 3:

[0545] The server uses user voice, text, and operation logs obtained from the terminal as input data to operate the emotion engine. Specifically, it uses a natural language processing algorithm and an emotion recognition model to estimate the user's emotional state. The output is information about the user's emotional state.

[0546] Step 4:

[0547] Based on the analysis results and sentiment information, the server optimizes the system interface and operating instructions to match the user's emotions. The input is information from steps 2 and 3. The output is the user-optimized interface and support information. Specifically, if the user expresses anxiety, the server provides a detailed tutorial.

[0548] Step 5:

[0549] The device adjusts notifications and warnings to match the user's emotions based on optimization information provided by the server. The input is the instruction information from step 4. The output is notification and warning messages that respond immediately to the user's emotions. Specifically, it replaces warning content that might cause anxiety in the user with simpler and easier-to-understand content.

[0550] Step 6:

[0551] The server records the final analysis results and sentiment information in a knowledge base. The input is the combined information obtained from each processing step. The output is feedback data that can be used for future system improvements. Specifically, it is accumulated as a data set based on past experience, supporting continuous system improvement.

[0552] (Application Example 2)

[0553] Next, we will explain application example 2. In the following explanation, the data processing device 12 will be referred to as the "server," and the headset-type terminal 314 will be referred to as the "terminal."

[0554] In modern information processing systems, technical optimization through the analysis of log information is required, but there are limitations to adjusting the interface to reflect user emotions or making suggestions to reduce user psychological stress. As a result, overall end-user satisfaction may decrease, and this needs to be addressed.

[0555] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means.

[0556] In this invention, the server includes means for converting log information into a unified structure, means for identifying error information using machine learning techniques, and means for identifying the user's emotional state and adjusting the interface. This enables dynamic adjustment of the interface according to the user's emotions and optimization to alleviate psychological stress.

[0557] "Log information" refers to data that records the activity history of a system or application.

[0558] "Means of converting to a unified structure" refers to the process of consolidating log information recorded in different formats into a consistent format.

[0559] "Machine learning technology" is a field of artificial intelligence that learns patterns and rules from data to perform predictions and classifications.

[0560] "Error information" refers to data that details malfunctions or problems that have occurred in a system or application.

[0561] "Means for identifying a user's emotional state" refers to technologies for estimating a user's current emotions from their facial expressions, voice, text, etc.

[0562] "Means of adjusting the interface" refers to functions that dynamically change the user's operating screen and the way information is provided.

[0563] "Optimization to alleviate psychological stress" refers to improvements that reduce user stress by adjusting the system according to the user's emotional state.

[0564] To implement this invention, it is necessary to build a system that recognizes the user's emotions in real time and dynamically adjusts the interface based on those emotions. Specifically, a home assistant robot will be equipped with an emotion recognition engine, and the user's emotional state will be analyzed by collecting the user's voice and video data. This will involve using hardware such as a voice recognition microphone and camera, as well as an emotion recognition algorithm using TensorFlow.

[0565] The server first converts log information into a unified structure and uses machine learning techniques to identify error information. Then, it identifies the user's emotional state and optimizes the interface to alleviate psychological stress. By utilizing natural language processing technology, it estimates user emotions from voice and text data, enabling dynamic responses as needed.

[0566] For example, if an assistant robot detects stress while a family member is getting ready in the morning, it can play relaxing music to facilitate conversation. This can make the home environment more comfortable. Furthermore, the system's response can be further improved by generating prompts for the AI ​​model, such as "What kind of support should be provided if the user is feeling anxious?"

[0567] The flow of a specific process in Application Example 2 will be explained using Figure 14.

[0568] Step 1:

[0569] The server collects user voice input and video data from sensing devices (microphones and cameras). The input consists of audio signals and image data, which are converted into digital format and passed on to the next processing step.

[0570] Step 2:

[0571] The server inputs collected audio and video data into a machine learning model, combining natural language processing and facial recognition techniques to estimate the user's emotional state. It analyzes the voice tone and facial expressions as input and obtains emotional labels such as joy, sadness, anger, and surprise as output.

[0572] Step 3:

[0573] The server determines whether the user interface needs adjustment based on the emotion labels obtained. In this step, if the emotion labels indicate stress or anxiety, it generates data to instruct the interface to make specification changes.

[0574] Step 4:

[0575] The terminal, upon receiving instructions from the server, dynamically adjusts the user interface to reflect the user's emotions. Specifically, it changes the color tone on the screen, reconfigures button placement, and provides support information, and the output is the adjusted user interface.

[0576] Step 5:

[0577] When a user begins interacting with a new interface, the device again collects the results as log information. This log includes the user's operation history and responses, and is sent to the server for optimization in the future.

[0578] Step 6:

[0579] The server stores newly obtained log information in a knowledge base and uses it to improve the system and enhance the user experience in the future. In this process, important patterns and trends are extracted, and based on this, subsequent actions are further refined.

[0580] The specific processing unit 290 transmits the result of the specific processing to the headset terminal 314. In the headset terminal 314, the control unit 46A causes the speaker 240 and display 343 to output the result of the specific processing. The microphone 238 acquires audio indicating user input for the result of the specific processing. The control unit 46A transmits the audio data indicating user input acquired by the microphone 238 to the data processing unit 12. In the data processing unit 12, the specific processing unit 290 acquires the audio data.

[0581] Data generation model 58 is a type of so-called generative AI (Artificial Intelligence). An example of data generation model 58 is ChatGPT (Internet Search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search) <url: https: gemini.google.com ?hl="ja">Examples of generative AI include the following. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 is input with prompts containing instructions, and with inference data such as audio data representing speech, text data representing text, and image data representing images. The data generation model 58 infers from the input inference data according to the instructions indicated by the prompts, and outputs the inference results in data formats such as audio data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0582] In the above embodiment, an example was given in which specific processing is performed by the data processing device 12, but the technology of this disclosure is not limited thereto, and specific processing may also be performed by the headset terminal 314.

[0583] [Fourth Embodiment]

[0584] Figure 7 shows an example of the configuration of the data processing system 410 according to the fourth embodiment.

[0585] As shown in Figure 7, the data processing system 410 includes a data processing device 12 and a robot 414. An example of the data processing device 12 is a server.

[0586] The data processing device 12 comprises a computer 22, a database 24, and a communication interface 26. The computer 22 is an example of a "computer" related to the technology of this disclosure. The computer 22 comprises a processor 28, RAM 30, and storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication interface 26 are also connected to the bus 34. The communication interface 26 is connected to a network 54. An example of the network 54 is a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0587] The robot 414 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication interface 44, and a controlled object 443. The computer 36 includes a processor 46, RAM 48, and storage 50. The processor 46, RAM 48, and storage 50 are connected to a bus 52. The microphone 238, speaker 240, camera 42, and controlled object 443 are also connected to the bus 52.

[0588] The microphone 238 receives voice signals from the user 20 and receives instructions from the user 20. The microphone 238 captures the voice signals from the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to the instructions from the processor 46.

[0589] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an image sensor such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the area around the user 20 (for example, an imaging range defined by a field of view equivalent to the width of a typical healthy person's field of vision).

[0590] Communication interface 44 is connected to network 54. Communication interfaces 44 and 26 are responsible for the exchange of various information between processor 46 and processor 28 via network 54. The exchange of various information between processor 46 and processor 28 using communication interfaces 44 and 26 is performed in a secure manner.

[0591] The controlled object 443 includes a display device, LEDs in the eyes, and motors that drive the arms, hands, and feet. The posture and gestures of the robot 414 are controlled by controlling the motors of the arms, hands, and feet. Some of the robot 414's emotions can be expressed by controlling these motors. Furthermore, the robot 414's facial expressions can also be expressed by controlling the illumination state of the LEDs in its eyes.

[0592] Figure 8 shows an example of the main functions of the data processing device 12 and the robot 414. As shown in Figure 8, the data processing device 12 performs specific processing using the processor 28. The storage 32 stores the specific processing program 56.

[0593] The specific processing program 56 is an example of a "program" relating to the technology of this disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0594] The storage 32 stores the data generation model 58 and the emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0595] In robot 414, the processor 46 performs the reception output processing. The storage 50 stores the reception output program 60. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output processing is realized by the processor 46 operating as a control unit 46A according to the reception output program 60 executed on the RAM 48.

[0596] Next, the specific processing performed by the specific processing unit 290 of the data processing device 12 will be described. In the following description, the data processing device 12 will be referred to as the "server" and the robot 414 as the "terminal".

[0597] This invention relates to the realization of a system that collects log data from diverse data sources and analyzes it in real time using AI technology. This system has functions to identify error logs and analyze their causes, as well as functions to quickly detect security incidents and generate warnings. Furthermore, it is possible to identify bottlenecks to optimize system performance and provide appropriate improvement suggestions.

[0598] The server first collects log data from various endpoints, including networks, hardware devices, and software applications. Since this log data often has different formats, the server converts the collected data into a unified format. Next, the server uses AI technology to analyze this converted data, initiating a process of classifying and identifying error logs.

[0599] System administrators and DevOps engineers, acting as users, can leverage analysis results provided by the server to quickly identify and resolve problems. For example, if a terminal crashes while using a specific application, the server analyzes the logs related to the crash and identifies the root cause: insufficient resources. Based on this information, the server then suggests an appropriate reallocation of memory, helping to resolve the problem.

[0600] Furthermore, the servers are also used to detect security incidents. They can immediately identify behaviors that raise security concerns, such as unusual login attempts or an increase in suspicious packets, and warn users. In this way, they play a role in protecting the system from potential security threats.

[0601] All analysis results are automatically added to the knowledge base, allowing users to access it and learn from and improve their strategies for dealing with past problems. This automatic update and notification feature enables efficient information sharing across the entire team, improving overall operational efficiency.

[0602] By utilizing this invention, it becomes possible to quickly identify and resolve error logs, thereby improving the stability and efficiency of the IT infrastructure of companies and organizations through enhanced security measures and optimized system performance.

[0603] The following describes the processing flow.

[0604] Step 1:

[0605] The server initiates the process of acquiring log data from each endpoint within the system. This log data contains a variety of information, including application events, system errors, and network traffic. The server efficiently aggregates this data using separate collection scripts or APIs for each of these data sources.

[0606] Step 2:

[0607] The server converts the acquired log data into a unified, parseable format. This process utilizes regular expressions and data mining techniques to standardize different log formats. Format conversion makes it easier for the analysis engine to process the data.

[0608] Step 3:

[0609] The server uses AI technology to analyze the converted log data. During this analysis phase, natural language processing techniques are used to extract error logs, understand their content, and classify them. The server also consults a knowledge base to see if similar problems have occurred in the past.

[0610] Step 4:

[0611] The server automatically analyzes the cause of error logs and generates possible solutions. In this process, the AI ​​refers to past cases and best practices to make suggestions to the system administrator. For example, if a particular error log is determined to be due to CPU overload, solutions such as adjusting process priorities will be suggested.

[0612] Step 5:

[0613] The server monitors security incidents in real time and immediately identifies anomalous patterns. This monitoring uses anomaly detection algorithms to learn normal operation and identify behaviors that deviate from it. When suspicious activity is detected, the server sends an alert to the security team.

[0614] Step 6:

[0615] The server analyzes system-wide performance data to identify bottlenecks. This process identifies delays in API calls and abnormal resource consumption, and analyzes their causes. Based on the results, the server makes suggestions for improvements, such as process optimization and resource reallocation.

[0616] Step 7:

[0617] The server automatically registers all analysis results in the knowledge base and notifies relevant team members in real time. System administrators, acting as users, can then build future countermeasures based on the newly generated knowledge, enabling rapid responses across the entire team.

[0618] (Example 1)

[0619] Next, we will describe Example 1. In the following description, the data processing device 12 will be referred to as the "server" and the robot 414 as the "terminal".

[0620] This invention aims to provide a method for quickly and automatically identifying errors and security incidents occurring in a system by collecting and analyzing log data obtained from diverse sources. Furthermore, it enables the identification of system performance bottlenecks and the provision of practical suggestions for optimization. Conventional methods require manual analysis and response, which is time-consuming and labor-intensive; this invention aims to solve this problem.

[0621] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 1 is realized by the following means.

[0622] In this invention, the server includes means for collecting information and converting it into a unified format, means for processing it immediately using advanced analysis techniques and extracting error information, and means for automatically analyzing the cause based on the extracted error information and providing a solution. This enables efficient management of diverse log data and rapid problem identification and solution provision.

[0623] "Means of collecting information and converting it into a unified format" refers to technologies or devices for acquiring data from multiple different sources and converting them into an analyzable format.

[0624] "Means of processing data immediately using advanced analytical techniques and extracting error information" refers to algorithms and models that analyze collected data in real time and detect errors and anomalies.

[0625] "A means of automatically analyzing the cause based on extracted error information and providing a solution" refers to a technology or process that analyzes the cause behind an error and proposes actions to correct it.

[0626] "Means for automatically detecting protection-related events and generating warnings" refers to technologies that have the function of detecting unauthorized access or suspicious activity within a system and issuing immediate warnings.

[0627] "Means for automatically identifying computing resource constraints and providing improvement suggestions" refers to technologies or tools that detect system performance failures and provide specific suggestions for improvement.

[0628] "A means of automatically updating and notifying a collection of knowledge" refers to a technology that adds newly acquired knowledge to a database or knowledge base and notifies relevant parties of this information.

[0629] This invention provides a method for collecting log data in real time from various data sources through a server-based system, converting it into a unified format, and analyzing it. This system consists of a server, terminals, and users.

[0630] The server collects log data from various endpoints, including network devices, hardware components, and software applications, via sensors and agents. Since this data often comes in different formats, the server automatically converts it into a unified, parseable format.

[0631] The server also utilizes advanced analytical techniques, particularly generative AI models, to analyze the transformed data in real time. This analysis identifies error logs, detects anomalies, and automatically generates root cause analysis and suggested solutions based on these findings. For example, if an application frequently crashes due to insufficient memory, the server analyzes the crash logs and suggests an optimal memory reallocation.

[0632] This system can also be applied to security, allowing servers to detect unusual login attempts and suspicious network traffic, and issue immediate warnings. This enables a rapid response to potential threats.

[0633] All analysis results and improvement suggestions are automatically added to the knowledge base by the server and notified to the user. Based on this information, the user can learn from solutions to past problems and apply them to future actions.

[0634] For example, if a system administrator notices that an application is slow on a particular terminal, the server can analyze the terminal's log data to identify sudden spikes in CPU usage or disk I / O bottlenecks. Based on this information, the server can suggest workload distribution or process adjustments.

[0635] As an example of a prompt, inputting a message in the format of "Identify the cause of the application crash on a specific device and suggest a solution" into the AI ​​model allows you to obtain analysis results and improvement suggestions. This enables users to efficiently identify and resolve problems, improving the overall reliability and efficiency of the system.

[0636] The flow of the specific processing in Example 1 will be explained using Figure 11.

[0637] Step 1:

[0638] The server collects log data from network devices, hardware, and software applications. To do this, the server deploys agents or sensors and configures them to periodically send log information to the server. The input is raw log data from each endpoint, and the output is raw log data aggregated on the server. This data includes system calls, network traffic, and other similar information.

[0639] Step 2:

[0640] Because the collected log data is in different formats, the server uses a data parser to convert them to a unified format. The input is log data in different formats, and the output is log data in a unified format suitable for analysis. At this stage, the data parser performs syntactic analysis and maps the necessary information to a standard template.

[0641] Step 3:

[0642] The server uses an AI model to analyze log data converted to a unified format in real time. The input is log data in a unified format, and the output is identified error logs and abnormal events. The AI ​​model compares these with past log patterns to find regularities and detect abnormal behavior. Specifically, it extracts the frequency of error messages and behavioral patterns that pose a high security risk.

[0643] Step 4:

[0644] The server analyzes the causes of extracted errors so that users can receive the analysis results and take quick action based on the error logs. The input is the data from the error logs, and the output is the root cause analysis and solutions based on that data. This analysis provides automatically generated suggestions based on resource usage and similar past events. For example, if high CPU load is identified as a problem, it will suggest how to reallocate resources to address it.

[0645] Step 5:

[0646] The server monitors security incidents and operates a function to automatically detect anomalies. Inputs include network traffic and login attempt data, while outputs are warning messages based on anomaly detection. Here, the server compares abnormal access patterns and malicious behavior to a baseline and can immediately notify the user.

[0647] Step 6:

[0648] The server adds the analysis results and generated improvement suggestions to the knowledge base. The input is the data of the analysis results and improvement suggestions, and the output is the updated knowledge base. In this step, newly discovered knowledge is automatically and periodically recorded in the database, and the user is notified as needed. An example of a prompt message would be to ask the AI, "What are the most frequent error logs that occurred this week?", and then take follow-up actions based on the knowledge base.

[0649] (Application Example 1)

[0650] Next, we will explain Application Example 1. In the following explanation, the data processing device 12 will be referred to as the "server" and the robot 414 as the "terminal".

[0651] In today's information technology environment, rapidly identifying and responding to failures and security incidents in data centers is challenging. Vast amounts of log data are generated in diverse formats, requiring immediate extraction of meaningful information and appropriate responses. However, traditional methods struggle with real-time analysis and efficient notification. Furthermore, technologies are needed to ensure proper management even when operations managers are away from the site.

[0652] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 1 is realized by the following means.

[0653] In this invention, the server includes means for acquiring log data and converting it to a standard format, means for immediately analyzing the acquired log data using machine learning technology to identify fault logs, and means for the operations manager to receive the analysis results from a mobile device via a user interface. This enables the operations manager to identify data center failures and security incidents in real time, even from a remote location, and to respond quickly.

[0654] "Log data" refers to records of activity generated by computer systems and network devices.

[0655] A "standard format" is a format used to unify different data formats and bring them together according to a common standard.

[0656] "Machine learning techniques" are algorithms and methods that allow computers to learn patterns from data and perform predictions and classifications.

[0657] A "failure log" is a log that records information about errors and malfunctions that occur in a system or application.

[0658] An "information security incident" is an activity or situation that could potentially affect the security of a system or network.

[0659] A "warning" is a notification or message that indicates a system malfunction.

[0660] The "system efficiency limit" is an indicator that shows the limit of the load at which a system's performance or throughput begins to decline.

[0661] An "improvement suggestion" is a specific measure to optimize the operation of the current system and improve its performance.

[0662] A "knowledge base" is a collection of data that accumulates and makes accessible past cases and solutions.

[0663] A "user interface" is a means or screen through which a user interacts with a system and inputs or receives information.

[0664] An "operations manager" is a person responsible for monitoring, maintaining, and troubleshooting systems and networks.

[0665] A "personal digital assistant" (PDA) is a portable device equipped with communication capabilities, such as a smartphone or tablet.

[0666] As an embodiment of this invention, a system for streamlining the management of log data within a data center is described. This system is based on the premise that multiple servers operate in cooperation. The servers acquire log data from various terminals and devices within the network, convert it to a standard format, and store it. Log data is important for accurate and rapid identification of failures and events.

[0667] The acquired data is analyzed in real time using machine learning techniques. For example, AI platforms such as TensorFlow and SageMaker are used to perform pattern recognition and anomaly detection on the data. This allows the server to identify failure logs and information security incidents and immediately notify the operations manager. Notifications are made using mobile devices such as smartphones and tablets, enabling rapid responses tailored to business needs.

[0668] Furthermore, it identifies the limits of system efficiency and generates improvement suggestions to optimize performance. These suggested improvements are stored in a knowledge base, allowing operations managers to make optimal decisions based on this knowledge. Throughout this entire process, the security and efficiency of the data center can be improved.

[0669] A concrete example is log analysis to maintain the performance of a website experiencing a surge in traffic during an event. This allows for rapid adjustment of resource allocation within the data center and ensures service quality. An example of a prompt would be, "Analyze the following log dataset to identify errors and generate improvement suggestions: <log data>".

[0670] In this way, the system aims to achieve efficient and reliable operation and significantly improve data center management.

[0671] The flow of a specific process in Application Example 1 will be explained using Figure 12.

[0672] Step 1:

[0673] The server acquires log data from various terminals and devices within the network. The input is log data transmitted from each endpoint, and the output is log data converted to a standard format. The server first unifies this log data into a standard format, enabling efficient data analysis in subsequent processing steps.

[0674] Step 2:

[0675] The server analyzes standardized log data in real time using machine learning techniques. The input is log data in a unified format obtained in the previous step, and the output is detected failure logs and information security events. The server uses AI platforms such as TensorFlow to extract anomalous data patterns and specific events.

[0676] Step 3:

[0677] The server identifies fault logs and suspicious security incidents based on the analysis results and notifies the system administrator. The input is the log data where anomalies were detected, and the output is a warning message to the system administrator. This allows administrators to understand problems in real time via their mobile devices.

[0678] Step 4:

[0679] The server identifies the limits of system efficiency and generates improvement suggestions to optimize performance. The input is system performance metrics derived from log data, and the output is improvement suggestions. Users can access the knowledge base to tune performance based on these suggestions.

[0680] Step 5:

[0681] Users implement the proposed improvements using their mobile devices to optimize the system. The input is the improvements provided by the server, and the output is the stable system operation status after the adjustments. Optimization is carried out manually or automatically according to specific operating instructions to maintain the stable operation of the data center.

[0682] Furthermore, an emotion engine that estimates the user's emotions may be incorporated. That is, the identification processing unit 290 may use the emotion identification model 59 to estimate the user's emotions and perform identification processing using the user's emotions.

[0683] This invention is a log analysis system incorporating an emotion engine that recognizes user emotions. In addition to conventional log data analysis and system optimization functions, it aims to improve the user experience. This system has the ability to monitor each user's interaction and identify their emotional state at that time.

[0684] The server first collects log data as before and converts it into a unified format. After conversion, it uses AI technology to perform real-time analysis, identifying error logs and automatically analyzing their causes. In parallel, the emotion engine monitors user actions and inputs, and estimates emotions from voice, text, and behavior. This function is achieved by combining natural language processing algorithms and emotion recognition models.

[0685] When the user's emotional state is recognized, the server uses that information to optimize the analysis results and system interface. For example, if a user is experiencing stress during operation, the server will provide simpler instructions and support information tailored to that user. The emotion engine aims to mitigate unpleasant experiences and recommend actions to increase user satisfaction.

[0686] Notifications and warnings displayed on the device are also adjusted to the user's emotions. For example, if a security incident warning is deemed likely to cause anxiety to the user, the server replaces it with a notification that clearly explains the corrective actions.

[0687] The recognized emotional information, along with the analysis results, is recorded in the knowledge base and used for future system improvements. This data functions as feedback information to enhance the overall user experience.

[0688] As a concrete example, consider a scenario where a user begins using a new software feature, and the device uses an emotion engine to detect the user's anxiety. In this case, the server provides an appropriate tutorial and offers support to alleviate the user's questions and anxieties. In this way, sophisticated interaction that takes the user's emotions into account is achieved.

[0689] This invention enables log analysis systems to go beyond the conventional scope of problem-solving and provide services that even extend to the comfort of the end user.

[0690] The following describes the processing flow.

[0691] Step 1:

[0692] The server collects log data from across the entire system. This stage includes a wide range of information, such as application events, system errors, and network data. The server then integrates this data and converts it into a parseable format.

[0693] Step 2:

[0694] The terminal monitors how the user interacts with the system in real time. This includes tracking entered text, click patterns, mouse movements, and voice commands. The terminal sends this data to an emotion engine to estimate the user's emotional state.

[0695] Step 3:

[0696] The server uses AI technology to analyze collected log data. The analysis process identifies error logs, analyzes their associated causes, and automatically generates possible solutions. Security incidents detected during the analysis are immediately alerted.

[0697] Step 4:

[0698] The emotion engine recognizes the user's emotions in real time and sends that information to the server. This information is used to improve the user experience. For example, if a user expresses dissatisfaction, the server provides flexible responses and support to alleviate the situation.

[0699] Step 5:

[0700] The server dynamically adjusts the system interface and notification content based on the recognized user's emotions. For example, if a warning message is expected to be stressful for the user, the explanation will be simplified and reassuring language will be used.

[0701] Step 6:

[0702] The server automatically records analysis results and sentiment data in a knowledge base. This record accumulates past incidents and user reactions, which can be referenced for future improvements. User feedback is also integrated, enabling continuous system improvement.

[0703] Step 7:

[0704] Users receive analysis results and personalized notifications from the system, allowing them to respond quickly and appropriately. As a result, the quality of the user experience is significantly improved, and the overall efficiency of the system is also enhanced.

[0705] (Example 2)

[0706] Next, we will describe Example 2. In the following description, the data processing device 12 will be referred to as the "server" and the robot 414 as the "terminal".

[0707] In modern information systems, rapid analysis of log data and identification of error logs are crucial. However, conventional technologies required considerable time to analyze the root cause of error logs, making it difficult to quickly provide solutions. Furthermore, it was difficult to provide support that considered the user's emotions during operation and to optimize the system, making improving the user experience a challenge.

[0708] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 2 is realized by the following means.

[0709] In this invention, the server includes means for collecting log data and converting it into a unified format, means for analyzing the collected log data in real time using AI technology to identify error logs, and means for identifying the emotional state using user input data. This enables rapid analysis of error logs and automatic analysis of their causes, as well as real-time identification of the user's emotions and optimization of the system interface based on these emotions.

[0710] "Log data" refers to a series of data generated or acquired by the system, such as user operation history and system error messages.

[0711] A "unified format" refers to a method or result of converting multiple different data formats into a consistent format.

[0712] "AI technology" refers to technologies that use artificial intelligence to perform data analysis and pattern recognition.

[0713] An "error log" is data that records errors and anomalies that occur within a system.

[0714] "Cause analysis" is the process of automatically identifying and analyzing the factors that cause identified problems or errors.

[0715] A "solution" refers to the means or methods used to correct or improve an identified problem.

[0716] A "security incident" refers to an event or occurrence that threatens the security of a system.

[0717] A "bottleneck" is a factor that hinders the performance or flow of a system.

[0718] A "knowledge base" is a collection of information that serves as a standard for future decision-making, accumulating analytical results and important data.

[0719] "Emotional state" refers to the psychological state or emotions of the user while they are using the service.

[0720] "Optimization" is the process of improving a system or process to make it more efficient or user-friendly.

[0721] "Natural language processing technology" is a technology that enables computers to understand and process human language.

[0722] This system aims to improve the user experience by recognizing user emotions in real time using user interaction data. The server first collects a wide range of log data and converts it into a unified format. Common data format conversion tools are used for this process. Furthermore, the server uses AI technology to perform real-time log analysis, enabling rapid identification of error logs. For this purpose, open-source tools known as machine learning libraries are utilized.

[0723] Furthermore, the server processes input data obtained from the user's terminal and runs an emotion engine for emotion recognition. This emotion engine combines natural language processing techniques and emotion recognition models to identify the user's emotional state. For this reason, algorithms specialized in natural language processing are used.

[0724] The terminal plays a role in providing personalized support information and visual interfaces to each user based on analytical and emotional information sent from the server. For example, if a user may show anxiety when using a new feature, the server detects that emotion and provides a tutorial appropriate for the user. Another feature is that notifications and warnings are appropriately adjusted according to the user's emotions.

[0725] This system can be continuously improved based on feedback obtained from past data and user interactions. An example of a prompt might be, "Design an AI model that can detect when a user is likely to show anxiety when trying out a new feature and suggest support information to provide."

[0726] In this way, dynamic information exchange can be performed between the server, terminal, and user, maximizing the user experience.

[0727] The flow of the specific processing in Example 2 will be explained using Figure 13.

[0728] Step 1:

[0729] The server collects log data based on user actions from terminals or sensor devices. The input consists of raw operation history and system error messages. This data is then converted to a unified format using a data format conversion tool. The output is the log data converted into a parseable format.

[0730] Step 2:

[0731] The server uses log data converted into a unified format and employs AI technology to perform real-time analysis. The input is the log data converted in Step 1. A machine learning library is used to identify error logs and analyze their causes. The output is the identified error logs and their corresponding cause information.

[0732] Step 3:

[0733] The server uses user voice, text, and operation logs obtained from the terminal as input data to operate the emotion engine. Specifically, it uses a natural language processing algorithm and an emotion recognition model to estimate the user's emotional state. The output is information about the user's emotional state.

[0734] Step 4:

[0735] Based on the analysis results and sentiment information, the server optimizes the system interface and operating instructions to match the user's emotions. The input is information from steps 2 and 3. The output is the user-optimized interface and support information. Specifically, if the user expresses anxiety, the server provides a detailed tutorial.

[0736] Step 5:

[0737] The device adjusts notifications and warnings to match the user's emotions based on optimization information provided by the server. The input is the instruction information from step 4. The output is notification and warning messages that respond immediately to the user's emotions. Specifically, it replaces warning content that might cause anxiety in the user with simpler and easier-to-understand content.

[0738] Step 6:

[0739] The server records the final analysis results and sentiment information in a knowledge base. The input is the combined information obtained from each processing step. The output is feedback data that can be used for future system improvements. Specifically, it is accumulated as a data set based on past experience, supporting continuous system improvement.

[0740] (Application Example 2)

[0741] Next, we will explain application example 2. In the following explanation, the data processing device 12 will be referred to as the "server" and the robot 414 as the "terminal".

[0742] In modern information processing systems, technical optimization through the analysis of log information is required, but there are limitations to adjusting the interface to reflect user emotions or making suggestions to reduce user psychological stress. As a result, overall end-user satisfaction may decrease, and this needs to be addressed.

[0743] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means.

[0744] In this invention, the server includes means for converting log information into a unified structure, means for identifying error information using machine learning techniques, and means for identifying the user's emotional state and adjusting the interface. This enables dynamic adjustment of the interface according to the user's emotions and optimization to alleviate psychological stress.

[0745] "Log information" refers to data that records the activity history of a system or application.

[0746] "Means of converting to a unified structure" refers to the process of consolidating log information recorded in different formats into a consistent format.

[0747] "Machine learning technology" is a field of artificial intelligence that learns patterns and rules from data to perform predictions and classifications.

[0748] "Error information" refers to data that details malfunctions or problems that have occurred in a system or application.

[0749] "Means for identifying a user's emotional state" refers to technologies for estimating a user's current emotions from their facial expressions, voice, text, etc.

[0750] "Means of adjusting the interface" refers to functions that dynamically change the user's operating screen and the way information is provided.

[0751] "Optimization to alleviate psychological stress" refers to improvements that reduce user stress by adjusting the system according to the user's emotional state.

[0752] To implement this invention, it is necessary to build a system that recognizes the user's emotions in real time and dynamically adjusts the interface based on those emotions. Specifically, a home assistant robot will be equipped with an emotion recognition engine, and the user's emotional state will be analyzed by collecting the user's voice and video data. This will involve using hardware such as a voice recognition microphone and camera, as well as an emotion recognition algorithm using TensorFlow.

[0753] The server first converts log information into a unified structure and uses machine learning techniques to identify error information. Then, it identifies the user's emotional state and optimizes the interface to alleviate psychological stress. By utilizing natural language processing technology, it estimates user emotions from voice and text data, enabling dynamic responses as needed.

[0754] For example, if an assistant robot detects stress while a family member is getting ready in the morning, it can play relaxing music to facilitate conversation. This can make the home environment more comfortable. Furthermore, the system's response can be further improved by generating prompts for the AI ​​model, such as "What kind of support should be provided if the user is feeling anxious?"

[0755] The flow of a specific process in Application Example 2 will be explained using Figure 14.

[0756] Step 1:

[0757] The server collects user voice input and video data from sensing devices (microphones and cameras). The input consists of audio signals and image data, which are converted into digital format and passed on to the next processing step.

[0758] Step 2:

[0759] The server inputs collected audio and video data into a machine learning model, combining natural language processing and facial recognition techniques to estimate the user's emotional state. It analyzes the voice tone and facial expressions as input and obtains emotional labels such as joy, sadness, anger, and surprise as output.

[0760] Step 3:

[0761] The server determines whether the user interface needs adjustment based on the emotion labels obtained. In this step, if the emotion labels indicate stress or anxiety, it generates data to instruct the interface to make specification changes.

[0762] Step 4:

[0763] The terminal, upon receiving instructions from the server, dynamically adjusts the user interface to reflect the user's emotions. Specifically, it changes the color tone on the screen, reconfigures button placement, and provides support information, and the output is the adjusted user interface.

[0764] Step 5:

[0765] When a user begins interacting with a new interface, the device again collects the results as log information. This log includes the user's operation history and responses, and is sent to the server for optimization in the future.

[0766] Step 6:

[0767] The server stores newly obtained log information in a knowledge base and uses it to improve the system and enhance the user experience in the future. In this process, important patterns and trends are extracted, and based on this, subsequent actions are further refined.

[0768] The specific processing unit 290 transmits the result of the specific processing to the robot 414. In the robot 414, the control unit 46A causes the speaker 240 and the controlled object 443 to output the result of the specific processing. The microphone 238 acquires audio indicating user input for the result of the specific processing. The control unit 46A transmits the audio data indicating user input acquired by the microphone 238 to the data processing unit 12. In the data processing unit 12, the specific processing unit 290 acquires the audio data.

[0769] Data generation model 58 is a type of so-called generative AI (Artificial Intelligence). An example of data generation model 58 is ChatGPT (Internet Search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search) <url: https: gemini.google.com ?hl="ja">Examples of generative AI include the following. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 is input with prompts containing instructions, and with inference data such as audio data representing speech, text data representing text, and image data representing images. The data generation model 58 infers from the input inference data according to the instructions indicated by the prompts, and outputs the inference results in data formats such as audio data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0770] In the above embodiment, an example was given in which the specific processing is performed by the data processing device 12, but the technology of this disclosure is not limited thereto, and the specific processing may also be performed by the robot 414.

[0771] Furthermore, the emotion identification model 59, acting as an emotion engine, may determine the user's emotion according to a specific mapping. Specifically, the emotion identification model 59 may determine the user's emotion according to a specific mapping, which is an emotion map (see Figure 9). Similarly, the emotion identification model 59 may also determine the robot's emotion, and the identification processing unit 290 may perform identification processing using the robot's emotion.

[0772] Figure 9 shows an emotion map 400 in which multiple emotions are mapped. In the emotion map 400, emotions are arranged in concentric circles radiating from the center. The closer to the center of the concentric circles, the more primitive the emotions are located. Further out of the concentric circles, emotions representing states and actions arising from mental states are located. Emotion is a concept that includes feelings and mental states. On the left side of the concentric circles, emotions that are generally generated from reactions occurring in the brain are located. On the right side of the concentric circles, emotions that are generally induced by situational judgment are located. Above and below the concentric circles, emotions that are generally generated from reactions occurring in the brain and induced by situational judgment are located. In addition, the emotion of "pleasure" is located on the upper side of the concentric circles, and the emotion of "displeasure" is located on the lower side. Thus, in the emotion map 400, multiple emotions are mapped based on the structure in which emotions arise, and emotions that are likely to occur simultaneously are mapped close together.

[0773] These emotions are distributed at the 3 o'clock position on the Emotion Map 400, and usually fluctuate between feelings of security and anxiety. In the right half of the Emotion Map 400, situational awareness takes precedence over internal feelings, resulting in a calm impression.

[0774] The inside of the Emotion Map 400 represents inner thoughts, while the outside represents actions. Therefore, the further you go from the outside of the Emotion Map 400, the more visible (expressed in actions) your emotions become.

[0775] Here, human emotions are based on various balances, such as posture and blood sugar levels. When these balances deviate from the ideal, it results in discomfort, and when they approach the ideal, it results in pleasure. Similarly, in robots, cars, motorcycles, etc., emotions can be created based on various balances, such as posture and battery level. When these balances deviate from the ideal, it results in discomfort, and when they approach the ideal, it results in pleasure. The emotion map can be generated, for example, based on Dr. Mitsuyoshi's emotion map (Research on a system for analyzing brain physiological signals of speech emotion recognition and emotion, Tokushima University, doctoral dissertation: https: / / ci.nii.ac.jp / naid / 500000375379). The left half of the emotion map contains emotions belonging to a region called "response," where sensation is dominant. The right half of the emotion map contains emotions belonging to a region called "situation," where situational awareness is dominant.

[0776] The emotion map defines two emotions that promote learning. One is the emotion around the middle of the negative "repentance" and "reflection" on the situation side. In other words, it is when the robot experiences negative emotions such as "I never want to feel this way again" or "I don't want to be scolded again." The other is the emotion around the positive "desire" on the reaction side. In other words, it is when the robot has positive feelings such as "I want more" or "I want to know more."

[0777] The emotion identification model 59 inputs user input into a pre-trained neural network, obtains emotion values ​​representing each emotion shown in the emotion map 400, and determines the user's emotion. This neural network is pre-trained based on multiple training data sets, which are combinations of user input and emotion values ​​representing each emotion shown in the emotion map 400. Furthermore, this neural network is trained so that emotions located close together have similar values, as shown in the emotion map 900 in Figure 10. Figure 10 shows an example where multiple emotions such as "reassured," "calm," and "confident" have similar emotion values.

[0778] The above description primarily focuses on the functions of the data processing device 12 in relation to this disclosure. However, the system related to this disclosure is not necessarily implemented on a server. The system related to this disclosure may be implemented as a general information processing system. This disclosure may be implemented, for example, as a software program that runs on a personal computer or as an application that runs on a smartphone. The method related to this disclosure may be provided to users in SaaS (Software as a Service) format.

[0779] In the above embodiment, an example was given in which a specific process is performed by a single computer 22. However, the technology of this disclosure is not limited thereto, and a distributed processing of the specific process may be performed by multiple computers, including computer 22. For example, a data generation model 58 may be provided in an external device of the data processing device 12, and the external device may generate data according to the input data.

[0780] In the above embodiment, an example was given in which the specific processing program 56 is stored in the storage 32, but the technology of this disclosure is not limited thereto. For example, the specific processing program 56 may be stored in a portable, computer-readable, non-temporary storage medium such as a USB (Universal Serial Bus) memory. The specific processing program 56 stored in the non-temporary storage medium is installed in the computer 22 of the data processing device 12. The processor 28 executes specific processing according to the specific processing program 56.

[0781] Alternatively, the specific processing program 56 may be stored in a storage device such as a server connected to the data processing device 12 via the network 54, and the specific processing program 56 may be downloaded and installed on the computer 22 in response to a request from the data processing device 12.

[0782] Furthermore, it is not necessary to store the entirety of the specific processing program 56 in a storage device such as a server connected to the data processing device 12 via the network 54, or to store the entirety of the specific processing program 56 in the storage 32; it is acceptable to store only a portion of the specific processing program 56.

[0783] The following types of processors can be used as hardware resources to perform specific processing. Examples of processors include a CPU, a general-purpose processor that functions as a hardware resource to perform specific processing by executing software, i.e., a program. Other examples of processors include dedicated electrical circuits, such as FPGAs (Field-Programmable Gate Arrays), PLDs (Programmable Logic Devices), or ASICs (Application Specific Integrated Circuits), which have circuit configurations specifically designed to perform specific processing. All of these processors have built-in or connected memory, and all of them perform specific processing by using memory.

[0784] The hardware resource that performs a specific process may consist of one of these various processors, or it may consist of a combination of two or more processors of the same or different types (for example, a combination of multiple FPGAs, or a combination of a CPU and an FPGA). Alternatively, the hardware resource that performs a specific process may consist of a single processor.

[0785] Examples of configurations using a single processor include, firstly, a configuration in which one or more CPUs and software are combined to form a single processor, and this processor functions as a hardware resource that performs a specific process. Secondly, there is a configuration using a processor that realizes the functions of the entire system, including multiple hardware resources that perform a specific process, on a single IC chip, as exemplified by SoCs (System-on-a-chip). In this way, a specific process is realized using one or more of the above types of processors as hardware resources.

[0786] Furthermore, the hardware structure of these various processors can more specifically utilize electrical circuits that combine circuit elements such as semiconductor devices. Also, the specific processing described above is merely an example. Therefore, it goes without saying that unnecessary steps can be deleted, new steps added, or the processing order rearranged, as long as it does not deviate from the main purpose.

[0787] The descriptions and illustrations presented above are detailed explanations of the technical aspects of this disclosure and are merely examples of the technical aspects. For example, the above descriptions of the structure, function, operation, and effect are examples of the structure, function, operation, and effect of the technical aspects of this disclosure. Therefore, it goes without saying that you may delete unnecessary parts, add new elements, or replace elements in the descriptions and illustrations presented above, as long as you do not deviate from the essence of the technical aspects of this disclosure. Furthermore, in order to avoid confusion and facilitate understanding of the technical aspects of this disclosure, explanations of common technical knowledge and the like that do not require special explanation to enable the implementation of the technical aspects of this disclosure have been omitted from the descriptions and illustrations presented above.

[0788] All documents, patent applications, and technical standards described herein are incorporated by reference to the same extent as if each individual document, patent application, and technical standard were specifically and individually noted to be incorporated by reference.

[0789] The following is further disclosed regarding the embodiments described above.

[0790] (Claim 1)

[0791] A means of collecting log data and converting it into a unified format,

[0792] A method for analyzing collected log data in real time using AI technology to identify error logs,

[0793] A means to automatically analyze the cause based on identified error logs and generate solutions,

[0794] A means of automatically detecting security incidents and generating warnings,

[0795] A means for automatically identifying system performance bottlenecks and generating optimization suggestions,

[0796] A means of automatically updating the knowledge base with processing results and providing notifications,

[0797] A system that includes this.

[0798] (Claim 2)

[0799] The system according to claim 1, which applies natural language processing technology to the analysis of log data.

[0800] (Claim 3)

[0801] The system according to claim 1, comprising the function of automatically executing the generated solution.

[0802] "Example 1"

[0803] (Claim 1)

[0804] A means of collecting information and converting it into a standardized format,

[0805] A means of immediately processing the collected information using advanced analytical techniques and extracting error information,

[0806] A means to automatically analyze the cause based on extracted error information and provide a solution,

[0807] A means for automatically detecting protection-related events and generating warnings,

[0808] A means to automatically identify computing resource constraints and provide improvement suggestions,

[0809] A means of automatically updating the processing results into a collection of knowledge and providing notifications,

[0810] A system that includes this.

[0811] (Claim 2)

[0812] The system according to claim 1, wherein natural language processing technology is applied to the analysis.

[0813] (Claim 3)

[0814] The system according to claim 1, comprising the function of automatically executing the generated solution.

[0815] "Application Example 1"

[0816] (Claim 1)

[0817] A means of acquiring log data and converting it to a standard format,

[0818] A means to immediately analyze acquired log data using machine learning technology to identify fault logs,

[0819] A means to automatically identify the cause based on identified failure logs and generate countermeasures,

[0820] A means for automatically detecting information security incidents and generating warnings,

[0821] A means to automatically identify the limits of system efficiency and generate improvement suggestions,

[0822] A means of automatically updating the knowledge base with processing results and providing notifications,

[0823] A means for the system administrator to receive analysis results from a mobile device via a user interface,

[0824] A system that includes this.

[0825] (Claim 2)

[0826] The system according to claim 1, which introduces natural language processing technology to analyze log data and presents the results to the operations manager in an easy-to-understand manner.

[0827] (Claim 3)

[0828] The system according to claim 1, which automatically executes the generated countermeasures and includes the selection of a predefined operating procedure.

[0829] "Example 2 of combining an emotion engine"

[0830] (Claim 1)

[0831] A means of collecting log data and converting it into a unified format,

[0832] A method for analyzing collected log data in real time using AI technology to identify error logs,

[0833] A means to automatically analyze the cause based on identified error logs and generate solutions,

[0834] A means of automatically detecting security incidents and generating warnings,

[0835] A means for automatically identifying system performance bottlenecks and generating optimization suggestions,

[0836] A means of automatically updating the knowledge base with processing results and providing notifications,

[0837] A means of identifying emotional states using user input data,

[0838] Means for optimizing the system interface based on identified emotional states,

[0839] A means of adjusting notifications and warnings according to the user's emotions,

[0840] A system that includes this.

[0841] (Claim 2)

[0842] The system according to claim 1, which applies natural language processing technology to the analysis of log data and estimates the user's emotions in real time.

[0843] (Claim 3)

[0844] The system according to claim 1, comprising a function to automatically perform optimization based on the generated solution and the user's emotions.

[0845] "Application example 2 when combining with an emotional engine"

[0846] (Claim 1)

[0847] A means of collecting log information and converting it into a unified structure,

[0848] A means of analyzing collected log information in real time using machine learning technology to identify error information,

[0849] A means to automatically analyze the cause based on identified error information and generate a solution,

[0850] A means for automatically detecting security-related anomalies and generating warnings,

[0851] A means for automatically identifying bottlenecks in information processing efficiency and generating optimization suggestions,

[0852] A means of automatically updating the knowledge base with processing results and providing notifications,

[0853] A means for identifying the user's emotional state and adjusting the interface accordingly,

[0854] A means of offering suggestions to help users relax when they are feeling stressed,

[0855] A system that includes this.

[0856] (Claim 2)

[0857] The system according to claim 1, which applies natural language processing technology to analyze log information and estimates the user's emotions.

[0858] (Claim 3)

[0859] The system according to claim 1, comprising the ability to automatically perform optimization based on the generated solutions and emotions. [Explanation of symbols]

[0860] 10, 210, 310, 410 Data Processing Systems 12 Data Processing Devices 14 Smart Devices 214 Smart Glasses 314 Headset-type terminal 414 Robots< / url:> < / url:> < / url:> < / url:>

Claims

1. A means of collecting log data and converting it into a unified format, A method for analyzing collected log data in real time using AI technology to identify error logs, A means to automatically analyze the cause based on identified error logs and generate solutions, A means of automatically detecting security incidents and generating warnings, A means for automatically identifying system performance bottlenecks and generating optimization suggestions, A means of automatically updating the knowledge base with processing results and providing notifications, A system that includes this.

2. The system according to claim 1, which applies natural language processing technology to the analysis of log data.

3. The system according to claim 1, further comprising a function to automatically execute the generated solution.

Images