system

Abstract

Provide a system. 【Solution means】 An information acquisition means for collecting information in real time from the network, An information shaping means for preprocessing and formatting the collected information, A multimodal analysis means for analyzing the preprocessed information and detecting suspicious patterns, An anomaly detection means for detecting and scoring anomalies based on the analysis results, A warning notification means for notifying a warning about the detected anomaly, A safety guideline presentation means for presenting guidelines for improving safety to the user, An information providing means for providing educational information for improving information literacy to the user, A dynamic analysis means for analyzing the digital content accessed by the user and evaluating the risk, A system including the above.

Description

Technical Field

[0001] The technology of the present disclosure relates to a system.

Background Art

[0002] Patent Document 1 discloses a persona chatbot control method performed by at least one processor, including steps of receiving a user utterance, adding the user utterance to a prompt including an instruction sentence related to an explanation of a chatbot character, encoding the prompt, and inputting the encoded prompt into a language model to generate a chatbot utterance as a response to the user utterance.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] Currently, the decline in the reliability of information on the Internet and the increase in cyberattacks have become serious problems, and a prompt and effective response is required. However, it is difficult for users themselves to judge the authenticity and security of information, and they often do not know appropriate countermeasures. Therefore, there is a need for a system that provides a safe and reliable Internet environment and improves users' information literacy.

Means for Solving the Problems

[0005] The present invention includes data formatting means for collecting data from a network in real time, preprocessing the collected data, and formatting it. Furthermore, it includes multimodal analysis means for analyzing the preprocessed data and detecting suspicious patterns using a natural language processing model and an image / video analysis model. Based on the results, it includes an anomaly detection means for detecting and scoring anomalies, and a warning notification means for notifying users of the detected anomalies. It also includes countermeasure suggestion means for presenting countermeasures to the user, and content provision means for providing educational content to improve information literacy based on the user's behavior history. In this way, the present invention helps users enjoy a safe and reliable internet environment.

[0006] A "network" is a system in which multiple computers and devices are interconnected to share data and communicate with each other.

[0007] "Data acquisition means" refers to a function or device for collecting necessary information or files from a network.

[0008] "Data formatting means" refers to a function that processes collected data into a format suitable for analysis, removing unnecessary parts and standardizing the format.

[0009] A "multimodal analysis method" is a function that analyzes multiple data formats, such as text, images, and videos, by combining them, thereby enabling the understanding of multidimensional information.

[0010] A "natural language processing model" refers to a system that uses algorithms and machine learning techniques to enable computers to understand and analyze human language.

[0011] An "image / video analysis model" is an algorithm or machine learning technique used to analyze image and video data and detect specific patterns or features.

[0012] An "anomaly detection method" is a function that automatically detects patterns that are different from the norm or unexpected behavior and notifies the user.

[0013] A "warning notification method" refers to a message or alert function that informs the user of detected potential problems or anomalies.

[0014] A "solution suggestion method" is a function that presents users with specific countermeasures or solutions for the detected problems.

[0015] "Content delivery means" refers to functions or systems that deliver useful information or educational materials to users.

[0016] "Information literacy" is the ability to select, evaluate, and utilize necessary information from a diverse range of sources. [Brief explanation of the drawing]

[0017] [Figure 1] This is a conceptual diagram showing an example of the configuration of a data processing system according to the first embodiment. [Figure 2] This is a conceptual diagram showing an example of the essential functions of a data processing device and a smart device according to the first embodiment. [Figure 3] This is a conceptual diagram showing an example of the configuration of a data processing system according to the second embodiment. [Figure 4] This is a conceptual diagram showing an example of the main functions of a data processing device and smart glasses according to the second embodiment. [Figure 5] This is a conceptual diagram showing an example of the configuration of a data processing system according to the third embodiment. [Figure 6] This is a conceptual diagram showing an example of the main functions of a data processing device and a headset-type terminal according to the third embodiment. [Figure 7] This is a conceptual diagram showing an example of the configuration of a data processing system according to the fourth embodiment. [Figure 8] This is a conceptual diagram showing an example of the main functions of a data processing device and a robot according to the fourth embodiment. [Figure 9] Shows an emotion map to which a plurality of emotions are mapped. [Figure 10] Shows an emotion map to which a plurality of emotions are mapped. [Figure 11] It is a sequence diagram showing the processing flow of the data processing system in Example 1. [Figure 12] It is a sequence diagram showing the processing flow of the data processing system in Application Example 1. [Figure 13] It is a sequence diagram showing the processing flow of the data processing system in Example 2 when an emotion engine is combined. [Figure 14] It is a sequence diagram showing the processing flow of the data processing system in Application Example 2 when an emotion engine is combined.

Mode for Carrying Out the Invention

[0018] Hereinafter, an example of an embodiment of a system according to the technology of the present disclosure will be described with reference to the accompanying drawings.

[0019] First, the terms used in the following description will be described.

[0020] In the following embodiments, a processor with a reference number (hereinafter simply referred to as "processor") may be a single arithmetic unit or a combination of a plurality of arithmetic units. Also, the processor may be a single type of arithmetic unit or a combination of a plurality of types of arithmetic units. Examples of arithmetic units include a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), a GPGPU (General-Purpose computing on Graphics Processing Units), an APU (Accelerated Processing Unit), and the like.

[0021] In the following embodiments, signed RAM (Random Access Memory) is a memory that temporarily stores information and is used as work memory by the processor.

[0022] In the following embodiments, the signed storage is one or more non-volatile storage devices that store various programs and various parameters. Examples of non-volatile storage devices include flash memory (SSD (Solid State Drive)), magnetic disks (e.g., hard disks), or magnetic tapes.

[0023] In the following embodiments, the signed communication interface (I / F) is an interface that includes a communication processor and an antenna, etc. The communication interface manages communication between multiple computers. Examples of communication standards applicable to the communication interface include wireless communication standards such as 5G (5th Generation Mobile Communication System), Wi-Fi (registered trademark), or Bluetooth (registered trademark).

[0024] In the following embodiments, "A and / or B" is synonymous with "at least one of A and B." That is, "A and / or B" means that it may be A alone, or B alone, or a combination of A and B. Furthermore, in this specification, the same concept as "A and / or B" applies when expressing three or more things linked by "and / or."

[0025] [First Embodiment]

[0026] Figure 1 shows an example of the configuration of the data processing system 10 according to the first embodiment.

[0027] As shown in Figure 1, the data processing system 10 includes a data processing device 12 and a smart device 14. An example of the data processing device 12 is a server.

[0028] The data processing device 12 comprises a computer 22, a database 24, and a communication interface 26. The computer 22 is an example of a "computer" related to the technology of this disclosure. The computer 22 comprises a processor 28, RAM 30, and storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication interface 26 are also connected to the bus 34. The communication interface 26 is connected to a network 54. An example of the network 54 is a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0029] The smart device 14 comprises a computer 36, a reception device 38, an output device 40, a camera 42, and a communication interface 44. The computer 36 comprises a processor 46, RAM 48, and storage 50. The processor 46, RAM 48, and storage 50 are connected to a bus 52. The reception device 38, output device 40, and camera 42 are also connected to the bus 52.

[0030] The reception device 38 is equipped with a touch panel 38A and a microphone 38B, etc., and receives user input. The touch panel 38A receives user input by detecting contact with an object (e.g., a pen or finger). The microphone 38B receives user input by detecting the user's voice. The control unit 46A transmits data indicating the user input received by the touch panel 38A and microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the data indicating the user input.

[0031] The output device 40 includes a display 40A and a speaker 40B, and presents data to the user 20 by outputting the data in a form perceptible to the user 20 (e.g., audio and / or text). The display 40A displays visible information such as text and images according to instructions from the processor 46. The speaker 40B outputs audio according to instructions from the processor 46. The camera 42 is a small digital camera equipped with an optical system such as a lens, aperture, and shutter, and an image sensor such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor.

[0032] Communication interface 44 is connected to network 54. Communication interfaces 44 and 26 are responsible for the exchange of various types of information between processor 46 and processor 28 via network 54.

[0033] Figure 2 shows an example of the main functions of the data processing device 12 and the smart device 14.

[0034] As shown in Figure 2, in the data processing device 12, a specific processing is performed by the processor 28. A specific processing program 56 is stored in the storage 32. The specific processing program 56 is an example of a "program" related to the technology of this disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 according to the specific processing program 56 executed on the RAM 30.

[0035] The storage 32 stores the data generation model 58 and the emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0036] In the smart device 14, the processor 46 performs the reception output processing. The storage 50 stores the reception output program 60. The reception output program 60 is used in conjunction with a specific processing program 56 by the data processing system 10. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output processing is realized by the processor 46 operating as a control unit 46A according to the reception output program 60 executed on the RAM 48.

[0037] Next, the specific processing performed by the specific processing unit 290 of the data processing device 12 will be described. In the following description, the data processing device 12 will be referred to as the "server" and the smart device 14 as the "terminal".

[0038] To implement the present invention, the following system configuration is necessary. The main components are a server, a terminal, and their respective functions.

[0039] The server collects data in various media formats from the network in real time. This collected data includes text obtained from web pages, content from social media and emails, images, and videos. The server receives this data and first performs preprocessing. Text data is processed to remove unnecessary information and to ensure a consistent format. Images and videos are processed to adjust resolution and reduce noise.

[0040] The preprocessed data is analyzed using the server's multimodal analysis technology. Specifically, a natural language processing model analyzes the text data to recognize specific keywords and patterns. For images and videos, a dedicated analysis model is used to detect visual features and identify signs of phishing or malware.

[0041] Once the analysis is complete, the server calculates an anomaly score and detects potential risks based on the result and score. If a risk is detected, a warning is sent to the terminal in real time. At this time, the terminal displays a warning message to the user, informing them of the danger, for example, "This may be a phishing email."

[0042] Users can choose their actions based on warnings displayed on their devices; for example, they can check for safe links or block senders according to the suggested countermeasures. Furthermore, the server generates and provides appropriate educational content based on the user's browsing history. This helps users improve their information literacy and mitigate future online risks.

[0043] For example, if a user receives a suspicious email, the server analyzes it, checks for potential phishing attempts, and then sends a signal to the user's device. The device then displays a warning and further advises the user not to click on any links. In this way, the system aims to continuously support users and provide a safe and reliable internet environment.

[0044] The following describes the processing flow.

[0045] Step 1:

[0046] The server collects text, image, and video data in real time from various data sources on the network, including web pages, social media, and email.

[0047] Step 2:

[0048] The server preprocesses the collected data. Specifically, it removes unnecessary information from text data and standardizes the format. It also adjusts the resolution and reduces noise in images and videos.

[0049] Step 3:

[0050] The server analyzes the pre-processed data. It uses natural language processing models to analyze text data and extract specific keywords and patterns. In addition, it uses image and video analysis models to identify visual features.

[0051] Step 4:

[0052] The server calculates an anomaly score based on the analysis results. The score indicates the possibility of cyberattacks or misinformation, and anomalies are detected based on this score.

[0053] Step 5:

[0054] If an anomaly is detected, the server sends a warning notification to the terminal. The terminal displays a warning to the user, such as "This link may be a phishing link."

[0055] Step 6:

[0056] The device will present the user with specific countermeasures based on the detected anomaly. For example, it may recommend actions such as not clicking on links or blocking the sender.

[0057] Step 7:

[0058] The server generates educational content based on the user's behavioral history. The device then provides this content to the user, helping to improve their information literacy.

[0059] (Example 1)

[0060] Next, we will describe Example 1. In the following description, the data processing device 12 will be referred to as the "server," and the smart device 14 will be referred to as the "terminal."

[0061] In today's internet environment, it is necessary to effectively and quickly assess the security of data collected in real time from diverse sources and protect users from harmful content and attacks. A system is needed to ensure the security of such information and improve users' information literacy.

[0062] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 1 is realized by the following means.

[0063] In this invention, the server includes information acquisition means for collecting information from a network in real time, information formatting means for preprocessing the collected information and formatting it into a unified format, and analysis means for analyzing the preprocessed information and detecting suspicious patterns. This enables the provision of rapid warnings and educational materials to users.

[0064] "Information acquisition means" refers to means that have the function of collecting diverse information in real time from a network.

[0065] "Information formatting means" refers to means that have the function of pre-processing collected information and formatting it into a unified format.

[0066] "Analysis means" refers to means that have the function of analyzing pre-processed information to detect suspicious patterns or features.

[0067] An "anomaly detection means" is a means that has the function of evaluating anomalies based on analysis results and detecting them.

[0068] A "notification means" is a means that has the function of sending a warning to an information device in real time based on the detected anomaly.

[0069] A "means for presenting solutions" refers to a means that has the function of presenting specific countermeasures or proposed solutions to the user.

[0070] "Means of providing materials" refers to means that have the function of providing educational materials aimed at improving users' digital literacy.

[0071] "Material generation means" refers to means that have the function of generating educational materials based on the user's behavioral history.

[0072] To implement this invention, the server collects diverse information in real time via the network and deploys information acquisition means to all digital devices. The server acquires information in text, images, videos, and other media formats using various APIs and web crawlers.

[0073] The collected information is preprocessed by information formatting tools on the server. Here, regular expressions are used to filter out unnecessary parts of text information, and it is converted to a standard character encoding format. For images and videos, open-source media processing libraries are used to adjust the resolution and reduce noise.

[0074] The pre-processed information is further analyzed by analysis tools on the server. Natural language processing techniques (e.g., generative AI models) are used to analyze text information and extract important keywords and patterns. Images and videos are analyzed using deep learning models to determine whether they are suspected of being phishing or malware.

[0075] The analysis results are evaluated in real time by anomaly detection measures, and if an anomaly is detected, it is scored. Based on this anomaly score, the server immediately issues a warning to the terminal. The terminal has a function that displays a warning to the user via a notification mechanism, immediately notifying them that "this link may be unsafe."

[0076] Users can take appropriate action based on warnings displayed on their devices and have the option of not clicking on suspicious links by following safety measures. Furthermore, the server uses a material generation system to generate customized educational materials based on the user's behavioral history. These materials help users improve their digital literacy and provide information to effectively manage online risks.

[0077] For example, if a user receives a suspicious email, the server analyzes the email and calculates an anomaly score. If it is suspected to be a phishing attempt, a warning message saying "Be careful with this email" will be displayed on the device in real time.

[0078] As an example of a prompt, the user can enter "Is this email a phishing attempt?" to help the generating AI model perform a more detailed analysis.

[0079] The flow of the specific processing in Example 1 will be explained using Figure 11.

[0080] Step 1:

[0081] The server collects information from the network. Specifically, it uses web crawling technology and APIs to obtain data in digital media formats such as text, images, and videos. The input is a specified URL or API endpoint, and the output is raw, unprocessed data. This raw data forms the basis for subsequent processing.

[0082] Step 2:

[0083] The server preprocesses the collected data. For text data, it uses regular expressions to filter out unnecessary elements and converts it to a standard character encoding. Images and videos are processed using a viral processing library for resolution adjustment and noise reduction. The input is raw data, and the output is formatted data. This formatted data is then prepared for analysis.

[0084] Step 3:

[0085] The server analyzes pre-processed data. It uses natural language processing techniques to analyze text data and extract keywords and patterns. A generative AI model supports this process. For image and video data, deep learning techniques are used to detect and analyze visual features. The input is formatted data, and the output is an analysis result that checks for the presence or absence of specific patterns.

[0086] Step 4:

[0087] The server calculates an anomaly score based on the analysis results. It utilizes singular value decomposition and anomaly detection techniques to evaluate whether the data exceeds a threshold. The input is the analysis results, and the output is an anomaly score. This score helps identify potential risks.

[0088] Step 5:

[0089] The server issues a warning if the anomaly score exceeds a threshold. Specifically, it immediately sends a warning message to the terminal. The input is the anomaly score, and the output is a warning notification displayed on the terminal. This allows users to recognize potential dangers in real time.

[0090] Step 6:

[0091] The user selects the appropriate action based on the warning message displayed on their device. The input is the warning displayed on the device, and the output is the user's response. Specifically, the user may take actions such as avoiding links or blocking email senders based on the presented phishing suspicion information.

[0092] Step 7:

[0093] The server collects user activity history and generates educational materials. Using a material generation method, prompts are fed into a generation AI model to provide user-specific educational content. The input is the user's activity history, and the output is customized educational materials. This process aims to improve users' digital literacy.

[0094] (Application Example 1)

[0095] Next, we will explain Application Example 1. In the following explanation, the data processing device 12 will be referred to as the "server," and the smart device 14 will be referred to as the "terminal."

[0096] In recent years, with the rapid increase in the flow of information on networks, the risks of phishing and malware have risen. In this context, there is a need to detect suspicious digital content in real time, provide appropriate warnings to users, and create a safe internet environment. However, existing systems lack the ability to comprehensively analyze complex multimodal data and provide users with immediate, practical guidance. Therefore, there is a need to provide a system that uses more advanced analytical techniques to comprehensively detect anomalies, provide appropriate educational content, and protect users from malicious activity.

[0097] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 1 is realized by the following means.

[0098] In this invention, the server includes information acquisition means for collecting information from a network in real time, information formatting means for preprocessing and formatting the collected information, and dynamic analysis means for analyzing the digital content accessed by the user and evaluating its risks. This makes it possible to provide users with real-time guidance for improving safety and educational information for improving information literacy.

[0099] "Information acquisition means" refers to methods for collecting information in various media formats from a network in real time.

[0100] "Information formatting methods" refer to means of pre-processing collected information and adjusting it into a unified format.

[0101] A "multimodal analysis method" is a means of analyzing pre-processed information and detecting suspicious patterns from text and visual data.

[0102] An "anomaly detection method" is a means of detecting anomalies based on analysis results and scoring the likelihood of an anomaly occurring.

[0103] A "warning notification system" is a means of notifying users in real time of detected anomalies.

[0104] A "safety guideline presentation method" is a means of presenting users with guidelines for improving safety based on detected anomalies.

[0105] "Information provision means" refers to means of providing users with educational information to improve their information literacy.

[0106] A "dynamic analysis method" is a means of analyzing the digital content accessed by users in real time and evaluating its risks.

[0107] To implement this invention, the involvement of a network, a server, and a user terminal is essential. The server is equipped with information acquisition means that collect information from the network in real time, and can collect information in various media formats from any network environment. This information is preprocessed by the server and converted into a unified format by information formatting means.

[0108] The server further analyzes the preprocessed information using multimodal analysis methods. It utilizes natural language processing models and visual data analysis models to detect suspicious patterns in text, images, and videos. Based on the analysis results, an anomaly detection method calculates an anomaly score, and based on this score, a warning notification method sends a warning to the user terminal.

[0109] Upon receiving a warning, the user's terminal displays safety guidelines provided by the server, prompting the user to take appropriate action. This allows the user to choose from options such as blocking the sender or not clicking the link, thus maintaining their safety. Furthermore, educational information aimed at improving information literacy is provided to the user through various information delivery methods. This information is customized based on the user's usage history.

[0110] Dynamic analysis tools analyze the digital content that users access in real time and assess its risks. This assessment provides an additional layer of security, allowing users to use the internet with peace of mind.

[0111] For example, if a user receives an email suspected of being a phishing attempt, the server analyzes the email's content to identify the possibility of phishing. The result is calculated as an anomaly score, and a warning is sent to the user's device. At the same time, the user is presented with a prompt to the generative AI model asking, "Please provide details about the algorithm used to identify phishing emails," and information is provided to aid in its understanding.

[0112] The flow of a specific process in Application Example 1 will be explained using Figure 12.

[0113] Step 1:

[0114] The server acquires information from the network in real time. It receives data from various sources such as web pages, social media, and emails as input, and outputs the acquired raw data. It utilizes various information acquisition methods to collect data in diverse formats.

[0115] Step 2:

[0116] The server preprocesses the acquired raw data and converts it into a unified format using information formatting tools. This process removes data noise and unnecessary text information. The input is the acquired raw data, and the output is formatted, clean data.

[0117] Step 3:

[0118] The server analyzes formatted, clean data using multimodal analysis methods. In this process, a natural language processing model extracts keywords and patterns from text data, and a visual data analysis model detects features in images and videos. It receives clean data as input and outputs the analysis results.

[0119] Step 4:

[0120] The server calculates an anomaly score using an anomaly detection mechanism based on the analysis results. The analysis results are used as input, and an anomaly score, which is a numerical value indicating the possibility of an anomaly, is output. Based on this score, the server performs actions to identify suspicious content.

[0121] Step 5:

[0122] The server sends a warning to the user terminal via a warning notification mechanism if the anomaly score exceeds a certain threshold. Information regarding the warning is input, and a warning message for user notification is output. A specific warning message is generated to inform the user of the danger.

[0123] Step 6:

[0124] When the user terminal receives a warning from the server, it displays safety guidelines on the screen and presents the user with appropriate action suggestions. The warning message is input, and the suggested guidelines and suggestions are output.

[0125] Step 7:

[0126] The user terminal provides educational information using information delivery tools to promote improved information literacy. The user's behavioral history is used as input, and educational content is output. As a specific example, the prompt "Please tell me the details of the algorithm used to identify phishing emails." is generated for the generating AI model and presented to the user.

[0127] Furthermore, an emotion engine that estimates the user's emotions may be incorporated. That is, the identification processing unit 290 may use the emotion identification model 59 to estimate the user's emotions and perform identification processing using the user's emotions.

[0128] To implement the present invention, a system configuration including a server, terminals, and user interfaces is required. This system acquires data from the network in real time and then performs a series of analysis and notification processes.

[0129] The server collects text, image, and video data from multiple data sources and preprocesses them using data formatting tools. Next, it analyzes the data using a combination of natural language processing models and image / video analysis models to detect suspicious patterns. An anomaly score is calculated from the analysis results, and anomalies are detected based on this score.

[0130] Furthermore, the server is equipped with an emotion engine to recognize the user's emotions. The emotion engine analyzes the user's input data and infers their emotional state. Based on these results, the server outputs educational content and warning messages that are adapted to the user's emotions.

[0131] The terminal notifies the user of warnings and advice sent from the server. The warning notification system sends a signal to the user in real time when an anomaly is detected. It also adjusts the notification method according to the user's emotional state, for example, providing a concise message when the user is under stress.

[0132] Users can receive notifications from their devices, act according to the suggested countermeasures, and maintain online safety. Furthermore, educational content tailored by an emotion engine can improve information literacy. This content is provided considering the user's past behavioral history and emotional state, thus offering more appropriate learning opportunities.

[0133] For example, if a user receives an email suspected of being a phishing attempt, the server detects it, and the emotion engine checks the user's calm emotional state before notifying them of detailed countermeasures. Conversely, if the user is feeling stressed, a simple warning is provided to encourage cautious action. This system aims to improve the user experience and support safe internet use.

[0134] The following describes the processing flow.

[0135] Step 1:

[0136] The server collects text, image, and video data from various data sources on the network. This includes information from web pages, social media, emails, and other sources.

[0137] Step 2:

[0138] The server preprocesses the collected data, removing unnecessary characters from text and standardizing the resolution of images and videos to reduce noise. This formats the data so that it is suitable for analysis.

[0139] Step 3:

[0140] The server analyzes the formatted data. It uses natural language processing models to analyze important keywords and context in the text, and image / video analysis models to extract visual features and identify suspicious patterns.

[0141] Step 4:

[0142] The server calculates an anomaly score based on the analysis results. Based on the calculated score, it determines the risk of phishing or malware, and may identify it as an anomaly.

[0143] Step 5:

[0144] The server uses an emotion engine to recognize the user's emotional state from user input data, such as keyboard input speed and mouse movements. The emotion engine infers the user's current emotions and optimizes notification content along with any anomaly detection results.

[0145] Step 6:

[0146] The server sends a warning and suggested countermeasures to the terminal. The terminal displays the received information to the user as a warning, for example, a message such as "This email may be a phishing attempt."

[0147] Step 7:

[0148] The device uses the results of its emotion engine to select appropriate actions and notification methods tailored to the user's emotions. For example, in a highly stressed state, it might offer simple action suggestions.

[0149] Step 8:

[0150] The server considers the user's usual behavioral history and emotional state to generate appropriate educational content. The device then delivers this content to the user, supporting the improvement of their information literacy.

[0151] Through these steps, the system aims to provide users with a secure internet environment and support the improvement of their information literacy.

[0152] (Example 2)

[0153] Next, we will describe Example 2. In the following description, the data processing device 12 will be referred to as the "server" and the smart device 14 as the "terminal".

[0154] In today's information society, users find it difficult to select and access information safely from a vast amount of data. Furthermore, judging the reliability of information and responding appropriately requires a high level of information technology understanding, but not all users possess the same level of literacy. Moreover, given that users' emotions influence their responses to information, it is necessary to implement appropriate measures that take these emotions into consideration. To address these challenges, there is a need for systems that allow users to enjoy a safe and comfortable information environment.

[0155] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 2 is realized by the following means.

[0156] In this invention, the server includes information acquisition means for collecting information from a network in real time, data formatting means for preprocessing and shaping the collected information, various modal analysis means for analyzing the preprocessed information and detecting suspicious patterns, anomaly detection means for detecting and evaluating anomalies, and emotion recognition means for recognizing emotional states and generating messages adapted to those states. This makes it possible to provide safe and reliable access to information and educational content tailored to individual users, while taking into account the emotional state of the user.

[0157] "Information acquisition means" refers to the components used to collect information in real time from a network.

[0158] A "data formatting means" is a configuration that has the function of pre-processing and formatting collected information.

[0159] "Diverse modal analysis methods" refer to techniques for analyzing different types of data and detecting suspicious patterns.

[0160] An "anomaly detection method" is a system that evaluates and detects anomalies in data based on the analysis results.

[0161] A "warning mechanism" is a method used to communicate a warning to users about detected anomalies.

[0162] "Methods for presenting countermeasures" refers to the process of presenting appropriate countermeasures to users.

[0163] "Content delivery means" refers to components that provide educational content to improve users' understanding of information technology.

[0164] "Emotion recognition means" refers to technology that analyzes a user's emotional state and generates information or messages that are adapted to that state.

[0165] This invention is a system designed to provide users with an environment in which they can use information with peace of mind. The configuration and operation of this system are described in detail below.

[0166] The server first activates its information acquisition mechanisms to collect information from the network in real time. This process automatically aggregates data from various sources using a streaming platform. Next, the collected information is pre-processed using data formatting mechanisms, including tokenization of text data and noise reduction. This ensures information consistency and facilitates analysis.

[0167] The analysis utilizes a variety of modal analysis methods. In this process, a general-purpose model is used for text analysis as a natural language processing model, while a general image recognition model is used for image and video data. Based on the analysis results, an anomaly detection method evaluates suspicious patterns and activities, and calculates an anomaly score. Based on this information, an emotion recognition method analyzes the user's emotional state, and messages and educational content are generated accordingly.

[0168] The device's role is to notify users of warnings and advice sent from the server. Information is communicated to users via push notifications and in-app messages, prompting appropriate responses based on their emotional state. This process ensures that information is presented in an easily understandable format, even when users are experiencing stress.

[0169] Users can receive notifications from their devices, immediately understand the necessary countermeasures, and decide on the actions they should take. They can also deepen their understanding of information technology through emotionally-based educational content. For example, when a phishing email is detected, the server selects and notifies the user of detailed countermeasures or a concise warning message based on their emotional state. An example of a prompt might be, "Analyze the potential threats hidden in the message received by the user and generate a customized warning message based on the emotional recognition results."

[0170] This system aims to provide a safe and reserved information access environment while taking into consideration the feelings of users.

[0171] The flow of the specific processing in Example 2 will be explained using Figure 13.

[0172] Step 1:

[0173] The server collects data from multiple sources on the network. It uses streaming services to acquire text, images, and video data in real time. The input consists of data from a large number of unspecified sources, which is then output as structured data.

[0174] Step 2:

[0175] The server uses data formatting techniques to properly process the collected data. Specifically, it tokenizes text using a natural language processing library and removes unnecessary information. Image and video data are resized and denoised using conversion tools. The input is the raw data acquired in step 1, and after processing, it is output as analyzable, formatted data.

[0176] Step 3:

[0177] The server analyzes the formatted data using various modal analysis methods. Specifically, it performs text analysis using a natural language processing model commonly used as a generative AI model, and extracts features from images and videos using an image recognition model. The input is the formatted data obtained in step 2, and the output is suspicious patterns and anomaly scores.

[0178] Step 4:

[0179] The server evaluates anomalies using anomaly detection means based on the analysis results and estimates the user's emotional state using emotion recognition means. The input is the analysis results from step 3, and the output is information on the presence or absence of anomalies, anomaly scores, and the user's emotional state. This allows for the customization of warnings and educational content.

[0180] Step 5:

[0181] The device notifies the user of warnings and advice sent from the server. This process uses push notifications and in-app messages, and the information is presented appropriately based on the user's emotional state. The input is the anomaly information and emotional data generated in step 4, and the output is a customized notification message displayed on the screen.

[0182] Step 6:

[0183] Users can receive notifications from their devices and take action based on the suggested solutions. They can also deepen their understanding of information technology through educational content. The input is the message received in step 5, and the output is the result of the user's specific actions and skill improvement.

[0184] (Application Example 2)

[0185] Next, we will explain application example 2. In the following explanation, the data processing device 12 will be referred to as a "server" and the smart device 14 as a "terminal".

[0186] In today's information-saturated society, the information users receive includes risks such as phishing scams and misinformation. However, there is a lack of systems that can accurately and quickly detect these threats and provide appropriate responses tailored to the user's emotional state. Furthermore, improving users' information literacy to enable them to act safely is also a crucial challenge.

[0187] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means.

[0188] In this invention, the server includes data acquisition means for collecting data from the network in real time, data formatting means for preprocessing and formatting the collected data, and anomaly detection means for detecting and scoring anomalies based on the analysis results. This makes it possible to provide flexible notifications and learning opportunities based on the user's emotional state.

[0189] A "data acquisition method" is a mechanism that collects diverse information in real time via a network.

[0190] "Data formatting methods" refer to the processes of converting and formatting collected data into a format that is easy to analyze.

[0191] A "multimodal analysis method" is a mechanism for simultaneously analyzing multiple data formats (text, images, videos, etc.) to identify suspicious patterns.

[0192] An "anomaly detection method" is a process for detecting abnormal behaviors and patterns from analyzed data and assigning scores to them.

[0193] A "warning notification system" is a mechanism that provides warnings in a manner appropriate to the user's emotional state in response to detected anomalies.

[0194] A "means of presenting countermeasures" is a mechanism that shows users specific countermeasures for abnormalities or dangers, and adjusts the content according to their emotions.

[0195] "Content delivery means" refers to a function that provides educational content to improve information literacy in accordance with the user's emotional state and past behavioral history.

[0196] An "emotion engine" is a model or algorithm that analyzes user input data to infer the user's current emotional state.

[0197] To implement this invention, a system integrating a server, terminal, and user interface is required. The server collects text, image, and video data in real time from multiple data sources via a network. This data is preprocessed by data formatting means, and suspicious patterns are analyzed using natural language processing models and image / video analysis models. The server calculates an anomaly score and identifies potential threats to the user using anomaly detection means.

[0198] Furthermore, an emotion engine is used to analyze the user's emotional state from their input, and based on the results, it generates warning messages and educational content appropriate to the user's situation. The device receives notifications sent from the server and issues warnings in the most appropriate format corresponding to the user's emotional state. For example, if the user is relaxed, it provides detailed countermeasures, while if they are stressed, it provides a simple warning.

[0199] For example, when a user receives a phishing email, the server analyzes the email's suspicious characteristics and detects an anomaly. The sentiment engine assesses whether the user is calm, and if it confirms that the user is calm, it notifies the device with detailed countermeasures.

[0200] An example of a prompt message is, "Generate a notification message that effectively warns of emails that have been identified as potentially phishing scams."

[0201] These features are implemented as applications that run on the user's device, and are realized using software tools such as Python, TENSORFLOW®, and an emotion recognition API. This system allows users to obtain necessary information safely and efficiently, improving safety in online activities.

[0202] The flow of a specific process in Application Example 2 will be explained using Figure 14.

[0203] Step 1:

[0204] The server collects data from the network in real time. It receives text, image, and video data from the internet as input and collects it using data acquisition methods. The output is a set of pre-processed data. Specifically, it accesses each data source via an API and downloads the data.

[0205] Step 2:

[0206] The server preprocesses the collected data using data formatting tools to prepare the format. The raw data collected in the previous step is used as input, and data in a format suitable for analysis is generated as output. This includes specific actions such as data cleaning and format conversion.

[0207] Step 3:

[0208] The server analyzes pre-processed data using natural language processing models and image / video analysis models. It uses formatted data as input and outputs analysis results that highlight suspicious patterns. The specific operations to run the models involve calculations using Python and TensorFlow.

[0209] Step 4:

[0210] The server detects anomalies based on the analysis results and calculates an anomaly score. The input is the analysis results of the model, and the output is anomaly information accompanied by an anomaly score. Specifically, it uses a scoring algorithm to quantify the degree of anomaly.

[0211] Step 5:

[0212] The server uses an emotion engine to infer the user's emotional state from their input data. The user's recent actions and input data are used as input, and the output is information indicating their emotional state. The specific operation involves data analysis using an emotion recognition API.

[0213] Step 6:

[0214] The terminal receives anomaly information and emotional state information from the server and delivers warnings to the user. Using the received information as input, a customized warning message for the user is generated as output. Specific actions include displaying the message to the user using a notification API.

[0215] Step 7:

[0216] The device presents the user with suggested solutions and provides educational content to improve information literacy based on their emotional state. Input consists of solutions and educational content sent from the server, while output is information displayed on the user's screen. Specific operations include rendering content on a graphical user interface (GUI).

[0217] The specific processing unit 290 transmits the result of the specific processing to the smart device 14. In the smart device 14, the control unit 46A causes the output device 40 to output the result of the specific processing. The microphone 38B acquires audio indicating user input for the result of the specific processing. The control unit 46A transmits the audio data indicating user input acquired by the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0218] Data generation model 58 is a so-called generative AI (Artificial Intelligence). An example of data generation model 58 is ChatGPT (registered trademark) (Internet search).<URL: https: / / openai.com / blog / chatgpt> ), Gemini (registered trademark) (Internet search) <url: https: gemini.google.com ?hl="ja">Examples of generative AI include the following. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 is input with prompts containing instructions, and with inference data such as audio data representing speech, text data representing text, and image data representing images. The data generation model 58 infers from the input inference data according to the instructions indicated by the prompts, and outputs the inference results in data formats such as audio data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0219] In the above embodiment, an example was given in which specific processing is performed by the data processing device 12, but the technology of this disclosure is not limited thereto, and the specific processing may also be performed by the smart device 14.

[0220] [Second Embodiment]

[0221] Figure 3 shows an example of the configuration of the data processing system 210 according to the second embodiment.

[0222] As shown in Figure 3, the data processing system 210 includes a data processing device 12 and smart glasses 214. An example of the data processing device 12 is a server.

[0223] The data processing device 12 comprises a computer 22, a database 24, and a communication interface 26. The computer 22 is an example of a "computer" related to the technology of this disclosure. The computer 22 comprises a processor 28, RAM 30, and storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication interface 26 are also connected to the bus 34. The communication interface 26 is connected to a network 54. An example of the network 54 is a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0224] The smart glasses 214 include a computer 36, a microphone 238, a speaker 240, a camera 42, and a communication interface 44. The computer 36 includes a processor 46, RAM 48, and storage 50. The processor 46, RAM 48, and storage 50 are connected to a bus 52. The microphone 238, speaker 240, and camera 42 are also connected to the bus 52.

[0225] The microphone 238 receives voice signals from the user 20 and receives instructions from the user 20. The microphone 238 captures the voice signals from the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to the instructions from the processor 46.

[0226] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an image sensor such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the area around the user 20 (for example, an imaging range defined by a field of view equivalent to the width of a typical healthy person's field of vision).

[0227] Communication interface 44 is connected to network 54. Communication interfaces 44 and 26 are responsible for the exchange of various information between processor 46 and processor 28 via network 54. The exchange of various information between processor 46 and processor 28 using communication interfaces 44 and 26 is performed in a secure manner.

[0228] Figure 4 shows an example of the main functions of the data processing device 12 and the smart glasses 214. As shown in Figure 4, the data processing device 12 performs specific processing using the processor 28. The storage 32 stores the specific processing program 56.

[0229] The specific processing program 56 is an example of a "program" relating to the technology of this disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0230] The storage 32 stores the data generation model 58 and the emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0231] In the smart glasses 214, the processor 46 performs the reception output processing. The storage 50 stores the reception output program 60. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output processing is realized by the processor 46 operating as a control unit 46A according to the reception output program 60 executed on the RAM 48.

[0232] Next, the identification processing performed by the identification processing unit 290 of the data processing device 12 will be described. In the following description, the data processing device 12 will be referred to as the "server" and the smart glasses 214 will be referred to as the "terminal".

[0233] To implement the present invention, the following system configuration is necessary. The main components are a server, a terminal, and their respective functions.

[0234] The server collects data in various media formats from the network in real time. This collected data includes text obtained from web pages, content from social media and emails, images, and videos. The server receives this data and first performs preprocessing. Text data is processed to remove unnecessary information and to ensure a consistent format. Images and videos are processed to adjust resolution and reduce noise.

[0235] The preprocessed data is analyzed using the server's multimodal analysis technology. Specifically, a natural language processing model analyzes the text data to recognize specific keywords and patterns. For images and videos, a dedicated analysis model is used to detect visual features and identify signs of phishing or malware.

[0236] Once the analysis is complete, the server calculates an anomaly score and detects potential risks based on the result and score. If a risk is detected, a warning is sent to the terminal in real time. At this time, the terminal displays a warning message to the user, informing them of the danger, for example, "This may be a phishing email."

[0237] Users can choose their actions based on warnings displayed on their devices; for example, they can check for safe links or block senders according to the suggested countermeasures. Furthermore, the server generates and provides appropriate educational content based on the user's browsing history. This helps users improve their information literacy and mitigate future online risks.

[0238] For example, if a user receives a suspicious email, the server analyzes it, checks for potential phishing attempts, and then sends a signal to the user's device. The device then displays a warning and further advises the user not to click on any links. In this way, the system aims to continuously support users and provide a safe and reliable internet environment.

[0239] The following describes the processing flow.

[0240] Step 1:

[0241] The server collects text, image, and video data in real time from various data sources on the network, including web pages, social media, and email.

[0242] Step 2:

[0243] The server preprocesses the collected data. Specifically, it removes unnecessary information from text data and standardizes the format. It also adjusts the resolution and reduces noise in images and videos.

[0244] Step 3:

[0245] The server analyzes the pre-processed data. It uses natural language processing models to analyze text data and extract specific keywords and patterns. In addition, it uses image and video analysis models to identify visual features.

[0246] Step 4:

[0247] The server calculates an anomaly score based on the analysis results. The score indicates the possibility of cyberattacks or misinformation, and anomalies are detected based on this score.

[0248] Step 5:

[0249] If an anomaly is detected, the server sends a warning notification to the terminal. The terminal displays a warning to the user, such as "This link may be a phishing link."

[0250] Step 6:

[0251] The device will present the user with specific countermeasures based on the detected anomaly. For example, it may recommend actions such as not clicking on links or blocking the sender.

[0252] Step 7:

[0253] The server generates educational content based on the user's behavioral history. The device then provides this content to the user, helping to improve their information literacy.

[0254] (Example 1)

[0255] Next, we will describe Example 1. In the following description, the data processing device 12 will be referred to as the "server" and the smart glasses 214 will be referred to as the "terminal".

[0256] In today's internet environment, it is necessary to effectively and quickly assess the security of data collected in real time from diverse sources and protect users from harmful content and attacks. A system is needed to ensure the security of such information and improve users' information literacy.

[0257] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 1 is realized by the following means.

[0258] In this invention, the server includes information acquisition means for collecting information from a network in real time, information formatting means for preprocessing the collected information and formatting it into a unified format, and analysis means for analyzing the preprocessed information and detecting suspicious patterns. This enables the provision of rapid warnings and educational materials to users.

[0259] "Information acquisition means" refers to means that have the function of collecting diverse information in real time from a network.

[0260] "Information formatting means" refers to means that have the function of pre-processing collected information and formatting it into a unified format.

[0261] "Analysis means" refers to means that have the function of analyzing pre-processed information to detect suspicious patterns or features.

[0262] An "anomaly detection means" is a means that has the function of evaluating anomalies based on analysis results and detecting them.

[0263] A "notification means" is a means that has the function of sending a warning to an information device in real time based on the detected anomaly.

[0264] A "means for presenting solutions" refers to a means that has the function of presenting specific countermeasures or proposed solutions to the user.

[0265] "Means of providing materials" refers to means that have the function of providing educational materials aimed at improving users' digital literacy.

[0266] "Material generation means" refers to means that have the function of generating educational materials based on the user's behavioral history.

[0267] To implement this invention, the server collects diverse information in real time via the network and deploys information acquisition means to all digital devices. The server acquires information in text, images, videos, and other media formats using various APIs and web crawlers.

[0268] The collected information is preprocessed by information formatting tools on the server. Here, regular expressions are used to filter out unnecessary parts of text information, and it is converted to a standard character encoding format. For images and videos, open-source media processing libraries are used to adjust the resolution and reduce noise.

[0269] The pre-processed information is further analyzed by analysis tools on the server. Natural language processing techniques (e.g., generative AI models) are used to analyze text information and extract important keywords and patterns. Images and videos are analyzed using deep learning models to determine whether they are suspected of being phishing or malware.

[0270] The analysis results are evaluated in real time by anomaly detection measures, and if an anomaly is detected, it is scored. Based on this anomaly score, the server immediately issues a warning to the terminal. The terminal has a function that displays a warning to the user via a notification mechanism, immediately notifying them that "this link may be unsafe."

[0271] Users can take appropriate action based on warnings displayed on their devices and have the option of not clicking on suspicious links by following safety measures. Furthermore, the server uses a material generation system to generate customized educational materials based on the user's behavioral history. These materials help users improve their digital literacy and provide information to effectively manage online risks.

[0272] For example, if a user receives a suspicious email, the server analyzes the email and calculates an anomaly score. If it is suspected to be a phishing attempt, a warning message saying "Be careful with this email" will be displayed on the device in real time.

[0273] As an example of a prompt, the user can enter "Is this email a phishing attempt?" to help the generating AI model perform a more detailed analysis.

[0274] The flow of the specific processing in Example 1 will be explained using Figure 11.

[0275] Step 1:

[0276] The server collects information from the network. Specifically, it uses web crawling technology and APIs to obtain data in digital media formats such as text, images, and videos. The input is a specified URL or API endpoint, and the output is raw, unprocessed data. This raw data forms the basis for subsequent processing.

[0277] Step 2:

[0278] The server preprocesses the collected data. In the case of text data, regular expressions are used to filter out unnecessary components and convert it to the standard character encoding. For images and videos, resolution adjustment and noise removal are performed using a bilateral processing library. The input is raw data, and the output is formatted data. This formatted data is prepared in a form suitable for analysis.

[0279] Step 3:

[0280] The server analyzes the preprocessed data. It uses natural language processing techniques to analyze text data and extract keywords and patterns. A generative AI model supports this process. For image and video data, deep learning techniques are used to detect and analyze visual features. The input is formatted data, and the output is an analysis result that confirms the presence or absence of specific patterns.

[0281] Step 4:

[0282] The server calculates an anomaly score based on the analysis result. It makes full use of singular value decomposition and anomaly detection techniques to evaluate whether the data exceeds a threshold. The input is the analysis result, and the output is the generated anomaly score. Potential risks are discriminated based on this score.

[0283] Step 5:

[0284] When the anomaly score exceeds the threshold, the server issues a warning. Specifically, it immediately sends a warning message to the terminal. The input is the anomaly score, and the output is a warning notification displayed on the terminal. This enables the user to recognize the potential risk in real time.

[0285] Step 6:

[0286] Based on the warning message displayed on the terminal, the user selects an appropriate response. The input is the warning display from the terminal, and the output is the user's response action. Specifically, operations such as avoiding links or blocking the email sender are executed according to the presented phishing suspicion information.

[0287] Step 7:

[0288] The server collects the user's behavior history and generates educational materials. By using the material generation means, a prompt sentence is input into the generation AI model to provide educational content tailored to the user. The input is the user's behavior history, and the output is the customized educational materials generated. Through this process, the digital literacy of the user can be improved.

[0289] (Application Example 1)

[0290] Next, Application Example 1 will be described. In the following description, the data processing device 12 is referred to as the "server", and the smart glasses 214 are referred to as the "terminal".

[0291] In recent years, with the rapid increase in the flow of information on the network, the risks of phishing and malware have been increasing. In such a situation, it is required to detect suspicious digital content in real time, provide appropriate warnings to users, and realize a safe Internet environment. However, existing systems lack the ability to comprehensively analyze complex multimodal data and promptly present practical guidelines to users. Therefore, it is necessary to provide a system that uses more advanced analysis techniques to comprehensively detect anomalies, provide appropriate educational content, and protect users from illegal acts.

[0292] The specific processing by the specific processing unit 290 of the data processing device 12 in Application Example 1 is realized by the following means.

[0293] In this invention, the server includes information acquisition means for collecting information from a network in real time, information formatting means for preprocessing and formatting the collected information, and dynamic analysis means for analyzing the digital content accessed by the user and evaluating its risks. This makes it possible to provide users with real-time guidance for improving safety and educational information for improving information literacy.

[0294] "Information acquisition means" refers to methods for collecting information in various media formats from a network in real time.

[0295] "Information formatting methods" refer to means of pre-processing collected information and adjusting it into a unified format.

[0296] A "multimodal analysis method" is a means of analyzing pre-processed information and detecting suspicious patterns from text and visual data.

[0297] An "anomaly detection method" is a means of detecting anomalies based on analysis results and scoring the likelihood of an anomaly occurring.

[0298] A "warning notification system" is a means of notifying users in real time of detected anomalies.

[0299] A "safety guideline presentation method" is a means of presenting users with guidelines for improving safety based on detected anomalies.

[0300] "Information provision means" refers to means of providing users with educational information to improve their information literacy.

[0301] A "dynamic analysis method" is a means of analyzing the digital content accessed by users in real time and evaluating its risks.

[0302] To implement this invention, the involvement of a network, a server, and a user terminal is essential. The server is equipped with information acquisition means that collect information from the network in real time, and can collect information in various media formats from any network environment. This information is preprocessed by the server and converted into a unified format by information formatting means.

[0303] The server further analyzes the preprocessed information using multimodal analysis methods. It utilizes natural language processing models and visual data analysis models to detect suspicious patterns in text, images, and videos. Based on the analysis results, an anomaly detection method calculates an anomaly score, and based on this score, a warning notification method sends a warning to the user terminal.

[0304] Upon receiving a warning, the user's terminal displays safety guidelines provided by the server, prompting the user to take appropriate action. This allows the user to choose from options such as blocking the sender or not clicking the link, thus maintaining their safety. Furthermore, educational information aimed at improving information literacy is provided to the user through various information delivery methods. This information is customized based on the user's usage history.

[0305] Dynamic analysis tools analyze the digital content that users access in real time and assess its risks. This assessment provides an additional layer of security, allowing users to use the internet with peace of mind.

[0306] For example, if a user receives an email suspected of being a phishing attempt, the server analyzes the email's content to identify the possibility of phishing. The result is calculated as an anomaly score, and a warning is sent to the user's device. At the same time, the user is presented with a prompt to the generative AI model asking, "Please provide details about the algorithm used to identify phishing emails," and information is provided to aid in its understanding.

[0307] The flow of the specific process in Application Example 1 will be described using FIG. 12.

[0308] Step 1:

[0309] The server acquires information in real time from the network. As input, it receives data from various web pages, SNS, emails, etc., and outputs the acquired raw data. It performs an operation of collecting various forms of data by utilizing information acquisition means.

[0310] Step 2:

[0311] The server preprocesses the acquired raw data and converts it into a unified format using information formatting means. In this process, noise removal of data and deletion of redundant information in the text are performed. The input is the acquired raw data, and the output is the formatted clean data.

[0312] Step 3:

[0313] The server analyzes the formatted clean data using multimodal analysis means. In this process, the natural language processing model extracts keywords and patterns from the text data, and the visual data analysis model detects features of images and videos. As input, it receives clean data and outputs the analysis result.

[0314] Step 4:

[0315] The server calculates an anomaly score using anomaly detection means based on the analysis result. The analysis result is used as input, and an anomaly score as a numerical value indicating the possibility of an anomaly is output. Based on this score, an operation of identifying suspicious content is performed.

[0316] Step 5:

[0317] The server sends a warning to the user terminal via a warning notification mechanism if the anomaly score exceeds a certain threshold. Information regarding the warning is input, and a warning message for user notification is output. A specific warning message is generated to inform the user of the danger.

[0318] Step 6:

[0319] When the user terminal receives a warning from the server, it displays safety guidelines on the screen and presents the user with appropriate action suggestions. The warning message is input, and the suggested guidelines and suggestions are output.

[0320] Step 7:

[0321] The user terminal provides educational information using information delivery tools to promote improved information literacy. The user's behavioral history is used as input, and educational content is output. As a specific example, the prompt "Please tell me the details of the algorithm used to identify phishing emails." is generated for the generating AI model and presented to the user.

[0322] Furthermore, an emotion engine that estimates the user's emotions may be incorporated. That is, the identification processing unit 290 may use the emotion identification model 59 to estimate the user's emotions and perform identification processing using the user's emotions.

[0323] To implement the present invention, a system configuration including a server, terminals, and user interfaces is required. This system acquires data from the network in real time and then performs a series of analysis and notification processes.

[0324] The server collects text, image, and video data from multiple data sources and preprocesses them using data formatting tools. Next, it analyzes the data using a combination of natural language processing models and image / video analysis models to detect suspicious patterns. An anomaly score is calculated from the analysis results, and anomalies are detected based on this score.

[0325] Furthermore, the server is equipped with an emotion engine to recognize the user's emotions. The emotion engine analyzes the user's input data and infers their emotional state. Based on these results, the server outputs educational content and warning messages that are adapted to the user's emotions.

[0326] The terminal notifies the user of warnings and advice sent from the server. The warning notification system sends a signal to the user in real time when an anomaly is detected. It also adjusts the notification method according to the user's emotional state, for example, providing a concise message when the user is under stress.

[0327] Users can receive notifications from their devices, act according to the suggested countermeasures, and maintain online safety. Furthermore, educational content tailored by an emotion engine can improve information literacy. This content is provided considering the user's past behavioral history and emotional state, thus offering more appropriate learning opportunities.

[0328] For example, if a user receives an email suspected of being a phishing attempt, the server detects it, and the emotion engine checks the user's calm emotional state before notifying them of detailed countermeasures. Conversely, if the user is feeling stressed, a simple warning is provided to encourage cautious action. This system aims to improve the user experience and support safe internet use.

[0329] The following describes the processing flow.

[0330] Step 1:

[0331] The server collects text, image, and video data from various data sources on the network. This includes information from web pages, social media, emails, and other sources.

[0332] Step 2:

[0333] The server preprocesses the collected data, removing unnecessary characters from text and standardizing the resolution of images and videos to reduce noise. This formats the data so that it is suitable for analysis.

[0334] Step 3:

[0335] The server analyzes the formatted data. It uses natural language processing models to analyze important keywords and context in the text, and image / video analysis models to extract visual features and identify suspicious patterns.

[0336] Step 4:

[0337] The server calculates an anomaly score based on the analysis results. Based on the calculated score, it determines the risk of phishing or malware, and may identify it as an anomaly.

[0338] Step 5:

[0339] The server uses an emotion engine to recognize the user's emotional state from user input data, such as keyboard input speed and mouse movements. The emotion engine infers the user's current emotions and optimizes notification content along with any anomaly detection results.

[0340] Step 6:

[0341] The server sends a warning and suggested countermeasures to the terminal. The terminal displays the received information to the user as a warning, for example, a message such as "This email may be a phishing attempt."

[0342] Step 7:

[0343] The device uses the results of its emotion engine to select appropriate actions and notification methods tailored to the user's emotions. For example, in a highly stressed state, it might offer simple action suggestions.

[0344] Step 8:

[0345] The server considers the user's usual behavioral history and emotional state to generate appropriate educational content. The device then delivers this content to the user, supporting the improvement of their information literacy.

[0346] Through these steps, the system aims to provide users with a secure internet environment and support the improvement of their information literacy.

[0347] (Example 2)

[0348] Next, we will describe Example 2. In the following description, the data processing device 12 will be referred to as the "server" and the smart glasses 214 will be referred to as the "terminal".

[0349] In today's information society, users find it difficult to select and access information safely from a vast amount of data. Furthermore, judging the reliability of information and responding appropriately requires a high level of information technology understanding, but not all users possess the same level of literacy. Moreover, given that users' emotions influence their responses to information, it is necessary to implement appropriate measures that take these emotions into consideration. To address these challenges, there is a need for systems that allow users to enjoy a safe and comfortable information environment.

[0350] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 2 is realized by the following means.

[0351] In this invention, the server includes information acquisition means for collecting information from a network in real time, data formatting means for preprocessing and shaping the collected information, various modal analysis means for analyzing the preprocessed information and detecting suspicious patterns, anomaly detection means for detecting and evaluating anomalies, and emotion recognition means for recognizing emotional states and generating messages adapted to those states. This makes it possible to provide safe and reliable access to information and educational content tailored to individual users, while taking into account the emotional state of the user.

[0352] "Information acquisition means" refers to the components used to collect information in real time from a network.

[0353] A "data formatting means" is a configuration that has the function of pre-processing and formatting collected information.

[0354] "Diverse modal analysis methods" refer to techniques for analyzing different types of data and detecting suspicious patterns.

[0355] An "anomaly detection method" is a system that evaluates and detects anomalies in data based on the analysis results.

[0356] A "warning mechanism" is a method used to communicate a warning to users about detected anomalies.

[0357] "Methods for presenting countermeasures" refers to the process of presenting appropriate countermeasures to users.

[0358] "Content delivery means" refers to components that provide educational content to improve users' understanding of information technology.

[0359] "Emotion recognition means" refers to technology that analyzes a user's emotional state and generates information or messages that are adapted to that state.

[0360] This invention is a system designed to provide users with an environment in which they can use information with peace of mind. The configuration and operation of this system are described in detail below.

[0361] The server first activates its information acquisition mechanisms to collect information from the network in real time. This process automatically aggregates data from various sources using a streaming platform. Next, the collected information is pre-processed using data formatting mechanisms, including tokenization of text data and noise reduction. This ensures information consistency and facilitates analysis.

[0362] The analysis utilizes a variety of modal analysis methods. In this process, a general-purpose model is used for text analysis as a natural language processing model, while a general image recognition model is used for image and video data. Based on the analysis results, an anomaly detection method evaluates suspicious patterns and activities, and calculates an anomaly score. Based on this information, an emotion recognition method analyzes the user's emotional state, and messages and educational content are generated accordingly.

[0363] The device's role is to notify users of warnings and advice sent from the server. Information is communicated to users via push notifications and in-app messages, prompting appropriate responses based on their emotional state. This process ensures that information is presented in an easily understandable format, even when users are experiencing stress.

[0364] Users can receive notifications from their devices, immediately understand the necessary countermeasures, and decide on the actions they should take. They can also deepen their understanding of information technology through emotionally-based educational content. For example, when a phishing email is detected, the server selects and notifies the user of detailed countermeasures or a concise warning message based on their emotional state. An example of a prompt might be, "Analyze the potential threats hidden in the message received by the user and generate a customized warning message based on the emotional recognition results."

[0365] This system aims to provide a safe and reserved information access environment while taking into consideration the feelings of users.

[0366] The flow of the specific processing in Example 2 will be explained using Figure 13.

[0367] Step 1:

[0368] The server collects data from multiple sources on the network. It uses streaming services to acquire text, images, and video data in real time. The input consists of data from a large number of unspecified sources, which is then output as structured data.

[0369] Step 2:

[0370] The server uses data formatting techniques to properly process the collected data. Specifically, it tokenizes text using a natural language processing library and removes unnecessary information. Image and video data are resized and denoised using conversion tools. The input is the raw data acquired in step 1, and after processing, it is output as analyzable, formatted data.

[0371] Step 3:

[0372] The server analyzes the formatted data using various modal analysis methods. Specifically, it performs text analysis using a natural language processing model commonly used as a generative AI model, and extracts features from images and videos using an image recognition model. The input is the formatted data obtained in step 2, and the output is suspicious patterns and anomaly scores.

[0373] Step 4:

[0374] The server evaluates anomalies using anomaly detection means based on the analysis results and estimates the user's emotional state using emotion recognition means. The input is the analysis results from step 3, and the output is information on the presence or absence of anomalies, anomaly scores, and the user's emotional state. This allows for the customization of warnings and educational content.

[0375] Step 5:

[0376] The device notifies the user of warnings and advice sent from the server. This process uses push notifications and in-app messages, and the information is presented appropriately based on the user's emotional state. The input is the anomaly information and emotional data generated in step 4, and the output is a customized notification message displayed on the screen.

[0377] Step 6:

[0378] Users can receive notifications from their devices and take action based on the suggested solutions. They can also deepen their understanding of information technology through educational content. The input is the message received in step 5, and the output is the result of the user's specific actions and skill improvement.

[0379] (Application Example 2)

[0380] Next, we will explain application example 2. In the following explanation, the data processing device 12 will be referred to as the "server," and the smart glasses 214 will be referred to as the "terminal."

[0381] In today's information-saturated society, the information users receive includes risks such as phishing scams and misinformation. However, there is a lack of systems that can accurately and quickly detect these threats and provide appropriate responses tailored to the user's emotional state. Furthermore, improving users' information literacy to enable them to act safely is also a crucial challenge.

[0382] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means.

[0383] In this invention, the server includes data acquisition means for collecting data from the network in real time, data formatting means for preprocessing and formatting the collected data, and anomaly detection means for detecting and scoring anomalies based on the analysis results. This makes it possible to provide flexible notifications and learning opportunities based on the user's emotional state.

[0384] A "data acquisition method" is a mechanism that collects diverse information in real time via a network.

[0385] "Data formatting methods" refer to the processes of converting and formatting collected data into a format that is easy to analyze.

[0386] A "multimodal analysis method" is a mechanism for simultaneously analyzing multiple data formats (text, images, videos, etc.) to identify suspicious patterns.

[0387] An "anomaly detection method" is a process for detecting abnormal behaviors and patterns from analyzed data and assigning scores to them.

[0388] A "warning notification system" is a mechanism that provides warnings in a manner appropriate to the user's emotional state in response to detected anomalies.

[0389] A "means of presenting countermeasures" is a mechanism that shows users specific countermeasures for abnormalities or dangers, and adjusts the content according to their emotions.

[0390] "Content delivery means" refers to a function that provides educational content to improve information literacy in accordance with the user's emotional state and past behavioral history.

[0391] An "emotion engine" is a model or algorithm that analyzes user input data to infer the user's current emotional state.

[0392] To implement this invention, a system integrating a server, terminal, and user interface is required. The server collects text, image, and video data in real time from multiple data sources via a network. This data is preprocessed by data formatting means, and suspicious patterns are analyzed using natural language processing models and image / video analysis models. The server calculates an anomaly score and identifies potential threats to the user using anomaly detection means.

[0393] Furthermore, an emotion engine is used to analyze the user's emotional state from their input, and based on the results, it generates warning messages and educational content appropriate to the user's situation. The device receives notifications sent from the server and issues warnings in the most appropriate format corresponding to the user's emotional state. For example, if the user is relaxed, it provides detailed countermeasures, while if they are stressed, it provides a simple warning.

[0394] For example, when a user receives a phishing email, the server analyzes the email's suspicious characteristics and detects an anomaly. The sentiment engine assesses whether the user is calm, and if it confirms that the user is calm, it notifies the device with detailed countermeasures.

[0395] An example of a prompt message is, "Generate a notification message that effectively warns of emails that have been identified as potentially phishing scams."

[0396] These features are implemented as applications that run on the user's device, utilizing software tools such as Python, TensorFlow, and emotion recognition APIs. This system allows users to obtain necessary information safely and efficiently, improving safety in online activities.

[0397] The flow of a specific process in Application Example 2 will be explained using Figure 14.

[0398] Step 1:

[0399] The server collects data from the network in real time. It receives text, image, and video data from the internet as input and collects it using data acquisition methods. The output is a set of pre-processed data. Specifically, it accesses each data source via an API and downloads the data.

[0400] Step 2:

[0401] The server preprocesses the collected data using data formatting tools to prepare the format. The raw data collected in the previous step is used as input, and data in a format suitable for analysis is generated as output. This includes specific actions such as data cleaning and format conversion.

[0402] Step 3:

[0403] The server analyzes pre-processed data using natural language processing models and image / video analysis models. It uses formatted data as input and outputs analysis results that highlight suspicious patterns. The specific operations to run the models involve calculations using Python and TensorFlow.

[0404] Step 4:

[0405] The server detects anomalies based on the analysis results and calculates an anomaly score. The input is the analysis results of the model, and the output is anomaly information accompanied by an anomaly score. Specifically, it uses a scoring algorithm to quantify the degree of anomaly.

[0406] Step 5:

[0407] The server uses an emotion engine to infer the user's emotional state from their input data. The user's recent actions and input data are used as input, and the output is information indicating their emotional state. The specific operation involves data analysis using an emotion recognition API.

[0408] Step 6:

[0409] The terminal receives anomaly information and emotional state information from the server and delivers warnings to the user. Using the received information as input, a customized warning message for the user is generated as output. Specific actions include displaying the message to the user using a notification API.

[0410] Step 7:

[0411] The device presents the user with suggested solutions and provides educational content to improve information literacy based on their emotional state. Input consists of solutions and educational content sent from the server, while output is information displayed on the user's screen. Specific operations include rendering content on a graphical user interface (GUI).

[0412] The specific processing unit 290 transmits the result of the specific processing to the smart glasses 214. In the smart glasses 214, the control unit 46A causes the speaker 240 to output the result of the specific processing. The microphone 238 acquires audio indicating user input for the result of the specific processing. The control unit 46A transmits the audio data indicating user input acquired by the microphone 238 to the data processing unit 12. In the data processing unit 12, the specific processing unit 290 acquires the audio data.

[0413] Data generation model 58 is a type of so-called generative AI (Artificial Intelligence). One example of data generation model 58 is ChatGPT (Internet search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search) <url: https: gemini.google.com ?hl="ja">Examples of generative AI include the following. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 is input with prompts containing instructions, and with inference data such as audio data representing speech, text data representing text, and image data representing images. The data generation model 58 infers from the input inference data according to the instructions indicated by the prompts, and outputs the inference results in data formats such as audio data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0414] In the above embodiment, an example was given in which specific processing is performed by the data processing device 12, but the technology of this disclosure is not limited thereto, and the specific processing may also be performed by the smart glasses 214.

[0415] [Third Embodiment]

[0416] Figure 5 shows an example of the configuration of the data processing system 310 according to the third embodiment.

[0417] As shown in Figure 5, the data processing system 310 includes a data processing device 12 and a headset terminal 314. An example of the data processing device 12 is a server.

[0418] The data processing device 12 comprises a computer 22, a database 24, and a communication interface 26. The computer 22 is an example of a "computer" related to the technology of this disclosure. The computer 22 comprises a processor 28, RAM 30, and storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication interface 26 are also connected to the bus 34. The communication interface 26 is connected to a network 54. An example of the network 54 is a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0419] The headset terminal 314 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication interface 44, and a display 343. The computer 36 includes a processor 46, RAM 48, and storage 50. The processor 46, RAM 48, and storage 50 are connected to a bus 52. The microphone 238, speaker 240, camera 42, and display 343 are also connected to the bus 52.

[0420] The microphone 238 receives voice signals from the user 20 and receives instructions from the user 20. The microphone 238 captures the voice signals from the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to the instructions from the processor 46.

[0421] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an image sensor such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the area around the user 20 (for example, an imaging range defined by a field of view equivalent to the width of a typical healthy person's field of vision).

[0422] Communication interface 44 is connected to network 54. Communication interfaces 44 and 26 are responsible for the exchange of various information between processor 46 and processor 28 via network 54. The exchange of various information between processor 46 and processor 28 using communication interfaces 44 and 26 is performed in a secure manner.

[0423] Figure 6 shows an example of the main functions of the data processing device 12 and the headset terminal 314. As shown in Figure 6, the data processing device 12 performs specific processing using the processor 28. The storage 32 stores the specific processing program 56.

[0424] The specific processing program 56 is an example of a "program" relating to the technology of this disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0425] The storage 32 stores the data generation model 58 and the emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0426] In the headset terminal 314, the processor 46 performs the reception output processing. The storage 50 stores the reception output program 60. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output processing is realized by the processor 46 operating as a control unit 46A according to the reception output program 60 executed on the RAM 48.

[0427] Next, the specific processing performed by the specific processing unit 290 of the data processing device 12 will be described. In the following description, the data processing device 12 will be referred to as the "server" and the headset terminal 314 will be referred to as the "terminal".

[0428] To implement the present invention, the following system configuration is necessary. The main components are a server, a terminal, and their respective functions.

[0429] The server collects data in various media formats from the network in real time. This collected data includes text obtained from web pages, content from social media and emails, images, and videos. The server receives this data and first performs preprocessing. Text data is processed to remove unnecessary information and to ensure a consistent format. Images and videos are processed to adjust resolution and reduce noise.

[0430] The preprocessed data is analyzed using the server's multimodal analysis technology. Specifically, a natural language processing model analyzes the text data to recognize specific keywords and patterns. For images and videos, a dedicated analysis model is used to detect visual features and identify signs of phishing or malware.

[0431] Once the analysis is complete, the server calculates an anomaly score and detects potential risks based on the result and score. If a risk is detected, a warning is sent to the terminal in real time. At this time, the terminal displays a warning message to the user, informing them of the danger, for example, "This may be a phishing email."

[0432] Users can choose their actions based on warnings displayed on their devices; for example, they can check for safe links or block senders according to the suggested countermeasures. Furthermore, the server generates and provides appropriate educational content based on the user's browsing history. This helps users improve their information literacy and mitigate future online risks.

[0433] For example, if a user receives a suspicious email, the server analyzes it, checks for potential phishing attempts, and then sends a signal to the user's device. The device then displays a warning and further advises the user not to click on any links. In this way, the system aims to continuously support users and provide a safe and reliable internet environment.

[0434] The following describes the processing flow.

[0435] Step 1:

[0436] The server collects text, image, and video data in real time from various data sources on the network, including web pages, social media, and email.

[0437] Step 2:

[0438] The server preprocesses the collected data. Specifically, it removes unnecessary information from text data and standardizes the format. It also adjusts the resolution and reduces noise in images and videos.

[0439] Step 3:

[0440] The server analyzes the pre-processed data. It uses natural language processing models to analyze text data and extract specific keywords and patterns. In addition, it uses image and video analysis models to identify visual features.

[0441] Step 4:

[0442] The server calculates an anomaly score based on the analysis results. The score indicates the possibility of cyberattacks or misinformation, and anomalies are detected based on this score.

[0443] Step 5:

[0444] If an anomaly is detected, the server sends a warning notification to the terminal. The terminal displays a warning to the user, such as "This link may be a phishing link."

[0445] Step 6:

[0446] The device will present the user with specific countermeasures based on the detected anomaly. For example, it may recommend actions such as not clicking on links or blocking the sender.

[0447] Step 7:

[0448] The server generates educational content based on the user's behavioral history. The device then provides this content to the user, helping to improve their information literacy.

[0449] (Example 1)

[0450] Next, we will describe Example 1. In the following description, the data processing device 12 will be referred to as the "server," and the headset-type terminal 314 will be referred to as the "terminal."

[0451] In today's internet environment, it is necessary to effectively and quickly assess the security of data collected in real time from diverse sources and protect users from harmful content and attacks. A system is needed to ensure the security of such information and improve users' information literacy.

[0452] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 1 is realized by the following means.

[0453] In this invention, the server includes information acquisition means for collecting information from a network in real time, information formatting means for preprocessing the collected information and formatting it into a unified format, and analysis means for analyzing the preprocessed information and detecting suspicious patterns. This enables the provision of rapid warnings and educational materials to users.

[0454] "Information acquisition means" refers to means that have the function of collecting diverse information in real time from a network.

[0455] "Information formatting means" refers to means that have the function of pre-processing collected information and formatting it into a unified format.

[0456] "Analysis means" refers to means that have the function of analyzing pre-processed information to detect suspicious patterns or features.

[0457] An "anomaly detection means" is a means that has the function of evaluating anomalies based on analysis results and detecting them.

[0458] A "notification means" is a means that has the function of sending a warning to an information device in real time based on the detected anomaly.

[0459] A "means for presenting solutions" refers to a means that has the function of presenting specific countermeasures or proposed solutions to the user.

[0460] "Means of providing materials" refers to means that have the function of providing educational materials aimed at improving users' digital literacy.

[0461] "Material generation means" refers to means that have the function of generating educational materials based on the user's behavioral history.

[0462] To implement this invention, the server collects diverse information in real time via the network and deploys information acquisition means to all digital devices. The server acquires information in text, images, videos, and other media formats using various APIs and web crawlers.

[0463] The collected information is preprocessed by information formatting tools on the server. Here, regular expressions are used to filter out unnecessary parts of text information, and it is converted to a standard character encoding format. For images and videos, open-source media processing libraries are used to adjust the resolution and reduce noise.

[0464] The pre-processed information is further analyzed by analysis tools on the server. Natural language processing techniques (e.g., generative AI models) are used to analyze text information and extract important keywords and patterns. Images and videos are analyzed using deep learning models to determine whether they are suspected of being phishing or malware.

[0465] The analysis results are evaluated in real time by anomaly detection measures, and if an anomaly is detected, it is scored. Based on this anomaly score, the server immediately issues a warning to the terminal. The terminal has a function that displays a warning to the user via a notification mechanism, immediately notifying them that "this link may be unsafe."

[0466] Users can take appropriate action based on warnings displayed on their devices and have the option of not clicking on suspicious links by following safety measures. Furthermore, the server uses a material generation system to generate customized educational materials based on the user's behavioral history. These materials help users improve their digital literacy and provide information to effectively manage online risks.

[0467] For example, if a user receives a suspicious email, the server analyzes the email and calculates an anomaly score. If it is suspected to be a phishing attempt, a warning message saying "Be careful with this email" will be displayed on the device in real time.

[0468] As an example of a prompt, the user can enter "Is this email a phishing attempt?" to help the generating AI model perform a more detailed analysis.

[0469] The flow of the specific processing in Example 1 will be explained using Figure 11.

[0470] Step 1:

[0471] The server collects information from the network. Specifically, it uses web crawling technology and APIs to obtain data in digital media formats such as text, images, and videos. The input is a specified URL or API endpoint, and the output is raw, unprocessed data. This raw data forms the basis for subsequent processing.

[0472] Step 2:

[0473] The server preprocesses the collected data. For text data, it uses regular expressions to filter out unnecessary elements and converts it to a standard character encoding. Images and videos are processed using a viral processing library for resolution adjustment and noise reduction. The input is raw data, and the output is formatted data. This formatted data is then prepared for analysis.

[0474] Step 3:

[0475] The server analyzes pre-processed data. It uses natural language processing techniques to analyze text data and extract keywords and patterns. A generative AI model supports this process. For image and video data, deep learning techniques are used to detect and analyze visual features. The input is formatted data, and the output is an analysis result that checks for the presence or absence of specific patterns.

[0476] Step 4:

[0477] The server calculates an anomaly score based on the analysis results. It utilizes singular value decomposition and anomaly detection techniques to evaluate whether the data exceeds a threshold. The input is the analysis results, and the output is an anomaly score. This score helps identify potential risks.

[0478] Step 5:

[0479] The server issues a warning if the anomaly score exceeds a threshold. Specifically, it immediately sends a warning message to the terminal. The input is the anomaly score, and the output is a warning notification displayed on the terminal. This allows users to recognize potential dangers in real time.

[0480] Step 6:

[0481] The user selects the appropriate action based on the warning message displayed on their device. The input is the warning displayed on the device, and the output is the user's response. Specifically, the user may take actions such as avoiding links or blocking email senders based on the presented phishing suspicion information.

[0482] Step 7:

[0483] The server collects user activity history and generates educational materials. Using a material generation method, prompts are fed into a generation AI model to provide user-specific educational content. The input is the user's activity history, and the output is customized educational materials. This process aims to improve users' digital literacy.

[0484] (Application Example 1)

[0485] Next, we will explain Application Example 1. In the following explanation, the data processing device 12 will be referred to as the "server," and the headset-type terminal 314 will be referred to as the "terminal."

[0486] In recent years, with the rapid increase in the flow of information on networks, the risks of phishing and malware have risen. In this context, there is a need to detect suspicious digital content in real time, provide appropriate warnings to users, and create a safe internet environment. However, existing systems lack the ability to comprehensively analyze complex multimodal data and provide users with immediate, practical guidance. Therefore, there is a need to provide a system that uses more advanced analytical techniques to comprehensively detect anomalies, provide appropriate educational content, and protect users from malicious activity.

[0487] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 1 is realized by the following means.

[0488] In this invention, the server includes information acquisition means for collecting information from a network in real time, information formatting means for preprocessing and formatting the collected information, and dynamic analysis means for analyzing the digital content accessed by the user and evaluating its risks. This makes it possible to provide users with real-time guidance for improving safety and educational information for improving information literacy.

[0489] "Information acquisition means" refers to methods for collecting information in various media formats from a network in real time.

[0490] "Information formatting methods" refer to means of pre-processing collected information and adjusting it into a unified format.

[0491] A "multimodal analysis method" is a means of analyzing pre-processed information and detecting suspicious patterns from text and visual data.

[0492] An "anomaly detection method" is a means of detecting anomalies based on analysis results and scoring the likelihood of an anomaly occurring.

[0493] A "warning notification system" is a means of notifying users in real time of detected anomalies.

[0494] A "safety guideline presentation method" is a means of presenting users with guidelines for improving safety based on detected anomalies.

[0495] "Information provision means" refers to means of providing users with educational information to improve their information literacy.

[0496] A "dynamic analysis method" is a means of analyzing the digital content accessed by users in real time and evaluating its risks.

[0497] To implement this invention, the involvement of a network, a server, and a user terminal is essential. The server is equipped with information acquisition means that collect information from the network in real time, and can collect information in various media formats from any network environment. This information is preprocessed by the server and converted into a unified format by information formatting means.

[0498] The server further analyzes the preprocessed information using multimodal analysis methods. It utilizes natural language processing models and visual data analysis models to detect suspicious patterns in text, images, and videos. Based on the analysis results, an anomaly detection method calculates an anomaly score, and based on this score, a warning notification method sends a warning to the user terminal.

[0499] Upon receiving a warning, the user's terminal displays safety guidelines provided by the server, prompting the user to take appropriate action. This allows the user to choose from options such as blocking the sender or not clicking the link, thus maintaining their safety. Furthermore, educational information aimed at improving information literacy is provided to the user through various information delivery methods. This information is customized based on the user's usage history.

[0500] Dynamic analysis tools analyze the digital content that users access in real time and assess its risks. This assessment provides an additional layer of security, allowing users to use the internet with peace of mind.

[0501] For example, if a user receives an email suspected of being a phishing attempt, the server analyzes the email's content to identify the possibility of phishing. The result is calculated as an anomaly score, and a warning is sent to the user's device. At the same time, the user is presented with a prompt to the generative AI model asking, "Please provide details about the algorithm used to identify phishing emails," and information is provided to aid in its understanding.

[0502] The flow of a specific process in Application Example 1 will be explained using Figure 12.

[0503] Step 1:

[0504] The server acquires information from the network in real time. It receives data from various sources such as web pages, social media, and emails as input, and outputs the acquired raw data. It utilizes various information acquisition methods to collect data in diverse formats.

[0505] Step 2:

[0506] The server preprocesses the acquired raw data and converts it into a unified format using information formatting tools. This process removes data noise and unnecessary text information. The input is the acquired raw data, and the output is formatted, clean data.

[0507] Step 3:

[0508] The server analyzes formatted, clean data using multimodal analysis methods. In this process, a natural language processing model extracts keywords and patterns from text data, and a visual data analysis model detects features in images and videos. It receives clean data as input and outputs the analysis results.

[0509] Step 4:

[0510] The server calculates an anomaly score using an anomaly detection mechanism based on the analysis results. The analysis results are used as input, and an anomaly score, which is a numerical value indicating the possibility of an anomaly, is output. Based on this score, the server performs actions to identify suspicious content.

[0511] Step 5:

[0512] The server sends a warning to the user terminal via a warning notification mechanism if the anomaly score exceeds a certain threshold. Information regarding the warning is input, and a warning message for user notification is output. A specific warning message is generated to inform the user of the danger.

[0513] Step 6:

[0514] When the user terminal receives a warning from the server, it displays safety guidelines on the screen and presents the user with appropriate action suggestions. The warning message is input, and the suggested guidelines and suggestions are output.

[0515] Step 7:

[0516] The user terminal provides educational information using information delivery tools to promote improved information literacy. The user's behavioral history is used as input, and educational content is output. As a specific example, the prompt "Please tell me the details of the algorithm used to identify phishing emails." is generated for the generating AI model and presented to the user.

[0517] Furthermore, an emotion engine that estimates the user's emotions may be incorporated. That is, the identification processing unit 290 may use the emotion identification model 59 to estimate the user's emotions and perform identification processing using the user's emotions.

[0518] To implement the present invention, a system configuration including a server, terminals, and user interfaces is required. This system acquires data from the network in real time and then performs a series of analysis and notification processes.

[0519] The server collects text, image, and video data from multiple data sources and preprocesses them using data formatting tools. Next, it analyzes the data using a combination of natural language processing models and image / video analysis models to detect suspicious patterns. An anomaly score is calculated from the analysis results, and anomalies are detected based on this score.

[0520] Furthermore, the server is equipped with an emotion engine to recognize the user's emotions. The emotion engine analyzes the user's input data and infers their emotional state. Based on these results, the server outputs educational content and warning messages that are adapted to the user's emotions.

[0521] The terminal notifies the user of warnings and advice sent from the server. The warning notification system sends a signal to the user in real time when an anomaly is detected. It also adjusts the notification method according to the user's emotional state, for example, providing a concise message when the user is under stress.

[0522] Users can receive notifications from their devices, act according to the suggested countermeasures, and maintain online safety. Furthermore, educational content tailored by an emotion engine can improve information literacy. This content is provided considering the user's past behavioral history and emotional state, thus offering more appropriate learning opportunities.

[0523] For example, if a user receives an email suspected of being a phishing attempt, the server detects it, and the emotion engine checks the user's calm emotional state before notifying them of detailed countermeasures. Conversely, if the user is feeling stressed, a simple warning is provided to encourage cautious action. This system aims to improve the user experience and support safe internet use.

[0524] The following describes the processing flow.

[0525] Step 1:

[0526] The server collects text, image, and video data from various data sources on the network. This includes information from web pages, social media, emails, and other sources.

[0527] Step 2:

[0528] The server preprocesses the collected data, removing unnecessary characters from text and standardizing the resolution of images and videos to reduce noise. This formats the data so that it is suitable for analysis.

[0529] Step 3:

[0530] The server analyzes the formatted data. It uses natural language processing models to analyze important keywords and context in the text, and image / video analysis models to extract visual features and identify suspicious patterns.

[0531] Step 4:

[0532] The server calculates an anomaly score based on the analysis results. Based on the calculated score, it determines the risk of phishing or malware, and may identify it as an anomaly.

[0533] Step 5:

[0534] The server uses an emotion engine to recognize the user's emotional state from user input data, such as keyboard input speed and mouse movements. The emotion engine infers the user's current emotions and optimizes notification content along with any anomaly detection results.

[0535] Step 6:

[0536] The server sends a warning and suggested countermeasures to the terminal. The terminal displays the received information to the user as a warning, for example, a message such as "This email may be a phishing attempt."

[0537] Step 7:

[0538] The device uses the results of its emotion engine to select appropriate actions and notification methods tailored to the user's emotions. For example, in a highly stressed state, it might offer simple action suggestions.

[0539] Step 8:

[0540] The server considers the user's usual behavioral history and emotional state to generate appropriate educational content. The device then delivers this content to the user, supporting the improvement of their information literacy.

[0541] Through these steps, the system aims to provide users with a secure internet environment and support the improvement of their information literacy.

[0542] (Example 2)

[0543] Next, we will describe Example 2. In the following description, the data processing device 12 will be referred to as the "server," and the headset-type terminal 314 will be referred to as the "terminal."

[0544] In today's information society, users find it difficult to select and access information safely from a vast amount of data. Furthermore, judging the reliability of information and responding appropriately requires a high level of information technology understanding, but not all users possess the same level of literacy. Moreover, given that users' emotions influence their responses to information, it is necessary to implement appropriate measures that take these emotions into consideration. To address these challenges, there is a need for systems that allow users to enjoy a safe and comfortable information environment.

[0545] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 2 is realized by the following means.

[0546] In this invention, the server includes information acquisition means for collecting information from a network in real time, data formatting means for preprocessing and shaping the collected information, various modal analysis means for analyzing the preprocessed information and detecting suspicious patterns, anomaly detection means for detecting and evaluating anomalies, and emotion recognition means for recognizing emotional states and generating messages adapted to those states. This makes it possible to provide safe and reliable access to information and educational content tailored to individual users, while taking into account the emotional state of the user.

[0547] "Information acquisition means" refers to the components used to collect information in real time from a network.

[0548] A "data formatting means" is a configuration that has the function of pre-processing and formatting collected information.

[0549] "Diverse modal analysis methods" refer to techniques for analyzing different types of data and detecting suspicious patterns.

[0550] An "anomaly detection method" is a system that evaluates and detects anomalies in data based on the analysis results.

[0551] A "warning mechanism" is a method used to communicate a warning to users about detected anomalies.

[0552] "Methods for presenting countermeasures" refers to the process of presenting appropriate countermeasures to users.

[0553] "Content delivery means" refers to components that provide educational content to improve users' understanding of information technology.

[0554] "Emotion recognition means" refers to technology that analyzes a user's emotional state and generates information or messages that are adapted to that state.

[0555] This invention is a system designed to provide users with an environment in which they can use information with peace of mind. The configuration and operation of this system are described in detail below.

[0556] The server first activates its information acquisition mechanisms to collect information from the network in real time. This process automatically aggregates data from various sources using a streaming platform. Next, the collected information is pre-processed using data formatting mechanisms, including tokenization of text data and noise reduction. This ensures information consistency and facilitates analysis.

[0557] The analysis utilizes a variety of modal analysis methods. In this process, a general-purpose model is used for text analysis as a natural language processing model, while a general image recognition model is used for image and video data. Based on the analysis results, an anomaly detection method evaluates suspicious patterns and activities, and calculates an anomaly score. Based on this information, an emotion recognition method analyzes the user's emotional state, and messages and educational content are generated accordingly.

[0558] The device's role is to notify users of warnings and advice sent from the server. Information is communicated to users via push notifications and in-app messages, prompting appropriate responses based on their emotional state. This process ensures that information is presented in an easily understandable format, even when users are experiencing stress.

[0559] Users can receive notifications from their devices, immediately understand the necessary countermeasures, and decide on the actions they should take. They can also deepen their understanding of information technology through emotionally-based educational content. For example, when a phishing email is detected, the server selects and notifies the user of detailed countermeasures or a concise warning message based on their emotional state. An example of a prompt might be, "Analyze the potential threats hidden in the message received by the user and generate a customized warning message based on the emotional recognition results."

[0560] This system aims to provide a safe and reserved information access environment while taking into consideration the feelings of users.

[0561] The flow of the specific processing in Example 2 will be explained using Figure 13.

[0562] Step 1:

[0563] The server collects data from multiple sources on the network. It uses streaming services to acquire text, images, and video data in real time. The input consists of data from a large number of unspecified sources, which is then output as structured data.

[0564] Step 2:

[0565] The server uses data formatting techniques to properly process the collected data. Specifically, it tokenizes text using a natural language processing library and removes unnecessary information. Image and video data are resized and denoised using conversion tools. The input is the raw data acquired in step 1, and after processing, it is output as analyzable, formatted data.

[0566] Step 3:

[0567] The server analyzes the formatted data using various modal analysis methods. Specifically, it performs text analysis using a natural language processing model commonly used as a generative AI model, and extracts features from images and videos using an image recognition model. The input is the formatted data obtained in step 2, and the output is suspicious patterns and anomaly scores.

[0568] Step 4:

[0569] The server evaluates anomalies using anomaly detection means based on the analysis results and estimates the user's emotional state using emotion recognition means. The input is the analysis results from step 3, and the output is information on the presence or absence of anomalies, anomaly scores, and the user's emotional state. This allows for the customization of warnings and educational content.

[0570] Step 5:

[0571] The device notifies the user of warnings and advice sent from the server. This process uses push notifications and in-app messages, and the information is presented appropriately based on the user's emotional state. The input is the anomaly information and emotional data generated in step 4, and the output is a customized notification message displayed on the screen.

[0572] Step 6:

[0573] Users can receive notifications from their devices and take action based on the suggested solutions. They can also deepen their understanding of information technology through educational content. The input is the message received in step 5, and the output is the result of the user's specific actions and skill improvement.

[0574] (Application Example 2)

[0575] Next, we will explain application example 2. In the following explanation, the data processing device 12 will be referred to as the "server," and the headset-type terminal 314 will be referred to as the "terminal."

[0576] In today's information-saturated society, the information users receive includes risks such as phishing scams and misinformation. However, there is a lack of systems that can accurately and quickly detect these threats and provide appropriate responses tailored to the user's emotional state. Furthermore, improving users' information literacy to enable them to act safely is also a crucial challenge.

[0577] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means.

[0578] In this invention, the server includes data acquisition means for collecting data from the network in real time, data formatting means for preprocessing and formatting the collected data, and anomaly detection means for detecting and scoring anomalies based on the analysis results. This makes it possible to provide flexible notifications and learning opportunities based on the user's emotional state.

[0579] A "data acquisition method" is a mechanism that collects diverse information in real time via a network.

[0580] "Data formatting methods" refer to the processes of converting and formatting collected data into a format that is easy to analyze.

[0581] A "multimodal analysis method" is a mechanism for simultaneously analyzing multiple data formats (text, images, videos, etc.) to identify suspicious patterns.

[0582] An "anomaly detection method" is a process for detecting abnormal behaviors and patterns from analyzed data and assigning scores to them.

[0583] A "warning notification system" is a mechanism that provides warnings in a manner appropriate to the user's emotional state in response to detected anomalies.

[0584] A "means of presenting countermeasures" is a mechanism that shows users specific countermeasures for abnormalities or dangers, and adjusts the content according to their emotions.

[0585] "Content delivery means" refers to a function that provides educational content to improve information literacy in accordance with the user's emotional state and past behavioral history.

[0586] An "emotion engine" is a model or algorithm that analyzes user input data to infer the user's current emotional state.

[0587] To implement this invention, a system integrating a server, terminal, and user interface is required. The server collects text, image, and video data in real time from multiple data sources via a network. This data is preprocessed by data formatting means, and suspicious patterns are analyzed using natural language processing models and image / video analysis models. The server calculates an anomaly score and identifies potential threats to the user using anomaly detection means.

[0588] Furthermore, an emotion engine is used to analyze the user's emotional state from their input, and based on the results, it generates warning messages and educational content appropriate to the user's situation. The device receives notifications sent from the server and issues warnings in the most appropriate format corresponding to the user's emotional state. For example, if the user is relaxed, it provides detailed countermeasures, while if they are stressed, it provides a simple warning.

[0589] For example, when a user receives a phishing email, the server analyzes the email's suspicious characteristics and detects an anomaly. The sentiment engine assesses whether the user is calm, and if it confirms that the user is calm, it notifies the device with detailed countermeasures.

[0590] An example of a prompt message is, "Generate a notification message that effectively warns of emails that have been identified as potentially phishing scams."

[0591] These features are implemented as applications that run on the user's device, utilizing software tools such as Python, TensorFlow, and emotion recognition APIs. This system allows users to obtain necessary information safely and efficiently, improving safety in online activities.

[0592] The flow of a specific process in Application Example 2 will be explained using Figure 14.

[0593] Step 1:

[0594] The server collects data from the network in real time. It receives text, image, and video data from the internet as input and collects it using data acquisition methods. The output is a set of pre-processed data. Specifically, it accesses each data source via an API and downloads the data.

[0595] Step 2:

[0596] The server preprocesses the collected data using data formatting tools to prepare the format. The raw data collected in the previous step is used as input, and data in a format suitable for analysis is generated as output. This includes specific actions such as data cleaning and format conversion.

[0597] Step 3:

[0598] The server analyzes pre-processed data using natural language processing models and image / video analysis models. It uses formatted data as input and outputs analysis results that highlight suspicious patterns. The specific operations to run the models involve calculations using Python and TensorFlow.

[0599] Step 4:

[0600] The server detects anomalies based on the analysis results and calculates an anomaly score. The input is the analysis results of the model, and the output is anomaly information accompanied by an anomaly score. Specifically, it uses a scoring algorithm to quantify the degree of anomaly.

[0601] Step 5:

[0602] The server uses an emotion engine to infer the user's emotional state from their input data. The user's recent actions and input data are used as input, and the output is information indicating their emotional state. The specific operation involves data analysis using an emotion recognition API.

[0603] Step 6:

[0604] The terminal receives anomaly information and emotional state information from the server and delivers warnings to the user. Using the received information as input, a customized warning message for the user is generated as output. Specific actions include displaying the message to the user using a notification API.

[0605] Step 7:

[0606] The device presents the user with suggested solutions and provides educational content to improve information literacy based on their emotional state. Input consists of solutions and educational content sent from the server, while output is information displayed on the user's screen. Specific operations include rendering content on a graphical user interface (GUI).

[0607] The specific processing unit 290 transmits the result of the specific processing to the headset terminal 314. In the headset terminal 314, the control unit 46A causes the speaker 240 and display 343 to output the result of the specific processing. The microphone 238 acquires audio indicating user input for the result of the specific processing. The control unit 46A transmits the audio data indicating user input acquired by the microphone 238 to the data processing unit 12. In the data processing unit 12, the specific processing unit 290 acquires the audio data.

[0608] Data generation model 58 is a type of so-called generative AI (Artificial Intelligence). One example of data generation model 58 is ChatGPT (Internet search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search) <url: https: gemini.google.com ?hl="ja">Examples of generative AI include the following. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 is input with prompts containing instructions, and with inference data such as audio data representing speech, text data representing text, and image data representing images. The data generation model 58 infers from the input inference data according to the instructions indicated by the prompts, and outputs the inference results in data formats such as audio data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0609] In the above embodiment, an example was given in which specific processing is performed by the data processing device 12, but the technology of this disclosure is not limited thereto, and specific processing may also be performed by the headset terminal 314.

[0610] [Fourth Embodiment]

[0611] Figure 7 shows an example of the configuration of the data processing system 410 according to the fourth embodiment.

[0612] As shown in Figure 7, the data processing system 410 includes a data processing device 12 and a robot 414. An example of the data processing device 12 is a server.

[0613] The data processing device 12 comprises a computer 22, a database 24, and a communication interface 26. The computer 22 is an example of a "computer" related to the technology of this disclosure. The computer 22 comprises a processor 28, RAM 30, and storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication interface 26 are also connected to the bus 34. The communication interface 26 is connected to a network 54. An example of the network 54 is a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0614] The robot 414 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication interface 44, and a controlled object 443. The computer 36 includes a processor 46, RAM 48, and storage 50. The processor 46, RAM 48, and storage 50 are connected to a bus 52. The microphone 238, speaker 240, camera 42, and controlled object 443 are also connected to the bus 52.

[0615] The microphone 238 receives voice signals from the user 20 and receives instructions from the user 20. The microphone 238 captures the voice signals from the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to the instructions from the processor 46.

[0616] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an image sensor such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the area around the user 20 (for example, an imaging range defined by a field of view equivalent to the width of a typical healthy person's field of vision).

[0617] Communication interface 44 is connected to network 54. Communication interfaces 44 and 26 are responsible for the exchange of various information between processor 46 and processor 28 via network 54. The exchange of various information between processor 46 and processor 28 using communication interfaces 44 and 26 is performed in a secure manner.

[0618] The controlled object 443 includes a display device, LEDs in the eyes, and motors that drive the arms, hands, and feet. The posture and gestures of the robot 414 are controlled by controlling the motors of the arms, hands, and feet. Some of the robot 414's emotions can be expressed by controlling these motors. Furthermore, the robot 414's facial expressions can also be expressed by controlling the illumination state of the LEDs in its eyes.

[0619] Figure 8 shows an example of the main functions of the data processing device 12 and the robot 414. As shown in Figure 8, the data processing device 12 performs specific processing using the processor 28. The storage 32 stores the specific processing program 56.

[0620] The specific processing program 56 is an example of a "program" relating to the technology of this disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0621] The storage 32 stores the data generation model 58 and the emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0622] In robot 414, the processor 46 performs the reception output processing. The storage 50 stores the reception output program 60. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output processing is realized by the processor 46 operating as a control unit 46A according to the reception output program 60 executed on the RAM 48.

[0623] Next, the specific processing performed by the specific processing unit 290 of the data processing device 12 will be described. In the following description, the data processing device 12 will be referred to as the "server" and the robot 414 as the "terminal".

[0624] To implement the present invention, the following system configuration is necessary. The main components are a server, a terminal, and their respective functions.

[0625] The server collects data in various media formats from the network in real time. This collected data includes text obtained from web pages, content from social media and emails, images, and videos. The server receives this data and first performs preprocessing. Text data is processed to remove unnecessary information and to ensure a consistent format. Images and videos are processed to adjust resolution and reduce noise.

[0626] The preprocessed data is analyzed using the server's multimodal analysis technology. Specifically, a natural language processing model analyzes the text data to recognize specific keywords and patterns. For images and videos, a dedicated analysis model is used to detect visual features and identify signs of phishing or malware.

[0627] Once the analysis is complete, the server calculates an anomaly score and detects potential risks based on the result and score. If a risk is detected, a warning is sent to the terminal in real time. At this time, the terminal displays a warning message to the user, informing them of the danger, for example, "This may be a phishing email."

[0628] Users can choose their actions based on warnings displayed on their devices; for example, they can check for safe links or block senders according to the suggested countermeasures. Furthermore, the server generates and provides appropriate educational content based on the user's browsing history. This helps users improve their information literacy and mitigate future online risks.

[0629] For example, if a user receives a suspicious email, the server analyzes it, checks for potential phishing attempts, and then sends a signal to the user's device. The device then displays a warning and further advises the user not to click on any links. In this way, the system aims to continuously support users and provide a safe and reliable internet environment.

[0630] The following describes the processing flow.

[0631] Step 1:

[0632] The server collects text, image, and video data in real time from various data sources on the network, including web pages, social media, and email.

[0633] Step 2:

[0634] The server preprocesses the collected data. Specifically, it removes unnecessary information from text data and standardizes the format. It also adjusts the resolution and reduces noise in images and videos.

[0635] Step 3:

[0636] The server analyzes the pre-processed data. It uses natural language processing models to analyze text data and extract specific keywords and patterns. In addition, it uses image and video analysis models to identify visual features.

[0637] Step 4:

[0638] The server calculates an anomaly score based on the analysis results. The score indicates the possibility of cyberattacks or misinformation, and anomalies are detected based on this score.

[0639] Step 5:

[0640] If an anomaly is detected, the server sends a warning notification to the terminal. The terminal displays a warning to the user, such as "This link may be a phishing link."

[0641] Step 6:

[0642] The device will present the user with specific countermeasures based on the detected anomaly. For example, it may recommend actions such as not clicking on links or blocking the sender.

[0643] Step 7:

[0644] The server generates educational content based on the user's behavioral history. The device then provides this content to the user, helping to improve their information literacy.

[0645] (Example 1)

[0646] Next, we will describe Example 1. In the following description, the data processing device 12 will be referred to as the "server" and the robot 414 as the "terminal".

[0647] In today's internet environment, it is necessary to effectively and quickly assess the security of data collected in real time from diverse sources and protect users from harmful content and attacks. A system is needed to ensure the security of such information and improve users' information literacy.

[0648] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 1 is realized by the following means.

[0649] In this invention, the server includes information acquisition means for collecting information from a network in real time, information formatting means for preprocessing the collected information and formatting it into a unified format, and analysis means for analyzing the preprocessed information and detecting suspicious patterns. This enables the provision of rapid warnings and educational materials to users.

[0650] "Information acquisition means" refers to means that have the function of collecting diverse information in real time from a network.

[0651] "Information formatting means" refers to means that have the function of pre-processing collected information and formatting it into a unified format.

[0652] "Analysis means" refers to means that have the function of analyzing pre-processed information to detect suspicious patterns or features.

[0653] An "anomaly detection means" is a means that has the function of evaluating anomalies based on analysis results and detecting them.

[0654] A "notification means" is a means that has the function of sending a warning to an information device in real time based on the detected anomaly.

[0655] A "means for presenting solutions" refers to a means that has the function of presenting specific countermeasures or proposed solutions to the user.

[0656] "Means of providing materials" refers to means that have the function of providing educational materials aimed at improving users' digital literacy.

[0657] "Material generation means" refers to means that have the function of generating educational materials based on the user's behavioral history.

[0658] To implement this invention, the server collects diverse information in real time via the network and deploys information acquisition means to all digital devices. The server acquires information in text, images, videos, and other media formats using various APIs and web crawlers.

[0659] The collected information is preprocessed by information formatting tools on the server. Here, regular expressions are used to filter out unnecessary parts of text information, and it is converted to a standard character encoding format. For images and videos, open-source media processing libraries are used to adjust the resolution and reduce noise.

[0660] The pre-processed information is further analyzed by analysis tools on the server. Natural language processing techniques (e.g., generative AI models) are used to analyze text information and extract important keywords and patterns. Images and videos are analyzed using deep learning models to determine whether they are suspected of being phishing or malware.

[0661] The analysis results are evaluated in real time by anomaly detection measures, and if an anomaly is detected, it is scored. Based on this anomaly score, the server immediately issues a warning to the terminal. The terminal has a function that displays a warning to the user via a notification mechanism, immediately notifying them that "this link may be unsafe."

[0662] Users can take appropriate action based on warnings displayed on their devices and have the option of not clicking on suspicious links by following safety measures. Furthermore, the server uses a material generation system to generate customized educational materials based on the user's behavioral history. These materials help users improve their digital literacy and provide information to effectively manage online risks.

[0663] For example, if a user receives a suspicious email, the server analyzes the email and calculates an anomaly score. If it is suspected to be a phishing attempt, a warning message saying "Be careful with this email" will be displayed on the device in real time.

[0664] As an example of a prompt, the user can enter "Is this email a phishing attempt?" to help the generating AI model perform a more detailed analysis.

[0665] The flow of the specific processing in Example 1 will be explained using Figure 11.

[0666] Step 1:

[0667] The server collects information from the network. Specifically, it uses web crawling technology and APIs to obtain data in digital media formats such as text, images, and videos. The input is a specified URL or API endpoint, and the output is raw, unprocessed data. This raw data forms the basis for subsequent processing.

[0668] Step 2:

[0669] The server preprocesses the collected data. For text data, it uses regular expressions to filter out unnecessary elements and converts it to a standard character encoding. Images and videos are processed using a viral processing library for resolution adjustment and noise reduction. The input is raw data, and the output is formatted data. This formatted data is then prepared for analysis.

[0670] Step 3:

[0671] The server analyzes pre-processed data. It uses natural language processing techniques to analyze text data and extract keywords and patterns. A generative AI model supports this process. For image and video data, deep learning techniques are used to detect and analyze visual features. The input is formatted data, and the output is an analysis result that checks for the presence or absence of specific patterns.

[0672] Step 4:

[0673] The server calculates an anomaly score based on the analysis results. It utilizes singular value decomposition and anomaly detection techniques to evaluate whether the data exceeds a threshold. The input is the analysis results, and the output is an anomaly score. This score helps identify potential risks.

[0674] Step 5:

[0675] The server issues a warning if the anomaly score exceeds a threshold. Specifically, it immediately sends a warning message to the terminal. The input is the anomaly score, and the output is a warning notification displayed on the terminal. This allows users to recognize potential dangers in real time.

[0676] Step 6:

[0677] The user selects the appropriate action based on the warning message displayed on their device. The input is the warning displayed on the device, and the output is the user's response. Specifically, the user may take actions such as avoiding links or blocking email senders based on the presented phishing suspicion information.

[0678] Step 7:

[0679] The server collects user activity history and generates educational materials. Using a material generation method, prompts are fed into a generation AI model to provide user-specific educational content. The input is the user's activity history, and the output is customized educational materials. This process aims to improve users' digital literacy.

[0680] (Application Example 1)

[0681] Next, we will explain Application Example 1. In the following explanation, the data processing device 12 will be referred to as the "server" and the robot 414 as the "terminal".

[0682] In recent years, with the rapid increase in the flow of information on networks, the risks of phishing and malware have risen. In this context, there is a need to detect suspicious digital content in real time, provide appropriate warnings to users, and create a safe internet environment. However, existing systems lack the ability to comprehensively analyze complex multimodal data and provide users with immediate, practical guidance. Therefore, there is a need to provide a system that uses more advanced analytical techniques to comprehensively detect anomalies, provide appropriate educational content, and protect users from malicious activity.

[0683] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 1 is realized by the following means.

[0684] In this invention, the server includes information acquisition means for collecting information from a network in real time, information formatting means for preprocessing and formatting the collected information, and dynamic analysis means for analyzing the digital content accessed by the user and evaluating its risks. This makes it possible to provide users with real-time guidance for improving safety and educational information for improving information literacy.

[0685] "Information acquisition means" refers to methods for collecting information in various media formats from a network in real time.

[0686] "Information formatting methods" refer to means of pre-processing collected information and adjusting it into a unified format.

[0687] A "multimodal analysis method" is a means of analyzing pre-processed information and detecting suspicious patterns from text and visual data.

[0688] An "anomaly detection method" is a means of detecting anomalies based on analysis results and scoring the likelihood of an anomaly occurring.

[0689] A "warning notification system" is a means of notifying users in real time of detected anomalies.

[0690] A "safety guideline presentation method" is a means of presenting users with guidelines for improving safety based on detected anomalies.

[0691] "Information provision means" refers to means of providing users with educational information to improve their information literacy.

[0692] A "dynamic analysis method" is a means of analyzing the digital content accessed by users in real time and evaluating its risks.

[0693] To implement this invention, the involvement of a network, a server, and a user terminal is essential. The server is equipped with information acquisition means that collect information from the network in real time, and can collect information in various media formats from any network environment. This information is preprocessed by the server and converted into a unified format by information formatting means.

[0694] The server further analyzes the preprocessed information using multimodal analysis methods. It utilizes natural language processing models and visual data analysis models to detect suspicious patterns in text, images, and videos. Based on the analysis results, an anomaly detection method calculates an anomaly score, and based on this score, a warning notification method sends a warning to the user terminal.

[0695] Upon receiving a warning, the user's terminal displays safety guidelines provided by the server, prompting the user to take appropriate action. This allows the user to choose from options such as blocking the sender or not clicking the link, thus maintaining their safety. Furthermore, educational information aimed at improving information literacy is provided to the user through various information delivery methods. This information is customized based on the user's usage history.

[0696] Dynamic analysis tools analyze the digital content that users access in real time and assess its risks. This assessment provides an additional layer of security, allowing users to use the internet with peace of mind.

[0697] For example, if a user receives an email suspected of being a phishing attempt, the server analyzes the email's content to identify the possibility of phishing. The result is calculated as an anomaly score, and a warning is sent to the user's device. At the same time, the user is presented with a prompt to the generative AI model asking, "Please provide details about the algorithm used to identify phishing emails," and information is provided to aid in its understanding.

[0698] The flow of a specific process in Application Example 1 will be explained using Figure 12.

[0699] Step 1:

[0700] The server acquires information from the network in real time. It receives data from various sources such as web pages, social media, and emails as input, and outputs the acquired raw data. It utilizes various information acquisition methods to collect data in diverse formats.

[0701] Step 2:

[0702] The server preprocesses the acquired raw data and converts it into a unified format using information formatting tools. This process removes data noise and unnecessary text information. The input is the acquired raw data, and the output is formatted, clean data.

[0703] Step 3:

[0704] The server analyzes formatted, clean data using multimodal analysis methods. In this process, a natural language processing model extracts keywords and patterns from text data, and a visual data analysis model detects features in images and videos. It receives clean data as input and outputs the analysis results.

[0705] Step 4:

[0706] The server calculates an anomaly score using an anomaly detection mechanism based on the analysis results. The analysis results are used as input, and an anomaly score, which is a numerical value indicating the possibility of an anomaly, is output. Based on this score, the server performs actions to identify suspicious content.

[0707] Step 5:

[0708] The server sends a warning to the user terminal via a warning notification mechanism if the anomaly score exceeds a certain threshold. Information regarding the warning is input, and a warning message for user notification is output. A specific warning message is generated to inform the user of the danger.

[0709] Step 6:

[0710] When the user terminal receives a warning from the server, it displays safety guidelines on the screen and presents the user with appropriate action suggestions. The warning message is input, and the suggested guidelines and suggestions are output.

[0711] Step 7:

[0712] The user terminal provides educational information using information delivery tools to promote improved information literacy. The user's behavioral history is used as input, and educational content is output. As a specific example, the prompt "Please tell me the details of the algorithm used to identify phishing emails." is generated for the generating AI model and presented to the user.

[0713] Furthermore, an emotion engine that estimates the user's emotions may be incorporated. That is, the identification processing unit 290 may use the emotion identification model 59 to estimate the user's emotions and perform identification processing using the user's emotions.

[0714] To implement the present invention, a system configuration including a server, terminals, and user interfaces is required. This system acquires data from the network in real time and then performs a series of analysis and notification processes.

[0715] The server collects text, image, and video data from multiple data sources and preprocesses them using data formatting tools. Next, it analyzes the data using a combination of natural language processing models and image / video analysis models to detect suspicious patterns. An anomaly score is calculated from the analysis results, and anomalies are detected based on this score.

[0716] Furthermore, the server is equipped with an emotion engine to recognize the user's emotions. The emotion engine analyzes the user's input data and infers their emotional state. Based on these results, the server outputs educational content and warning messages that are adapted to the user's emotions.

[0717] The terminal notifies the user of warnings and advice sent from the server. The warning notification system sends a signal to the user in real time when an anomaly is detected. It also adjusts the notification method according to the user's emotional state, for example, providing a concise message when the user is under stress.

[0718] Users can receive notifications from their devices, act according to the suggested countermeasures, and maintain online safety. Furthermore, educational content tailored by an emotion engine can improve information literacy. This content is provided considering the user's past behavioral history and emotional state, thus offering more appropriate learning opportunities.

[0719] For example, if a user receives an email suspected of being a phishing attempt, the server detects it, and the emotion engine checks the user's calm emotional state before notifying them of detailed countermeasures. Conversely, if the user is feeling stressed, a simple warning is provided to encourage cautious action. This system aims to improve the user experience and support safe internet use.

[0720] The following describes the processing flow.

[0721] Step 1:

[0722] The server collects text, image, and video data from various data sources on the network. This includes information from web pages, social media, emails, and other sources.

[0723] Step 2:

[0724] The server preprocesses the collected data, removing unnecessary characters from text and standardizing the resolution of images and videos to reduce noise. This formats the data so that it is suitable for analysis.

[0725] Step 3:

[0726] The server analyzes the formatted data. It uses natural language processing models to analyze important keywords and context in the text, and image / video analysis models to extract visual features and identify suspicious patterns.

[0727] Step 4:

[0728] The server calculates an anomaly score based on the analysis results. Based on the calculated score, it determines the risk of phishing or malware, and may identify it as an anomaly.

[0729] Step 5:

[0730] The server uses an emotion engine to recognize the user's emotional state from user input data, such as keyboard input speed and mouse movements. The emotion engine infers the user's current emotions and optimizes notification content along with any anomaly detection results.

[0731] Step 6:

[0732] The server sends a warning and suggested countermeasures to the terminal. The terminal displays the received information to the user as a warning, for example, a message such as "This email may be a phishing attempt."

[0733] Step 7:

[0734] The device uses the results of its emotion engine to select appropriate actions and notification methods tailored to the user's emotions. For example, in a highly stressed state, it might offer simple action suggestions.

[0735] Step 8:

[0736] The server considers the user's usual behavioral history and emotional state to generate appropriate educational content. The device then delivers this content to the user, supporting the improvement of their information literacy.

[0737] Through these steps, the system aims to provide users with a secure internet environment and support the improvement of their information literacy.

[0738] (Example 2)

[0739] Next, we will describe Example 2. In the following description, the data processing device 12 will be referred to as the "server" and the robot 414 as the "terminal".

[0740] In today's information society, users find it difficult to select and access information safely from a vast amount of data. Furthermore, judging the reliability of information and responding appropriately requires a high level of information technology understanding, but not all users possess the same level of literacy. Moreover, given that users' emotions influence their responses to information, it is necessary to implement appropriate measures that take these emotions into consideration. To address these challenges, there is a need for systems that allow users to enjoy a safe and comfortable information environment.

[0741] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 2 is realized by the following means.

[0742] In this invention, the server includes information acquisition means for collecting information from a network in real time, data formatting means for preprocessing and shaping the collected information, various modal analysis means for analyzing the preprocessed information and detecting suspicious patterns, anomaly detection means for detecting and evaluating anomalies, and emotion recognition means for recognizing emotional states and generating messages adapted to those states. This makes it possible to provide safe and reliable access to information and educational content tailored to individual users, while taking into account the emotional state of the user.

[0743] "Information acquisition means" refers to the components used to collect information in real time from a network.

[0744] A "data formatting means" is a configuration that has the function of pre-processing and formatting collected information.

[0745] "Diverse modal analysis methods" refer to techniques for analyzing different types of data and detecting suspicious patterns.

[0746] An "anomaly detection method" is a system that evaluates and detects anomalies in data based on the analysis results.

[0747] A "warning mechanism" is a method used to communicate a warning to users about detected anomalies.

[0748] "Methods for presenting countermeasures" refers to the process of presenting appropriate countermeasures to users.

[0749] "Content delivery means" refers to components that provide educational content to improve users' understanding of information technology.

[0750] "Emotion recognition means" refers to technology that analyzes a user's emotional state and generates information or messages that are adapted to that state.

[0751] This invention is a system designed to provide users with an environment in which they can use information with peace of mind. The configuration and operation of this system are described in detail below.

[0752] The server first activates its information acquisition mechanisms to collect information from the network in real time. This process automatically aggregates data from various sources using a streaming platform. Next, the collected information is pre-processed using data formatting mechanisms, including tokenization of text data and noise reduction. This ensures information consistency and facilitates analysis.

[0753] The analysis utilizes a variety of modal analysis methods. In this process, a general-purpose model is used for text analysis as a natural language processing model, while a general image recognition model is used for image and video data. Based on the analysis results, an anomaly detection method evaluates suspicious patterns and activities, and calculates an anomaly score. Based on this information, an emotion recognition method analyzes the user's emotional state, and messages and educational content are generated accordingly.

[0754] The device's role is to notify users of warnings and advice sent from the server. Information is communicated to users via push notifications and in-app messages, prompting appropriate responses based on their emotional state. This process ensures that information is presented in an easily understandable format, even when users are experiencing stress.

[0755] Users can receive notifications from their devices, immediately understand the necessary countermeasures, and decide on the actions they should take. They can also deepen their understanding of information technology through emotionally-based educational content. For example, when a phishing email is detected, the server selects and notifies the user of detailed countermeasures or a concise warning message based on their emotional state. An example of a prompt might be, "Analyze the potential threats hidden in the message received by the user and generate a customized warning message based on the emotional recognition results."

[0756] This system aims to provide a safe and reserved information access environment while taking into consideration the feelings of users.

[0757] The flow of the specific processing in Example 2 will be explained using Figure 13.

[0758] Step 1:

[0759] The server collects data from multiple sources on the network. It uses streaming services to acquire text, images, and video data in real time. The input consists of data from a large number of unspecified sources, which is then output as structured data.

[0760] Step 2:

[0761] The server uses data formatting techniques to properly process the collected data. Specifically, it tokenizes text using a natural language processing library and removes unnecessary information. Image and video data are resized and denoised using conversion tools. The input is the raw data acquired in step 1, and after processing, it is output as analyzable, formatted data.

[0762] Step 3:

[0763] The server analyzes the formatted data using various modal analysis methods. Specifically, it performs text analysis using a natural language processing model commonly used as a generative AI model, and extracts features from images and videos using an image recognition model. The input is the formatted data obtained in step 2, and the output is suspicious patterns and anomaly scores.

[0764] Step 4:

[0765] The server evaluates anomalies using anomaly detection means based on the analysis results and estimates the user's emotional state using emotion recognition means. The input is the analysis results from step 3, and the output is information on the presence or absence of anomalies, anomaly scores, and the user's emotional state. This allows for the customization of warnings and educational content.

[0766] Step 5:

[0767] The device notifies the user of warnings and advice sent from the server. This process uses push notifications and in-app messages, and the information is presented appropriately based on the user's emotional state. The input is the anomaly information and emotional data generated in step 4, and the output is a customized notification message displayed on the screen.

[0768] Step 6:

[0769] Users can receive notifications from their devices and take action based on the suggested solutions. They can also deepen their understanding of information technology through educational content. The input is the message received in step 5, and the output is the result of the user's specific actions and skill improvement.

[0770] (Application Example 2)

[0771] Next, we will explain application example 2. In the following explanation, the data processing device 12 will be referred to as the "server" and the robot 414 as the "terminal".

[0772] In today's information-saturated society, the information users receive includes risks such as phishing scams and misinformation. However, there is a lack of systems that can accurately and quickly detect these threats and provide appropriate responses tailored to the user's emotional state. Furthermore, improving users' information literacy to enable them to act safely is also a crucial challenge.

[0773] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means.

[0774] In this invention, the server includes data acquisition means for collecting data from the network in real time, data formatting means for preprocessing and formatting the collected data, and anomaly detection means for detecting and scoring anomalies based on the analysis results. This makes it possible to provide flexible notifications and learning opportunities based on the user's emotional state.

[0775] A "data acquisition method" is a mechanism that collects diverse information in real time via a network.

[0776] "Data formatting methods" refer to the processes of converting and formatting collected data into a format that is easy to analyze.

[0777] A "multimodal analysis method" is a mechanism for simultaneously analyzing multiple data formats (text, images, videos, etc.) to identify suspicious patterns.

[0778] An "anomaly detection method" is a process for detecting abnormal behaviors and patterns from analyzed data and assigning scores to them.

[0779] A "warning notification system" is a mechanism that provides warnings in a manner appropriate to the user's emotional state in response to detected anomalies.

[0780] A "means of presenting countermeasures" is a mechanism that shows users specific countermeasures for abnormalities or dangers, and adjusts the content according to their emotions.

[0781] "Content delivery means" refers to a function that provides educational content to improve information literacy in accordance with the user's emotional state and past behavioral history.

[0782] An "emotion engine" is a model or algorithm that analyzes user input data to infer the user's current emotional state.

[0783] To implement this invention, a system integrating a server, terminal, and user interface is required. The server collects text, image, and video data in real time from multiple data sources via a network. This data is preprocessed by data formatting means, and suspicious patterns are analyzed using natural language processing models and image / video analysis models. The server calculates an anomaly score and identifies potential threats to the user using anomaly detection means.

[0784] Furthermore, an emotion engine is used to analyze the user's emotional state from their input, and based on the results, it generates warning messages and educational content appropriate to the user's situation. The device receives notifications sent from the server and issues warnings in the most appropriate format corresponding to the user's emotional state. For example, if the user is relaxed, it provides detailed countermeasures, while if they are stressed, it provides a simple warning.

[0785] For example, when a user receives a phishing email, the server analyzes the email's suspicious characteristics and detects an anomaly. The sentiment engine assesses whether the user is calm, and if it confirms that the user is calm, it notifies the device with detailed countermeasures.

[0786] An example of a prompt message is, "Generate a notification message that effectively warns of emails that have been identified as potentially phishing scams."

[0787] These features are implemented as applications that run on the user's device, utilizing software tools such as Python, TensorFlow, and emotion recognition APIs. This system allows users to obtain necessary information safely and efficiently, improving safety in online activities.

[0788] The flow of a specific process in Application Example 2 will be explained using Figure 14.

[0789] Step 1:

[0790] The server collects data from the network in real time. It receives text, image, and video data from the internet as input and collects it using data acquisition methods. The output is a set of pre-processed data. Specifically, it accesses each data source via an API and downloads the data.

[0791] Step 2:

[0792] The server preprocesses the collected data using data formatting tools to prepare the format. The raw data collected in the previous step is used as input, and data in a format suitable for analysis is generated as output. This includes specific actions such as data cleaning and format conversion.

[0793] Step 3:

[0794] The server analyzes pre-processed data using natural language processing models and image / video analysis models. It uses formatted data as input and outputs analysis results that highlight suspicious patterns. The specific operations to run the models involve calculations using Python and TensorFlow.

[0795] Step 4:

[0796] The server detects anomalies based on the analysis results and calculates an anomaly score. The input is the analysis results of the model, and the output is anomaly information accompanied by an anomaly score. Specifically, it uses a scoring algorithm to quantify the degree of anomaly.

[0797] Step 5:

[0798] The server uses an emotion engine to infer the user's emotional state from their input data. The user's recent actions and input data are used as input, and the output is information indicating their emotional state. The specific operation involves data analysis using an emotion recognition API.

[0799] Step 6:

[0800] The terminal receives anomaly information and emotional state information from the server and delivers warnings to the user. Using the received information as input, a customized warning message for the user is generated as output. Specific actions include displaying the message to the user using a notification API.

[0801] Step 7:

[0802] The device presents the user with suggested solutions and provides educational content to improve information literacy based on their emotional state. Input consists of solutions and educational content sent from the server, while output is information displayed on the user's screen. Specific operations include rendering content on a graphical user interface (GUI).

[0803] The specific processing unit 290 transmits the result of the specific processing to the robot 414. In the robot 414, the control unit 46A causes the speaker 240 and the controlled object 443 to output the result of the specific processing. The microphone 238 acquires audio indicating user input for the result of the specific processing. The control unit 46A transmits the audio data indicating user input acquired by the microphone 238 to the data processing unit 12. In the data processing unit 12, the specific processing unit 290 acquires the audio data.

[0804] Data generation model 58 is a type of so-called generative AI (Artificial Intelligence). One example of data generation model 58 is ChatGPT (Internet search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search) <url: https: gemini.google.com ?hl="ja">Examples of generative AI include the following. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 is input with prompts containing instructions, and with inference data such as audio data representing speech, text data representing text, and image data representing images. The data generation model 58 infers from the input inference data according to the instructions indicated by the prompts, and outputs the inference results in data formats such as audio data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0805] In the above embodiment, an example was given in which the specific processing is performed by the data processing device 12, but the technology of this disclosure is not limited thereto, and the specific processing may also be performed by the robot 414.

[0806] Furthermore, the emotion identification model 59, acting as an emotion engine, may determine the user's emotion according to a specific mapping. Specifically, the emotion identification model 59 may determine the user's emotion according to a specific mapping, which is an emotion map (see Figure 9). Similarly, the emotion identification model 59 may also determine the robot's emotion, and the identification processing unit 290 may perform identification processing using the robot's emotion.

[0807] Figure 9 shows an emotion map 400 in which multiple emotions are mapped. In the emotion map 400, emotions are arranged in concentric circles radiating from the center. The closer to the center of the concentric circles, the more primitive the emotions are located. Further out of the concentric circles, emotions representing states and actions arising from mental states are located. Emotion is a concept that includes feelings and mental states. On the left side of the concentric circles, emotions that are generally generated from reactions occurring in the brain are located. On the right side of the concentric circles, emotions that are generally induced by situational judgment are located. Above and below the concentric circles, emotions that are generally generated from reactions occurring in the brain and induced by situational judgment are located. In addition, the emotion of "pleasure" is located on the upper side of the concentric circles, and the emotion of "displeasure" is located on the lower side. Thus, in the emotion map 400, multiple emotions are mapped based on the structure in which emotions arise, and emotions that are likely to occur simultaneously are mapped close together.

[0808] These emotions are distributed at the 3 o'clock position on the Emotion Map 400, and usually fluctuate between feelings of security and anxiety. In the right half of the Emotion Map 400, situational awareness takes precedence over internal feelings, resulting in a calm impression.

[0809] The inside of the Emotion Map 400 represents inner thoughts, while the outside represents actions. Therefore, the further you go from the outside of the Emotion Map 400, the more visible (expressed in actions) your emotions become.

[0810] Here, human emotions are based on various balances, such as posture and blood sugar levels. When these balances deviate from the ideal, it results in discomfort, and when they approach the ideal, it results in pleasure. Similarly, in robots, cars, motorcycles, etc., emotions can be created based on various balances, such as posture and battery level. When these balances deviate from the ideal, it results in discomfort, and when they approach the ideal, it results in pleasure. The emotion map can be generated, for example, based on Dr. Mitsuyoshi's emotion map (Research on a system for analyzing brain physiological signals of speech emotion recognition and emotion, Tokushima University, doctoral dissertation: https: / / ci.nii.ac.jp / naid / 500000375379). The left half of the emotion map contains emotions belonging to a region called "response," where sensation is dominant. The right half of the emotion map contains emotions belonging to a region called "situation," where situational awareness is dominant.

[0811] The emotion map defines two emotions that promote learning. One is the emotion around the middle of the negative "repentance" and "reflection" on the situation side. In other words, it is when the robot experiences negative emotions such as "I never want to feel this way again" or "I don't want to be scolded again." The other is the emotion around the positive "desire" on the reaction side. In other words, it is when the robot has positive feelings such as "I want more" or "I want to know more."

[0812] The emotion identification model 59 inputs user input into a pre-trained neural network, obtains emotion values ​​representing each emotion shown in the emotion map 400, and determines the user's emotion. This neural network is pre-trained based on multiple training data sets, which are combinations of user input and emotion values ​​representing each emotion shown in the emotion map 400. Furthermore, this neural network is trained so that emotions located close together have similar values, as shown in the emotion map 900 in Figure 10. Figure 10 shows an example where multiple emotions such as "reassured," "calm," and "confident" have similar emotion values.

[0813] The above description primarily focuses on the functions of the data processing device 12 in relation to this disclosure. However, the system related to this disclosure is not necessarily implemented on a server. The system related to this disclosure may be implemented as a general information processing system. This disclosure may be implemented, for example, as a software program that runs on a personal computer or as an application that runs on a smartphone. The method related to this disclosure may be provided to users in SaaS (Software as a Service) format.

[0814] In the above embodiment, an example was given in which a specific process is performed by a single computer 22. However, the technology of this disclosure is not limited thereto, and a distributed processing of the specific process may be performed by multiple computers, including computer 22. For example, a data generation model 58 may be provided in an external device of the data processing device 12, and the external device may generate data according to the input data.

[0815] In the above embodiment, an example was given in which the specific processing program 56 is stored in the storage 32, but the technology of this disclosure is not limited thereto. For example, the specific processing program 56 may be stored in a portable, computer-readable, non-temporary storage medium such as a USB (Universal Serial Bus) memory. The specific processing program 56 stored in the non-temporary storage medium is installed in the computer 22 of the data processing device 12. The processor 28 executes specific processing according to the specific processing program 56.

[0816] Alternatively, the specific processing program 56 may be stored in a storage device such as a server connected to the data processing device 12 via the network 54, and the specific processing program 56 may be downloaded and installed on the computer 22 in response to a request from the data processing device 12.

[0817] Furthermore, it is not necessary to store the entirety of the specific processing program 56 in a storage device such as a server connected to the data processing device 12 via the network 54, or to store the entirety of the specific processing program 56 in the storage 32; it is acceptable to store only a portion of the specific processing program 56.

[0818] The following types of processors can be used as hardware resources to perform specific processing. Examples of processors include a CPU, a general-purpose processor that functions as a hardware resource to perform specific processing by executing software, i.e., a program. Other examples of processors include dedicated electrical circuits, such as FPGAs (Field-Programmable Gate Arrays), PLDs (Programmable Logic Devices), or ASICs (Application Specific Integrated Circuits), which have circuit configurations specifically designed to perform specific processing. All of these processors have built-in or connected memory, and all of them perform specific processing by using memory.

[0819] The hardware resource that performs a specific process may consist of one of these various processors, or it may consist of a combination of two or more processors of the same or different types (for example, a combination of multiple FPGAs, or a combination of a CPU and an FPGA). Alternatively, the hardware resource that performs a specific process may consist of a single processor.

[0820] Examples of configurations using a single processor include, firstly, a configuration in which one or more CPUs and software are combined to form a single processor, and this processor functions as a hardware resource that performs a specific process. Secondly, there is a configuration using a processor that realizes the functions of the entire system, including multiple hardware resources that perform a specific process, on a single IC chip, as exemplified by SoCs (System-on-a-chip). In this way, a specific process is realized using one or more of the above types of processors as hardware resources.

[0821] Furthermore, the hardware structure of these various processors can more specifically utilize electrical circuits that combine circuit elements such as semiconductor devices. Also, the specific processing described above is merely an example. Therefore, it goes without saying that unnecessary steps can be deleted, new steps added, or the processing order rearranged, as long as it does not deviate from the main purpose.

[0822] The descriptions and illustrations presented above are detailed explanations of the technical aspects of this disclosure and are merely examples of the technical aspects. For example, the above descriptions of the structure, function, operation, and effect are examples of the structure, function, operation, and effect of the technical aspects of this disclosure. Therefore, it goes without saying that you may delete unnecessary parts, add new elements, or replace elements in the descriptions and illustrations presented above, as long as you do not deviate from the essence of the technical aspects of this disclosure. Furthermore, in order to avoid confusion and facilitate understanding of the technical aspects of this disclosure, explanations of common technical knowledge and the like that do not require special explanation to enable the implementation of the technical aspects of this disclosure have been omitted from the descriptions and illustrations presented above.

[0823] All documents, patent applications, and technical standards described herein are incorporated by reference to the same extent as if each individual document, patent application, and technical standard were specifically and individually noted to be incorporated by reference.

[0824] The following is further disclosed regarding the embodiments described above.

[0825] (Claim 1)

[0826] A data acquisition method that collects data from the network in real time,

[0827] A data formatting method for preprocessing and formatting the collected data,

[0828] A multimodal analysis means that analyzes preprocessed data and detects suspicious patterns,

[0829] An anomaly detection means that detects and scores anomalies based on the analysis results,

[0830] A warning notification means that notifies a warning about the detected anomaly,

[0831] A means of presenting countermeasures to users,

[0832] A content delivery method that provides educational content to users to improve their information literacy,

[0833] A system that includes this.

[0834] (Claim 2)

[0835] The system according to claim 1, characterized in that the anomaly detection means analyzes data using a natural language processing model and an image / video analysis model.

[0836] (Claim 3)

[0837] The system according to claim 1, characterized in that the content delivery means generates educational content based on the user's behavioral history.

[0838] "Example 1"

[0839] (Claim 1)

[0840] Information acquisition means for collecting information from a network in real time,

[0841] Information formatting means for preprocessing collected information and formatting it into a unified format,

[0842] An analysis means for analyzing pre-processed information and detecting suspicious patterns,

[0843] An anomaly detection means that detects and evaluates anomalies based on the analysis results,

[0844] A notification means for issuing warnings about detected anomalies,

[0845] A means of presenting a course of action to the user,

[0846] A means of providing educational materials to users to improve their digital literacy,

[0847] A means for generating educational materials based on information history,

[0848] A system that includes this.

[0849] (Claim 2)

[0850] The system according to claim 1, characterized in that it analyzes information using natural language processing technology and image / video analysis technology.

[0851] (Claim 3)

[0852] The system according to claim 1, characterized in that the notification means transmits a warning to an information device in real time.

[0853] "Application Example 1"

[0854] (Claim 1)

[0855] Information acquisition means for collecting information from a network in real time,

[0856] Information formatting means for preprocessing and formatting the collected information,

[0857] A multimodal analysis means that analyzes preprocessed information and detects suspicious patterns,

[0858] An anomaly detection means that detects and scores anomalies based on the analysis results,

[0859] A warning notification means that notifies a warning about the detected anomaly,

[0860] A safety guideline presentation method that presents users with guidelines for improving safety,

[0861] An information provision method that provides educational information to users to improve their information literacy,

[0862] A dynamic analysis method that analyzes the digital content accessed by users and assesses its risks,

[0863] A system that includes this.

[0864] (Claim 2)

[0865] The system according to claim 1, characterized in that the anomaly detection means analyzes data using a natural language processing model and a visual data analysis model.

[0866] (Claim 3)

[0867] The system according to claim 1, characterized in that the information provision means generates educational information based on the user's usage history.

[0868] "Example 2 of combining an emotion engine"

[0869] (Claim 1)

[0870] Information acquisition means for collecting information from a network in real time,

[0871] A data formatting method for pre-processing and shaping the collected information,

[0872] A variety of modal analysis means for analyzing pre-processed information and detecting suspicious patterns,

[0873] An anomaly detection means that detects and evaluates anomalies based on the analysis results,

[0874] A means of alerting and notifying about detected anomalies,

[0875] A means of presenting countermeasures to users,

[0876] A means of providing educational content to users to improve their understanding of information technology,

[0877] An emotion recognition means that recognizes the user's emotional state and generates a message adapted to that state,

[0878] A system that includes this.

[0879] (Claim 2)

[0880] The system according to claim 1, characterized in that the anomaly detection means analyzes information using a natural language processing model and an image / video analysis model, and provides notifications according to the user's emotional state based on the analysis.

[0881] (Claim 3)

[0882] The system according to claim 1, characterized in that the content delivery means generates educational content based on the user's behavioral history and emotional state.

[0883] "Application example 2 when combining with an emotional engine"

[0884] (Claim 1)

[0885] A data acquisition method that collects data from the network in real time,

[0886] A data formatting method for preprocessing and formatting the collected data,

[0887] A multimodal analysis means that analyzes preprocessed data and detects suspicious patterns,

[0888] An anomaly detection means that detects and scores anomalies based on the analysis results,

[0889] A warning notification means that notifies the user of a detected anomaly and adjusts the warning method according to the user's emotional state,

[0890] A means of presenting solutions to users and providing simple or detailed guidance according to their emotional state,

[0891] A content delivery method that provides users with educational content to improve their information literacy, based on their emotional state and past behavioral history.

[0892] A system that includes this.

[0893] (Claim 2)

[0894] The system according to claim 1, characterized in that the anomaly detection means analyzes data using a natural language processing model and an image / video analysis model, and includes an emotion engine that recognizes the user's emotions.

[0895] (Claim 3)

[0896] The system according to claim 1, characterized in that the content delivery means generates and provides educational content based on the user's behavioral history and emotional state. [Explanation of symbols]

[0897] 10, 210, 310, 410 Data Processing Systems 12 Data Processing Devices 14 Smart Devices 214 Smart Glasses 314 Headset-type terminal 414 Robots< / url:> < / url:> < / url:> < / url:>

Claims

1. Information acquisition means for collecting information from a network in real time, Information formatting means for preprocessing and formatting the collected information, A multimodal analysis means that analyzes preprocessed information and detects suspicious patterns, An anomaly detection means that detects and scores anomalies based on the analysis results, A warning notification means that notifies a warning about the detected anomaly, A safety guideline presentation method that presents users with guidelines for improving safety, An information provision method that provides educational information to users to improve their information literacy, A dynamic analysis method that analyzes the digital content accessed by users and assesses its risks, A system that includes this.

2. The system according to claim 1, characterized in that the anomaly detection means analyzes data using a natural language processing model and a visual data analysis model.

3. The system according to claim 1, characterized in that the information provision means generates educational information based on the user's usage history.

Images