system

Abstract

Provide a system. 【Solution means】 Means for collecting log data in real time, Means for converting the log data into a unified format, Means for extracting and classifying error logs from the log data using a generation model, Means for identifying the cause based on the error log and proposing a solution, Means for detecting and warning security incidents, Means for identifying system performance failures and proposing improvement measures, Means for adding the analysis results to the knowledge base and automatically notifying the management organization, A system including means for visualizing the analysis results using a mobile information terminal and notifying in real time.

Description

Technical Field

[0001] The technology of the present disclosure relates to a system.

Background Art

[0002] Patent Document 1 discloses a method for controlling a persona chatbot, which is performed by at least one processor, the method including steps of receiving a user utterance, adding the user utterance to a prompt including an instruction sentence related to an explanation of a character of the chatbot, encoding the prompt, and inputting the encoded prompt into a language model to generate a chatbot utterance in response to the user utterance.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] Problems in modern information systems are that it takes time to identify the cause of an error, detection of security incidents is delayed, it is difficult to identify bottlenecks where system performance degrades, and knowledge sharing is performed manually and takes time. In particular, in an environment where a large amount of diverse log data is generated, these problems become even more serious. The object of this invention is to improve the reliability and performance of a system and enable rapid problem solving.

Means for Solving the Problems

[0005] This invention provides a means for collecting log data in real time and converting it into a unified format. It extracts and classifies error logs using a generative model, identifies the cause based on those error logs, and proposes appropriate solutions. Furthermore, it includes means for detecting and warning about security incidents, and for identifying system performance bottlenecks and proposing improvement measures. It also adds analysis results to a knowledge base and automatically notifies the team in real time, thereby sharing past incidents and contributing to the prevention of future problems. In this way, it achieves efficient error management and rapid problem resolution.

[0006] "Log data" refers to recorded information generated while a system or application is running, including operation history, error information, and performance data.

[0007] A "unified format" is a format that converts data in various forms into a consistent data structure to facilitate analysis and processing.

[0008] A "generative model" is an algorithm trained using machine learning or AI technology to perform pattern recognition and prediction on new data.

[0009] An "error log" is a log entry that indicates anomalies or failures that have occurred in a system or application.

[0010] A "security incident" is an event that indicates a violation or threat to security policies in an information system.

[0011] A "bottleneck" is the main factor or obstacle that limits the performance of a system.

[0012] A "knowledge base" is an information resource that stores the results of analyses and solutions to past incidents, enabling the sharing and utilization of knowledge.

[0013] "Automatic notification" is a function that automatically informs relevant parties based on pre-set conditions when the system detects a specific event or analysis result. [Brief explanation of the drawing]

[0014] [Figure 1] This is a conceptual diagram showing an example of the configuration of a data processing system according to the first embodiment. [Figure 2] This is a conceptual diagram showing an example of the essential functions of a data processing device and a smart device according to the first embodiment. [Figure 3] This is a conceptual diagram showing an example of the configuration of a data processing system according to the second embodiment. [Figure 4] This is a conceptual diagram showing an example of the main functions of a data processing device and smart glasses according to the second embodiment. [Figure 5] This is a conceptual diagram showing an example of the configuration of a data processing system according to the third embodiment. [Figure 6] This is a conceptual diagram showing an example of the main functions of a data processing device and a headset-type terminal according to the third embodiment. [Figure 7] This is a conceptual diagram showing an example of the configuration of a data processing system according to the fourth embodiment. [Figure 8] This is a conceptual diagram showing an example of the main functions of a data processing device and a robot according to the fourth embodiment. [Figure 9] This shows an emotion map where multiple emotions are mapped. [Figure 10] This shows an emotion map where multiple emotions are mapped. [Figure 11] This is a sequence diagram showing the processing flow of the data processing system in Example 1. [Figure 12] This is a sequence diagram showing the processing flow of the data processing system in Application Example 1. [Figure 13] This is a sequence diagram showing the processing flow of the data processing system in Example 2, which incorporates an emotion engine. [Figure 14]It is a sequence diagram showing the processing flow of a data processing system in Application Example 2 when a sentiment engine is combined.

Embodiments for Carrying Out the Invention

[0015] Hereinafter, an example of an embodiment of a system according to the technology of the present disclosure will be described with reference to the accompanying drawings.

[0016] First, the terms used in the following description will be explained.

[0017] In the following embodiments, a processor with a reference number (hereinafter simply referred to as "processor") may be one arithmetic unit or a combination of a plurality of arithmetic units. Also, the processor may be one type of arithmetic unit or a combination of a plurality of types of arithmetic units. Examples of arithmetic units include a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), a GPGPU (General-Purpose computing on Graphics Processing Units), an APU (Accelerated Processing Unit), and the like.

[0018] In the following embodiments, a RAM (Random Access Memory) with a reference number is a memory in which information is temporarily stored and is used as a work memory by the processor.

[0019] In the following embodiments, a storage with a reference number is one or more non-volatile storage devices that store various programs and various parameters and the like. Examples of non-volatile storage devices include flash memory (SSD (Solid State Drive)), magnetic disks (e.g., hard disks), or magnetic tapes, and the like.

[0020] In the following embodiments, the signed communication interface (I / F) is an interface that includes a communication processor and an antenna, etc. The communication interface manages communication between multiple computers. Examples of communication standards applicable to the communication interface include wireless communication standards such as 5G (5th Generation Mobile Communication System), Wi-Fi (registered trademark), or Bluetooth (registered trademark).

[0021] In the following embodiments, "A and / or B" is synonymous with "at least one of A and B." That is, "A and / or B" means that it may be A alone, or B alone, or a combination of A and B. Furthermore, in this specification, the same concept as "A and / or B" applies when expressing three or more things linked by "and / or."

[0022] [First Embodiment]

[0023] Figure 1 shows an example of the configuration of the data processing system 10 according to the first embodiment.

[0024] As shown in Figure 1, the data processing system 10 includes a data processing device 12 and a smart device 14. An example of the data processing device 12 is a server.

[0025] The data processing device 12 comprises a computer 22, a database 24, and a communication interface 26. The computer 22 is an example of a "computer" related to the technology of this disclosure. The computer 22 comprises a processor 28, RAM 30, and storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication interface 26 are also connected to the bus 34. The communication interface 26 is connected to a network 54. An example of the network 54 is a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0026] The smart device 14 comprises a computer 36, a reception device 38, an output device 40, a camera 42, and a communication interface 44. The computer 36 comprises a processor 46, RAM 48, and storage 50. The processor 46, RAM 48, and storage 50 are connected to a bus 52. The reception device 38, output device 40, and camera 42 are also connected to the bus 52.

[0027] The reception device 38 is equipped with a touch panel 38A and a microphone 38B, etc., and receives user input. The touch panel 38A receives user input by detecting contact with an object (e.g., a pen or finger). The microphone 38B receives user input by detecting the user's voice. The control unit 46A transmits data indicating the user input received by the touch panel 38A and microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the data indicating the user input.

[0028] The output device 40 includes a display 40A and a speaker 40B, and presents data to the user 20 by outputting the data in a form perceptible to the user 20 (e.g., audio and / or text). The display 40A displays visible information such as text and images according to instructions from the processor 46. The speaker 40B outputs audio according to instructions from the processor 46. The camera 42 is a small digital camera equipped with an optical system such as a lens, aperture, and shutter, and an image sensor such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor.

[0029] Communication interface 44 is connected to network 54. Communication interfaces 44 and 26 are responsible for the exchange of various types of information between processor 46 and processor 28 via network 54.

[0030] Figure 2 shows an example of the main functions of the data processing device 12 and the smart device 14.

[0031] As shown in Figure 2, in the data processing device 12, a specific processing is performed by the processor 28. A specific processing program 56 is stored in the storage 32. The specific processing program 56 is an example of a "program" related to the technology of this disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 according to the specific processing program 56 executed on the RAM 30.

[0032] The storage 32 stores the data generation model 58 and the emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0033] In the smart device 14, the processor 46 performs the reception output processing. The storage 50 stores the reception output program 60. The reception output program 60 is used in conjunction with a specific processing program 56 by the data processing system 10. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output processing is realized by the processor 46 operating as a control unit 46A according to the reception output program 60 executed on the RAM 48.

[0034] Next, the specific processing performed by the specific processing unit 290 of the data processing device 12 will be described. In the following description, the data processing device 12 will be referred to as the "server" and the smart device 14 as the "terminal".

[0035] The system according to the present invention includes a program for monitoring the operating status of an information system in real time, analyzing log data, and quickly identifying and resolving problems. The operation of this program is described below.

[0036] First, the server receives log data sent from each component of the system in real time and converts it into a unified format. This allows for consistent analysis of log data in different formats.

[0037] Next, the server analyzes the log data using a generative model. This analysis identifies bottlenecks causing errors and performance degradation, and based on that, identifies the root cause and solution. This process includes predictive algorithms that leverage historical log data and incident history.

[0038] Furthermore, the server detects sections of log data related to security incidents and, if necessary, warns the user with details of the incident. This warning is provided in real time to encourage a quick response.

[0039] The analysis results are added to the system's knowledge base. This knowledge base allows teams to share information, leading to more efficient problem-solving and prevention of future incidents.

[0040] As a concrete example, consider a scenario where a server detects a significant network delay. The server analyzes log data and identifies an abnormally high load on a specific router. Once the cause of the problem is identified, the user can adjust network settings to distribute the load on that router, thereby resolving the delay issue. Furthermore, this solution is recorded in a knowledge base, which can be used to address similar cases in the future.

[0041] Thus, the system of the present invention can improve the reliability and efficiency of the system by enabling rapid error identification and resolution through real-time analysis, and further by accumulating and sharing knowledge.

[0042] The following describes the processing flow.

[0043] Step 1:

[0044] The server collects log data sent from each application and device within the system in real time. This process uses a file watcher that periodically checks for updates to the log files, immediately detecting newly recorded log entries.

[0045] Step 2:

[0046] The server converts the collected log data in various formats into a unified format. Specifically, it uses regular expressions to extract timestamps, error levels, message content, etc., from log entries and organizes them into JSON or XML format.

[0047] Step 3:

[0048] The server analyzes the transformed log data using a generative model. This model is based on machine learning algorithms and extracts error logs from the log data, classifying them based on the error level and message content.

[0049] Step 4:

[0050] The server identifies the cause of the error based on the error log and proposes a solution. At this stage, a predictive algorithm based on past incident data is applied to suggest solutions for similar problems.

[0051] Step 5:

[0052] The server detects security incidents based on log data. It monitors unusual user behavior and system access, and issues real-time warnings to users if an anomaly is detected.

[0053] Step 6:

[0054] The server analyzes system performance data to identify bottlenecks causing performance degradation. This uses monitoring data such as CPU usage and memory usage, and suggests improvement measures.

[0055] Step 7:

[0056] The server adds these analysis results to the knowledge base and automatically notifies the entire team in real time. Users can then access the knowledge base and share past incident information within the team, which helps prevent future incidents.

[0057] (Example 1)

[0058] Next, we will describe Example 1. In the following description, the data processing device 12 will be referred to as the "server," and the smart device 14 will be referred to as the "terminal."

[0059] In increasingly complex information processing systems, real-time error detection and rapid response are essential. However, conventional systems have struggled with the diverse formats of log information, making rapid and accurate analysis difficult. Furthermore, in addition to early detection and countermeasures for safety incidents, there has been a lack of mechanisms for learning effective solutions from past cases and efficiently accumulating and sharing knowledge. Therefore, there is a need to comprehensively solve the various problems that systems face.

[0060] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 1 is realized by the following means.

[0061] In this invention, the server includes means for acquiring log information in real time, means for converting the log information into a standard format, and means for extracting and classifying abnormal logs from the log information using a generative artificial intelligence model. This enables the unified analysis of diverse log information in real time, allowing for rapid error detection, the presentation of countermeasures, and the effective accumulation and sharing of knowledge.

[0062] "Log information" refers to data files that record the operation and status of an information processing system.

[0063] "Real-time" is a temporal concept that indicates that information acquisition and processing occur immediately.

[0064] A "standard format" is a common data format used to handle different data formats in a unified manner.

[0065] A "generative artificial intelligence model" is a machine learning model used to analyze data and learn patterns.

[0066] An "abnormal log" is log information that includes errors and warnings that deviate from normal system operation.

[0067] "Classification" is the act of dividing information into categories based on specific criteria.

[0068] A "security incident" refers to a problem or accident related to the security of an information system.

[0069] A "bottleneck" is a factor that limits the performance or processing speed of a system.

[0070] A "solution" is a plan or action to solve a specific problem.

[0071] "Analysis results" refer to conclusions or insights derived from the analysis of data.

[0072] A "knowledge aggregate" is a database that compiles past analysis results and empirical knowledge.

[0073] "Automatic notification" refers to a system that provides necessary information without requiring manual intervention.

[0074] A "factor" is a cause or factor that leads to a result.

[0075] A "solution" is a specific method or means of solving a problem.

[0076] "Case data" refers to information about specific events and situations that have occurred in the past.

[0077] A "working team" is a group formed to achieve a specific objective.

[0078] This invention is a technology for analyzing multiple log data in real time during the operation of an information processing system, and for quickly identifying and resolving problems. This system functions through the collaboration of a server, terminals, and users.

[0079] First, the server acquires log information from various components of the information processing system. Since log information is often in different formats, the server converts it to a standard format. This makes it possible to consistently analyze log information in different formats. The server uses a generative artificial intelligence model to extract and classify anomalies from the log information. In this analysis process, pattern recognition algorithms are used to identify system bottlenecks and safety incidents.

[0080] The terminal operates a database as a collection of knowledge, storing and sharing analysis results provided from the server. The interface on the terminal allows the team to view and edit analysis results and past case data, facilitating information sharing.

[0081] Users receive notifications from the server and take necessary actions to resolve the issue based on the results. For example, they might adjust the settings of specific network components and distribute the load to resolve latency or performance problems.

[0082] As a concrete example, if the server detects an abnormal delay in the network one day, the user can identify the cause and take immediate action. In this case, the server generates a prompt message such as, "Split the high-load session from a specific device and redistribute it across the entire network." This allows the user to receive assistance in taking specific measures.

[0083] With the system configuration described above, the present invention enables efficient and precise real-time analysis in complex and diverse information processing systems, and improves the reliability and efficiency of the entire system through the accumulation and sharing of knowledge.

[0084] The flow of the specific processing in Example 1 will be explained using Figure 11.

[0085] Step 1:

[0086] The server collects log information in real time from each component of the system. Its input is log information in various formats generated by each component. Specifically, the server immediately retrieves this raw information and temporarily stores it in various storage locations for later analysis. The output consists of log information awaiting conversion to a unified format.

[0087] Step 2:

[0088] The server converts the collected log information into a standard format. The input consists of log information in different formats prepared in Step 1. The server analyzes these logs and converts each item into a standardized timestamp and message structure. The output is log information formatted in a way that can be interpreted by the generating AI model.

[0089] Step 3:

[0090] The server analyzes the log information, which has been converted to a standard format, using a generative artificial intelligence model. The input includes the log information converted in step 2. Specifically, the server utilizes the AI ​​model to scan the data and identify patterns in abnormal logs. The output is an analysis result that includes error classification and an initial diagnosis of the cause.

[0091] Step 4:

[0092] The server classifies the error log and identifies the cause based on the analysis results, and generates prompt messages suggesting solutions. The input is the analysis results from step 3. The server analyzes this and uses AI to generate specific countermeasures and improvement measures appropriate to the situation. The output provides prompt messages indicating the actions the user should take.

[0093] Step 5:

[0094] The server detects security incidents in the log information and issues warnings to the user as needed. The input consists of log information in a standard format prepared in step 2 and the analysis results from steps 3 and 4. Specifically, the server uses an anomaly detection algorithm to immediately identify unauthorized access and security threats. The output includes warning messages to allow the user to react quickly.

[0095] Step 6:

[0096] The server adds the analysis results to the knowledge set and automatically notifies the work team via terminals. Inputs include analysis results and warnings from steps 4 and 5. Outputs include the newly updated knowledge set data and related notifications. This allows each member to easily access and prepare for similar problems.

[0097] (Application Example 1)

[0098] Next, we will explain Application Example 1. In the following explanation, the data processing device 12 will be referred to as the "server," and the smart device 14 will be referred to as the "terminal."

[0099] In today's information technology environment, real-time monitoring and rapid problem-solving are essential to maintaining system reliability and efficiency. However, properly analyzing vast amounts of log data and taking immediate action is not easy. Furthermore, there is a need for effective methods to learn from past incidents and share the knowledge gained. In particular, there is a demand for immediate notifications and displays utilizing mobile devices.

[0100] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 1 is realized by the following means.

[0101] In this invention, the server includes means for collecting log data in real time, means for converting the log data into a unified format, and means for extracting and classifying error logs from the log data using a generative model. This enables immediate analysis of data collected from each component of the information system. Furthermore, by incorporating means for visualizing the analysis results using a mobile device and notifying them in real time, administrators can quickly address problems anytime, anywhere. This system significantly improves the reliability and efficiency of the server and enables proactive problem solving by leveraging knowledge from past incidents.

[0102] "Log data" refers to data that records the operating status and error information of an information system.

[0103] "Means of real-time collection" refers to a device or process for instantly acquiring log data the moment information is generated.

[0104] "Methods for converting to a unified format" refers to a function that organizes and converts log data recorded in different formats into a consistent format.

[0105] A "generative model" is a mathematical or computational model designed to perform pattern recognition or prediction using historical data.

[0106] An "error log" is a record that shows abnormalities or problems that occurred during the operation of a system.

[0107] A "security incident" is an unauthorized access, data breach, or other breach that could compromise the confidentiality, integrity, or availability of an information system.

[0108] A "system performance failure" is a problem that arises when an information system fails to perform as expected.

[0109] "Means of proposing improvement measures" refers to the function of presenting appropriate actions or measures to solve identified problems.

[0110] A "knowledge base" is a collection of information that systematically organizes past incidents and problem-solving solutions so that they can be used later.

[0111] A "management body" is a team or organization responsible for the operation and maintenance of a system.

[0112] A "portable information terminal" refers to a handheld information display device such as a smartphone or tablet.

[0113] "Visualization" is the process of visually displaying data and analysis results to communicate them in an easy-to-understand manner.

[0114] "Immediately" means that something is done without any delay.

[0115] This invention realizes a system that improves the performance of information systems by collecting and analyzing log data in real time. A specific embodiment of this system is described below.

[0116] The server first receives log data in real time from each component within the system. This process utilizes a data collection framework such as Fluentd. Since the received log data may be in various formats, it is converted to a unified format via Fluentd. This conversion enables consistent analysis within the database.

[0117] Next, the server uses software tools such as TENSORFLOW® and Scikit-learn to build generative models and analyze log data in a unified format. In this analysis process, the system identifies the causes of errors and system performance issues and proposes solutions based on these findings. Furthermore, in the event of a security incident, it can immediately identify the details and generate appropriate warnings.

[0118] Furthermore, analysis results and warnings are displayed in real time on mobile devices. A notification system using Firebase Push Notifications allows users to quickly understand the situation no matter where they are. This application uses the analysis results to update its knowledge base, accumulating information to prevent future incidents.

[0119] For example, if a specific server experiences an abnormal load during business hours, this system immediately detects the situation and sends a notification to the user's mobile device, including a suggestion for load balancing. Based on this information, the user can respond quickly and restore stable system operation. This rapid feedback and response process significantly improves the efficiency of the information system.

[0120] Examples of prompt messages include the following:

[0121] "Please analyze the abnormal logs detected on the servers within the data center. Generate a report on the cause and recommended countermeasures. Also, check if there have been similar cases in the past and include past countermeasures."

[0122] The flow of a specific process in Application Example 1 will be explained using Figure 12.

[0123] Step 1:

[0124] The server collects all incoming log data in real time from each component of the system. This input data includes information such as time, message content, and error level. The server uses Fluentd to convert log data in different formats into a standardized, unified format and temporarily stores it in a database.

[0125] Step 2:

[0126] The server analyzes the log data, which has been converted to a unified format, using a generating AI model. The input data used is the data converted in step 1, and the output generates error types and frequencies, as well as the overall system operating status. This analysis utilizes a machine learning model using TensorFlow to perform data calculations for anomaly detection and to identify performance bottlenecks.

[0127] Step 3:

[0128] Based on the analysis results, the server generates solutions to identified errors and performance issues and updates its knowledge base. This data, based on input from the generated AI model, is output as a concrete action plan for the user. It proposes standard solutions to identified problems and stores past success stories and countermeasures in the knowledge base.

[0129] Step 4:

[0130] The device displays real-time analysis results from the server and immediately notifies the administrator. Input data includes server analysis results and knowledge base update information. Output includes direct notifications using Firebase Push Notifications and detailed displays on the device screen. This allows users to stay informed about the system status regardless of their location.

[0131] Step 5:

[0132] Users perform system configuration changes and troubleshooting based on notifications from their terminals. Inputs include solutions provided by the terminal and system log information, while output results in improved system performance and problem resolution. Specific actions include adjusting network settings and reviewing resource allocation. This process enables optimal system operation.

[0133] Furthermore, an emotion engine that estimates the user's emotions may be incorporated. That is, the identification processing unit 290 may use the emotion identification model 59 to estimate the user's emotions and perform identification processing using the user's emotions.

[0134] The system according to the present invention is based on a function that analyzes log data of an information system in real time, and adds an emotion engine that recognizes user emotions in real time. By combining technical insights derived from the analysis of log data with the emotional state of the user captured by the emotion engine, this system achieves more responsive system operation.

[0135] First, the server collects log data in real time and converts it into a unified format. Next, it analyzes the log data using a generative model to extract and classify error logs. This allows for the early detection of anomalies and bottlenecks within the system, and enables root cause identification and solution proposals based on these findings. This process utilizes past incident data for learning.

[0136] In addition, the emotion engine analyzes user input, such as text and voice, to extract the user's emotional state. This emotional information can be used to adjust the system's operation, particularly the user interface. For example, if a user is frustrated, the system can suggest improving response speed or simplifying interactions.

[0137] Furthermore, the server adds sentiment information to the knowledge base and records incidents related to emotions. This lays the foundation for developing future system improvements that take emotions into account.

[0138] As a concrete example, consider a case where a user is dissatisfied with the system's response to a particular operation on a given day. The emotion engine detects this situation in real time, and by comparing this information with the system's analysis results, the server promptly proposes countermeasures. For example, it might suggest simplifying the operation procedure or reviewing resource allocation to shorten response times. As a result, user dissatisfaction is reduced, the knowledge base is updated, and the ability to handle similar cases improves.

[0139] Thus, by integrating emotion recognition and log analysis, the system of the present invention can optimize the user experience and improve the reliability and efficiency of the system.

[0140] The following describes the processing flow.

[0141] Step 1:

[0142] The server collects log data generated from each application and hardware in real time. This is done using tools that continuously monitor log file updates and automatically receive log data whenever it is generated.

[0143] Step 2:

[0144] The server converts the collected log data into a unified format. Specifically, it uses regular expressions to extract necessary information (such as timestamps and error messages) from log entries and organizes it into an easily parsable data format such as JSON.

[0145] Step 3:

[0146] The server analyzes the log data transformed by the generative model. It extracts error logs from the log data and classifies them based on the type and location of the error. This analysis identifies potential problems in the system.

[0147] Step 4:

[0148] The emotion engine analyzes user text messages and voice input in real time to identify emotions. It uses natural language processing (NLP) techniques to infer emotions from text and voice analysis to infer emotions from intonation and tone.

[0149] Step 5:

[0150] The server integrates analyzed log data and sentiment information to adjust system responses. For example, if it detects that a user is expressing dissatisfaction, the server may suggest improvements to the user interface and use this as a trigger to optimize system performance.

[0151] Step 6:

[0152] The server adds analyzed log data and sentiment data to a knowledge base, recording incidents involving emotions. This allows the entire team to share incident information and use it for future problem feedback.

[0153] Step 7:

[0154] After receiving improvement suggestions from the server, the user adjusts system operations and settings. They send back feedback on the interface and evaluate the effectiveness of the system response.

[0155] In this way, this system integrates technical log analysis and emotion recognition, enabling intelligent system operation tailored to the user's needs and emotional state.

[0156] (Example 2)

[0157] Next, we will describe Example 2. In the following description, the data processing device 12 will be referred to as the "server" and the smart device 14 as the "terminal".

[0158] In the operation of information systems, while real-time extraction and processing of error logs are required, system response optimization that reflects the emotional state of users is not adequately performed. Furthermore, there is a lack of mechanisms to share this information across the entire organization and to implement rapid responses and improvements.

[0159] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 2 is realized by the following means.

[0160] In this invention, the server includes means for collecting log information in real time, means for extracting and classifying error logs using a generative AI model, and means for analyzing the user's emotional state. This enables rapid processing of error logs and adjustment of responses based on the user's emotions.

[0161] "Log information" refers to records of data collected in real time from information systems.

[0162] A "unified format" is a data format that facilitates analysis by converting data from different formats into a consistent format.

[0163] A "generative AI model" is a mathematical model that uses artificial intelligence to analyze data and perform pattern recognition and prediction.

[0164] An "error" refers to a problem or anomaly that prevents a system from functioning normally.

[0165] "Methods for identifying causes and proposing solutions" refers to the process of analyzing the causes of errors or problems and providing solutions.

[0166] A "security incident" refers to an event or action that could potentially affect the security of a system.

[0167] A "bottleneck" refers to a factor or process that reduces the processing power of a system.

[0168] A "knowledge base" is a database that stores past experiences and analysis results related to system operation.

[0169] "Text and voice input" refers to information provided by the user to the system in the form of text or voice.

[0170] "Emotional state" refers to the psychological state a user exhibits through their input into the system.

[0171] "Means for adjusting system response" refers to functions that modify and optimize system operation based on the user's emotional state and analysis results.

[0172] This invention improves system efficiency and user experience in an information processing system by performing real-time analysis of log information and system responses that reflect the user's emotional state.

[0173] The server collects log information from information systems in real time and converts it into a unified format. This format conversion facilitates subsequent analysis. Based on the collected log information, an AI model is used to extract and classify errors, enabling early detection of anomalies and bottlenecks within the system.

[0174] The emotion engine uses natural language processing techniques to analyze text and voice input from the user and extract their emotional state. The extracted emotional information is used by the server to optimize system responses. Specifically, if the user is expressing frustration, the server re-evaluates resource allocation to improve response speed. It also suggests simplifying the user interface if the operation is complex.

[0175] The system's knowledge base is updated by combining emotional information and analysis results. This creates a comprehensive database including past event data, laying the foundation for future system improvements.

[0176] For example, if a user inputs something like, "This operation takes too long," the emotion engine immediately analyzes that dissatisfaction. The server then compares this emotion information with log analysis to identify the bottleneck process and suggest improvements. For instance, improving the system's response speed can alleviate user dissatisfaction.

[0177] An example of a prompt for a generative AI model is, "Analyze the user's current emotional state from their log data and generate suggestions for the system's response."

[0178] Thus, the system of the present invention can provide a highly responsive information processing system by combining log analysis and emotion recognition.

[0179] The flow of the specific processing in Example 2 will be explained using Figure 13.

[0180] Step 1:

[0181] The server collects log information from information systems in real time. The input consists of raw log data from network devices and applications. The server receives this data and integrates each data entry, adding timestamps as needed, to create a pure data stream.

[0182] Step 2:

[0183] The server converts the collected log information into a unified format. The input is the raw log data collected in Step 1. This data is analyzed and converted into a unified format that is easy for the generating AI model to process. The output is log data converted into a unified format, guaranteeing data consistency and completeness.

[0184] Step 3:

[0185] The server uses a generative AI model to extract and classify errors from log data in a unified format. The input is the log data in a unified format generated in step 2. The data is fed into the AI ​​model to detect and classify errors and anomalies. In this process, machine learning algorithms are used to identify specific error patterns, and the output is an error report classified by severity.

[0186] Step 4:

[0187] The emotion engine receives text and voice input from the user, analyzes it, and extracts the user's emotional state. Input includes natural language instructions and voice data obtained from the user interface. The data is processed using an emotion analysis algorithm, and the output is the user's emotional state (e.g., satisfied, dissatisfied, stressed).

[0188] Step 5:

[0189] The server combines the sentiment information obtained by the sentiment engine with the error report from step 3 to adjust the system's response. The inputs are the sentiment data and error classification data from the previous step. The server refers to these and, if necessary, reallocates system resources or adjusts processes. The output is a proposal for optimized system settings and user interface changes.

[0190] Step 6:

[0191] The server adds emotional states and analysis results to its knowledge base, accumulating information for future improvements. The input is the system's response information adjusted or determined in step 5. This information is added to the knowledge base and stored as reference information for handling similar cases. The output is an updated knowledge base.

[0192] (Application Example 2)

[0193] Next, we will explain application example 2. In the following explanation, the data processing device 12 will be referred to as a "server" and the smart device 14 as a "terminal".

[0194] Current information systems lack real-time incident response that takes user emotions into consideration, resulting in insufficient optimization of system reliability and user experience. Furthermore, rapid and appropriate improvements are required in resolving security incidents and system performance bottlenecks.

[0195] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means.

[0196] In this invention, the server includes means for collecting log information in real time, means for converting the log information into a unified format, and means for extracting and classifying error logs from the log information using a generative AI model. This enables the rapid identification of security incidents and system performance bottlenecks, and allows for the adjustment of the interface to take user sentiment into consideration.

[0197] "Log information" refers to data that records the operating status of an information system.

[0198] "Methods for collecting information in real time" refer to methods for instantly acquiring information and storing it in a database or similar system.

[0199] "Methods for converting to a unified format" refer to methods for organizing data expressed in different formats into a consistent format.

[0200] "Using a generative AI model" means using a model that leverages machine learning techniques to find patterns and features from data.

[0201] "Means for extracting and classifying error logs" refers to a method for identifying errors in a system and organizing them according to similar error patterns.

[0202] A "security incident" is an event that causes intentional or accidental unauthorized access or threat to a system or data.

[0203] A "performance bottleneck" is a major factor or point of failure that degrades the overall performance of a system.

[0204] A "knowledge base" is a database that stores past cases and learned information to be used for decision-making and problem-solving.

[0205] "Means of recognizing user emotions" refers to technologies that determine a user's emotional state by analyzing their input data.

[0206] "Adjusting the user interface" means modifying and optimizing the operation screen and procedures to improve user convenience.

[0207] To implement this invention, a server for real-time monitoring of the information system and a terminal equipped with an emotion engine for detecting the user's emotions are required.

[0208] The server continuously collects log information from information systems and converts it into a unified format. Next, it uses a generative AI model to analyze this log information, extracting and classifying error logs. During this process, the server instantly detects security incidents and performance bottlenecks within the system based on specific error patterns, and alerts users and administrators. The analysis results are automatically added to a knowledge base and communicated to the entire team.

[0209] The device is equipped with an emotion engine that analyzes user emotions in real time based on user input, particularly text and voice data. If a user experiences frustration or anxiety while using the system, the device immediately evaluates those emotions and adjusts the user interface in conjunction with the server to provide a better user experience.

[0210] For example, if a user operates a smart home security system and expresses anxiety, the emotion engine can detect that emotion, and the server can suggest simplifying the user interface. Furthermore, using a generative AI model, it is possible to prioritize processing the most important error messages the system encounters.

[0211] An example of a prompt message is, "Given the user's speech data, determine the primary emotions detected, and suggest UI adjustments based on the levels of anxiety or frustration." This is intended to detect the primary emotions based on the user's speech data and suggest UI adjustments based on the level of anxiety or frustration.

[0212] The flow of a specific process in Application Example 2 will be explained using Figure 14.

[0213] Step 1:

[0214] The server collects log information from information systems in real time. This log information contains detailed records of various system events. The input log data is stored in a database inside the server.

[0215] Step 2:

[0216] The server converts the collected log information into a unified format. Here, log data stored in different formats and styles is organized into a consistent data format. The resulting unified log data becomes the input for the next analysis step.

[0217] Step 3:

[0218] The server uses a generative AI model to analyze log data in a unified format, extracting and classifying error logs. During the analysis, pattern recognition technology is used to distinguish between normal logs and abnormal (error) logs. As a result, specific error logs are extracted and sent to the next step.

[0219] Step 4:

[0220] The server identifies security incidents and performance bottlenecks based on extracted error logs. Here, it uses past incident data as a reference and a generative AI model to make predictions and determine the presence of problems. Identified incident information is output as a warning.

[0221] Step 5:

[0222] The server adds the analysis results to the knowledge base and automatically notifies the entire group of incident information. This notification process allows the team to quickly share incident details and take appropriate action.

[0223] Step 6:

[0224] The device receives user input, particularly voice and text data, and analyzes emotions using an emotion engine. This analysis classifies the user's emotional state and identifies emotions such as frustration and anxiety.

[0225] Step 7:

[0226] The device adjusts the user interface in cooperation with the server based on the analyzed user emotions. Specifically, if the user feels anxious, it simplifies the screen and provides audio guidance, among other interface improvements. An example of a prompt for this process is, "Given the user's speech data, determine the primary emotions detected and suggest UI adjustments based on the levels of anxiety or frustration."

[0227] The specific processing unit 290 transmits the result of the specific processing to the smart device 14. In the smart device 14, the control unit 46A causes the output device 40 to output the result of the specific processing. The microphone 38B acquires audio indicating user input for the result of the specific processing. The control unit 46A transmits the audio data indicating user input acquired by the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0228] Data generation model 58 is a type of so-called generative AI (Artificial Intelligence). An example of data generation model 58 is ChatGPT (registered trademark) (Internet search).<URL: https: / / openai.com / blog / chatgpt> ), Gemini (registered trademark) (Internet search) <url: https: gemini.google.com ?hl="ja">Examples of generative AI include the following. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 is input with prompts containing instructions, and with inference data such as audio data representing speech, text data representing text, and image data representing images. The data generation model 58 infers from the input inference data according to the instructions indicated by the prompts, and outputs the inference results in data formats such as audio data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0229] In the above embodiment, an example was given in which specific processing is performed by the data processing device 12, but the technology of this disclosure is not limited thereto, and the specific processing may also be performed by the smart device 14.

[0230] [Second Embodiment]

[0231] Figure 3 shows an example of the configuration of the data processing system 210 according to the second embodiment.

[0232] As shown in Figure 3, the data processing system 210 includes a data processing device 12 and smart glasses 214. An example of the data processing device 12 is a server.

[0233] The data processing device 12 comprises a computer 22, a database 24, and a communication interface 26. The computer 22 is an example of a "computer" related to the technology of this disclosure. The computer 22 comprises a processor 28, RAM 30, and storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication interface 26 are also connected to the bus 34. The communication interface 26 is connected to a network 54. An example of the network 54 is a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0234] The smart glasses 214 include a computer 36, a microphone 238, a speaker 240, a camera 42, and a communication interface 44. The computer 36 includes a processor 46, RAM 48, and storage 50. The processor 46, RAM 48, and storage 50 are connected to a bus 52. The microphone 238, speaker 240, and camera 42 are also connected to the bus 52.

[0235] The microphone 238 receives voice signals from the user 20 and receives instructions from the user 20. The microphone 238 captures the voice signals from the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to the instructions from the processor 46.

[0236] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an image sensor such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the area around the user 20 (for example, an imaging range defined by a field of view equivalent to the width of a typical healthy person's field of vision).

[0237] Communication interface 44 is connected to network 54. Communication interfaces 44 and 26 are responsible for the exchange of various information between processor 46 and processor 28 via network 54. The exchange of various information between processor 46 and processor 28 using communication interfaces 44 and 26 is performed in a secure manner.

[0238] Figure 4 shows an example of the main functions of the data processing device 12 and the smart glasses 214. As shown in Figure 4, the data processing device 12 performs specific processing using the processor 28. The storage 32 stores the specific processing program 56.

[0239] The specific processing program 56 is an example of a "program" relating to the technology of this disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0240] The storage 32 stores the data generation model 58 and the emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0241] In the smart glasses 214, the processor 46 performs the reception output processing. The storage 50 stores the reception output program 60. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output processing is realized by the processor 46 operating as a control unit 46A according to the reception output program 60 executed on the RAM 48.

[0242] Next, the identification processing performed by the identification processing unit 290 of the data processing device 12 will be described. In the following description, the data processing device 12 will be referred to as the "server" and the smart glasses 214 will be referred to as the "terminal".

[0243] The system according to the present invention includes a program for monitoring the operating status of an information system in real time, analyzing log data, and quickly identifying and resolving problems. The operation of this program is described below.

[0244] First, the server receives log data sent from each component of the system in real time and converts it into a unified format. This allows for consistent analysis of log data in different formats.

[0245] Next, the server analyzes the log data using a generative model. This analysis identifies bottlenecks causing errors and performance degradation, and based on that, identifies the root cause and solution. This process includes predictive algorithms that leverage historical log data and incident history.

[0246] Furthermore, the server detects sections of log data related to security incidents and, if necessary, warns the user with details of the incident. This warning is provided in real time to encourage a quick response.

[0247] The analysis results are added to the system's knowledge base. This knowledge base allows teams to share information, leading to more efficient problem-solving and prevention of future incidents.

[0248] As a concrete example, consider a scenario where a server detects a significant network delay. The server analyzes log data and identifies an abnormally high load on a specific router. Once the cause of the problem is identified, the user can adjust network settings to distribute the load on that router, thereby resolving the delay issue. Furthermore, this solution is recorded in a knowledge base, which can be used to address similar cases in the future.

[0249] Thus, the system of the present invention can improve the reliability and efficiency of the system by enabling rapid error identification and resolution through real-time analysis, and further by accumulating and sharing knowledge.

[0250] The following describes the processing flow.

[0251] Step 1:

[0252] The server collects log data sent from each application and device within the system in real time. This process uses a file watcher that periodically checks for updates to the log files, immediately detecting newly recorded log entries.

[0253] Step 2:

[0254] The server converts the collected log data in various formats into a unified format. Specifically, it uses regular expressions to extract timestamps, error levels, message content, etc., from log entries and organizes them into JSON or XML format.

[0255] Step 3:

[0256] The server analyzes the transformed log data using a generative model. This model is based on machine learning algorithms and extracts error logs from the log data, classifying them based on the error level and message content.

[0257] Step 4:

[0258] The server identifies the cause of the error based on the error log and proposes a solution. At this stage, a predictive algorithm based on past incident data is applied to suggest solutions for similar problems.

[0259] Step 5:

[0260] The server detects security incidents based on log data. It monitors unusual user behavior and system access, and issues real-time warnings to users if an anomaly is detected.

[0261] Step 6:

[0262] The server analyzes system performance data to identify bottlenecks causing performance degradation. This uses monitoring data such as CPU usage and memory usage, and suggests improvement measures.

[0263] Step 7:

[0264] The server adds these analysis results to the knowledge base and automatically notifies the entire team in real time. Users can then access the knowledge base and share past incident information within the team, which helps prevent future incidents.

[0265] (Example 1)

[0266] Next, we will describe Example 1. In the following description, the data processing device 12 will be referred to as the "server," and the smart glasses 214 will be referred to as the "terminal."

[0267] In increasingly complex information processing systems, real-time error detection and rapid response are essential. However, conventional systems have struggled with the diverse formats of log information, making rapid and accurate analysis difficult. Furthermore, in addition to early detection and countermeasures for safety incidents, there has been a lack of mechanisms for learning effective solutions from past cases and efficiently accumulating and sharing knowledge. Therefore, there is a need to comprehensively solve the various problems that systems face.

[0268] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 1 is realized by the following means.

[0269] In this invention, the server includes means for acquiring log information in real time, means for converting the log information into a standard format, and means for extracting and classifying abnormal logs from the log information using a generative artificial intelligence model. This enables the unified analysis of diverse log information in real time, allowing for rapid error detection, the presentation of countermeasures, and the effective accumulation and sharing of knowledge.

[0270] "Log information" refers to data files that record the operation and status of an information processing system.

[0271] "Real-time" is a temporal concept that indicates that information acquisition and processing occur immediately.

[0272] A "standard format" is a common data format used to handle different data formats in a unified manner.

[0273] A "generative artificial intelligence model" is a machine learning model used to analyze data and learn patterns.

[0274] An "abnormal log" is log information that includes errors and warnings that deviate from normal system operation.

[0275] "Classification" is the act of dividing information into categories based on specific criteria.

[0276] A "security incident" refers to a problem or accident related to the security of an information system.

[0277] A "bottleneck" is a factor that limits the performance or processing speed of a system.

[0278] A "solution" is a plan or action to solve a specific problem.

[0279] "Analysis results" refer to conclusions or insights derived from the analysis of data.

[0280] A "knowledge aggregate" is a database that compiles past analysis results and empirical knowledge.

[0281] "Automatic notification" refers to a system that provides necessary information without requiring manual intervention.

[0282] A "factor" is a cause or factor that leads to a result.

[0283] A "solution" refers to a specific method or means for solving a problem.

[0284] "Case data" refers to information on specific events and situations that occurred in the past.

[0285] A "work team" is a group organized to achieve a specific goal.

[0286] The present invention is a technology for analyzing a plurality of log informations in real time and quickly identifying and solving problems in the operation of an information processing system. This system functions through the cooperation of a server, terminals, and users.

[0287] First, the server acquires log information from various components of the information processing system. Since log information is often in different formats, the server converts it into a standard format. This enables consistent analysis of log information in different formats. The server uses a generated artificial intelligence model to extract anomalies from the log information and perform classification. In this analysis process, pattern recognition algorithms are fully utilized to identify system bottlenecks and security incidents.

[0288] The terminal operates a database as a knowledge aggregate and stores and shares the analysis results provided by the server. The interface on the terminal enables the analysis results and past case data to be browsed and edited within the team, promoting information sharing.

[0289] The user receives notifications from the server and executes actions necessary for problem solving based on the results. For example, by adjusting the settings of specific network components and distributing the load, problems such as delays and performance issues are solved.

[0290] As a concrete example, if the server detects an abnormal delay in the network one day, the user can identify the cause and take immediate action. In this case, the server generates a prompt message such as, "Split the high-load session from a specific device and redistribute it across the entire network." This allows the user to receive assistance in taking specific measures.

[0291] With the system configuration described above, the present invention enables efficient and precise real-time analysis in complex and diverse information processing systems, and improves the reliability and efficiency of the entire system through the accumulation and sharing of knowledge.

[0292] The flow of the specific processing in Example 1 will be explained using Figure 11.

[0293] Step 1:

[0294] The server collects log information in real time from each component of the system. Its input is log information in various formats generated by each component. Specifically, the server immediately retrieves this raw information and temporarily stores it in various storage locations for later analysis. The output consists of log information awaiting conversion to a unified format.

[0295] Step 2:

[0296] The server converts the collected log information into a standard format. The input consists of log information in different formats prepared in Step 1. The server analyzes these logs and converts each item into a standardized timestamp and message structure. The output is log information formatted in a way that can be interpreted by the generating AI model.

[0297] Step 3:

[0298] The server analyzes the log information, which has been converted to a standard format, using a generative artificial intelligence model. The input includes the log information converted in step 2. Specifically, the server utilizes the AI ​​model to scan the data and identify patterns in abnormal logs. The output is an analysis result that includes error classification and an initial diagnosis of the cause.

[0299] Step 4:

[0300] The server classifies the error log and identifies the cause based on the analysis results, and generates prompt messages suggesting solutions. The input is the analysis results from step 3. The server analyzes this and uses AI to generate specific countermeasures and improvement measures appropriate to the situation. The output provides prompt messages indicating the actions the user should take.

[0301] Step 5:

[0302] The server detects security incidents in the log information and issues warnings to the user as needed. The input consists of log information in a standard format prepared in step 2 and the analysis results from steps 3 and 4. Specifically, the server uses an anomaly detection algorithm to immediately identify unauthorized access and security threats. The output includes warning messages to allow the user to react quickly.

[0303] Step 6:

[0304] The server adds the analysis results to the knowledge set and automatically notifies the work team via terminals. Inputs include analysis results and warnings from steps 4 and 5. Outputs include the newly updated knowledge set data and related notifications. This allows each member to easily access and prepare for similar problems.

[0305] (Application Example 1)

[0306] Next, Application Example 1 will be described. In the following description, the data processing device 12 is referred to as a "server", and the smart glasses 214 are referred to as a "terminal".

[0307] In a modern information technology environment, in order to maintain the reliability and efficiency of a system, real-time monitoring and rapid problem-solving are essential. However, it is not easy to appropriately analyze a large amount of log data and immediately take countermeasures. In addition, a method for learning from past incidents and effectively sharing the acquired knowledge is also required. In particular, immediate notifications and displays using mobile devices are demanded.

[0308] The specific processing by the specific processing unit 290 of the data processing device 12 in Application Example 1 is realized by the following means.

[0309] In this invention, the server includes means for collecting log data in real time, means for converting the log data into a unified format, and means for extracting and classifying error logs from the log data using a generation model. Thereby, immediate analysis of data collected from each component of the information system becomes possible. In addition, by incorporating means for visualizing the analysis results using a portable information terminal and notifying in real time, the administrator can quickly respond to problems at any time and anywhere. With this system, the reliability and efficiency of the server are significantly improved, and preventive problem-solving using knowledge of past incidents is also possible.

[0310] "Log data" is data that records the operating status and error information of an information system.

[0311] "Means for collecting in real time" is a device or process for immediately acquiring log data at the moment when information occurs.

[0312] "Means for converting into a unified format" is a function for organizing and converting log data recorded in different formats into a consistent format. ​​A "generative model" is a mathematical or computational model designed to perform pattern recognition or prediction using historical data.

[0314] An "error log" is a record that shows abnormalities or problems that occurred during the operation of a system.

[0315] A "security incident" is an unauthorized access, data breach, or other breach that could compromise the confidentiality, integrity, or availability of an information system.

[0316] A "system performance failure" is a problem that arises when an information system fails to perform as expected.

[0317] "Means of proposing improvement measures" refers to the function of presenting appropriate actions or measures to solve identified problems.

[0318] A "knowledge base" is a collection of information that systematically organizes past incidents and problem-solving solutions so that they can be used later.

[0319] A "management body" is a team or organization responsible for the operation and maintenance of a system.

[0320] A "portable information terminal" refers to a handheld information display device such as a smartphone or tablet.

[0321] "Visualization" is the process of visually displaying data and analysis results to communicate them in an easy-to-understand manner.

[0322] "Immediately" means that something is done without any delay.

[0323] This invention realizes a system that improves the performance of information systems by collecting and analyzing log data in real time. A specific embodiment of this system is described below.

[0324] The server first receives log data in real time from each component within the system. This process utilizes a data collection framework such as Fluentd. Since the received log data may be in various formats, it is converted to a unified format via Fluentd. This conversion enables consistent analysis within the database.

[0325] Next, the server uses software tools such as TensorFlow and Scikit-learn to build generative models and analyze log data in a unified format. In this analysis process, the system identifies the causes of errors and system performance issues and proposes solutions based on these findings. Furthermore, in the event of a security incident, it can immediately identify the details and generate appropriate warnings.

[0326] Furthermore, analysis results and warnings are displayed in real time on mobile devices. A notification system using Firebase Push Notifications allows users to quickly understand the situation no matter where they are. This application uses the analysis results to update its knowledge base, accumulating information to prevent future incidents.

[0327] For example, if a specific server experiences an abnormal load during business hours, this system immediately detects the situation and sends a notification to the user's mobile device, including a suggestion for load balancing. Based on this information, the user can respond quickly and restore stable system operation. This rapid feedback and response process significantly improves the efficiency of the information system.

[0328] Examples of prompt messages include the following:

[0329] "Please analyze the abnormal logs detected on the servers within the data center. Generate a report on the cause and recommended countermeasures. Also, check if there have been similar cases in the past and include past countermeasures."

[0330] The flow of a specific process in Application Example 1 will be explained using Figure 12.

[0331] Step 1:

[0332] The server collects all incoming log data in real time from each component of the system. This input data includes information such as time, message content, and error level. The server uses Fluentd to convert log data in different formats into a standardized, unified format and temporarily stores it in a database.

[0333] Step 2:

[0334] The server analyzes the log data, which has been converted to a unified format, using a generating AI model. The input data used is the data converted in step 1, and the output generates error types and frequencies, as well as the overall system operating status. This analysis utilizes a machine learning model using TensorFlow to perform data calculations for anomaly detection and to identify performance bottlenecks.

[0335] Step 3:

[0336] Based on the analysis results, the server generates solutions to identified errors and performance issues and updates its knowledge base. This data, based on input from the generated AI model, is output as a concrete action plan for the user. It proposes standard solutions to identified problems and stores past success stories and countermeasures in the knowledge base.

[0337] Step 4:

[0338] The device displays real-time analysis results from the server and immediately notifies the administrator. Input data includes server analysis results and knowledge base update information. Output includes direct notifications using Firebase Push Notifications and detailed displays on the device screen. This allows users to stay informed about the system status regardless of their location.

[0339] Step 5:

[0340] Users perform system configuration changes and troubleshooting based on notifications from their terminals. Inputs include solutions provided by the terminal and system log information, while output results in improved system performance and problem resolution. Specific actions include adjusting network settings and reviewing resource allocation. This process enables optimal system operation.

[0341] Furthermore, an emotion engine that estimates the user's emotions may be incorporated. That is, the identification processing unit 290 may use the emotion identification model 59 to estimate the user's emotions and perform identification processing using the user's emotions.

[0342] The system according to the present invention is based on a function that analyzes log data of an information system in real time, and adds an emotion engine that recognizes user emotions in real time. By combining technical insights derived from the analysis of log data with the emotional state of the user captured by the emotion engine, this system achieves more responsive system operation.

[0343] First, the server collects log data in real time and converts it into a unified format. Next, it analyzes the log data using a generative model to extract and classify error logs. This allows for the early detection of anomalies and bottlenecks within the system, and enables root cause identification and solution proposals based on these findings. This process utilizes past incident data for learning.

[0344] In addition, the emotion engine analyzes user input, such as text and voice, to extract the user's emotional state. This emotional information can be used to adjust the system's operation, particularly the user interface. For example, if a user is frustrated, the system can suggest improving response speed or simplifying interactions.

[0345] Furthermore, the server adds sentiment information to the knowledge base and records incidents related to emotions. This lays the foundation for developing future system improvements that take emotions into account.

[0346] As a concrete example, consider a case where a user is dissatisfied with the system's response to a particular operation on a given day. The emotion engine detects this situation in real time, and by comparing this information with the system's analysis results, the server promptly proposes countermeasures. For example, it might suggest simplifying the operation procedure or reviewing resource allocation to shorten response times. As a result, user dissatisfaction is reduced, the knowledge base is updated, and the ability to handle similar cases improves.

[0347] Thus, by integrating emotion recognition and log analysis, the system of the present invention can optimize the user experience and improve the reliability and efficiency of the system.

[0348] The following describes the processing flow.

[0349] Step 1:

[0350] The server collects log data generated from each application and hardware in real time. This is done using tools that continuously monitor log file updates and automatically receive log data whenever it is generated.

[0351] Step 2:

[0352] The server converts the collected log data into a unified format. Specifically, it uses regular expressions to extract necessary information (such as timestamps and error messages) from log entries and organizes it into an easily parsable data format such as JSON.

[0353] Step 3:

[0354] The server analyzes the log data transformed by the generative model. It extracts error logs from the log data and classifies them based on the type and location of the error. This analysis identifies potential problems in the system.

[0355] Step 4:

[0356] The emotion engine analyzes user text messages and voice input in real time to identify emotions. It uses natural language processing (NLP) techniques to infer emotions from text and voice analysis to infer emotions from intonation and tone.

[0357] Step 5:

[0358] The server integrates analyzed log data and sentiment information to adjust system responses. For example, if it detects that a user is expressing dissatisfaction, the server may suggest improvements to the user interface and use this as a trigger to optimize system performance.

[0359] Step 6:

[0360] The server adds analyzed log data and sentiment data to a knowledge base, recording incidents involving emotions. This allows the entire team to share incident information and use it for future problem feedback.

[0361] Step 7:

[0362] After receiving improvement suggestions from the server, the user adjusts system operations and settings. They send back feedback on the interface and evaluate the effectiveness of the system response.

[0363] In this way, this system integrates technical log analysis and emotion recognition, enabling intelligent system operation tailored to the user's needs and emotional state.

[0364] (Example 2)

[0365] Next, we will describe Example 2. In the following description, the data processing device 12 will be referred to as the "server" and the smart glasses 214 will be referred to as the "terminal".

[0366] In the operation of information systems, while real-time extraction and processing of error logs are required, system response optimization that reflects the emotional state of users is not adequately performed. Furthermore, there is a lack of mechanisms to share this information across the entire organization and to implement rapid responses and improvements.

[0367] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 2 is realized by the following means.

[0368] In this invention, the server includes means for collecting log information in real time, means for extracting and classifying error logs using a generative AI model, and means for analyzing the user's emotional state. This enables rapid processing of error logs and adjustment of responses based on the user's emotions.

[0369] "Log information" refers to records of data collected in real time from information systems.

[0370] A "unified format" is a data format that facilitates analysis by converting data from different formats into a consistent format.

[0371] A "generative AI model" is a mathematical model that uses artificial intelligence to analyze data and perform pattern recognition and prediction.

[0372] An "error" refers to a problem or anomaly that prevents a system from functioning normally.

[0373] "Methods for identifying causes and proposing solutions" refers to the process of analyzing the causes of errors or problems and providing solutions.

[0374] A "security incident" refers to an event or action that could potentially affect the security of a system.

[0375] A "bottleneck" refers to a factor or process that reduces the processing power of a system.

[0376] A "knowledge base" is a database that stores past experiences and analysis results related to system operation.

[0377] "Text and voice input" refers to information provided by the user to the system in the form of text or voice.

[0378] "Emotional state" refers to the psychological state a user exhibits through their input into the system.

[0379] "Means for adjusting system response" refers to functions that modify and optimize system operation based on the user's emotional state and analysis results.

[0380] This invention improves system efficiency and user experience in an information processing system by performing real-time analysis of log information and system responses that reflect the user's emotional state.

[0381] The server collects log information from information systems in real time and converts it into a unified format. This format conversion facilitates subsequent analysis. Based on the collected log information, an AI model is used to extract and classify errors, enabling early detection of anomalies and bottlenecks within the system.

[0382] The emotion engine uses natural language processing techniques to analyze text and voice input from the user and extract their emotional state. The extracted emotional information is used by the server to optimize system responses. Specifically, if the user is expressing frustration, the server re-evaluates resource allocation to improve response speed. It also suggests simplifying the user interface if the operation is complex.

[0383] The system's knowledge base is updated by combining emotional information and analysis results. This creates a comprehensive database including past event data, laying the foundation for future system improvements.

[0384] For example, if a user inputs something like, "This operation takes too long," the emotion engine immediately analyzes that dissatisfaction. The server then compares this emotion information with log analysis to identify the bottleneck process and suggest improvements. For instance, improving the system's response speed can alleviate user dissatisfaction.

[0385] An example of a prompt for a generative AI model is, "Analyze the user's current emotional state from their log data and generate suggestions for the system's response."

[0386] Thus, the system of the present invention can provide a highly responsive information processing system by combining log analysis and emotion recognition.

[0387] The flow of the specific processing in Example 2 will be explained using Figure 13.

[0388] Step 1:

[0389] The server collects log information from information systems in real time. The input consists of raw log data from network devices and applications. The server receives this data and integrates each data entry, adding timestamps as needed, to create a pure data stream.

[0390] Step 2:

[0391] The server converts the collected log information into a unified format. The input is the raw log data collected in Step 1. This data is analyzed and converted into a unified format that is easy for the generating AI model to process. The output is log data converted into a unified format, guaranteeing data consistency and completeness.

[0392] Step 3:

[0393] The server uses a generative AI model to extract and classify errors from log data in a unified format. The input is the log data in a unified format generated in step 2. The data is fed into the AI ​​model to detect and classify errors and anomalies. In this process, machine learning algorithms are used to identify specific error patterns, and the output is an error report classified by severity.

[0394] Step 4:

[0395] The emotion engine receives text and voice input from the user, analyzes it, and extracts the user's emotional state. Input includes natural language instructions and voice data obtained from the user interface. The data is processed using an emotion analysis algorithm, and the output is the user's emotional state (e.g., satisfied, dissatisfied, stressed).

[0396] Step 5:

[0397] The server combines the sentiment information obtained by the sentiment engine with the error report from step 3 to adjust the system's response. The inputs are the sentiment data and error classification data from the previous step. The server refers to these and, if necessary, reallocates system resources or adjusts processes. The output is a proposal for optimized system settings and user interface changes.

[0398] Step 6:

[0399] The server adds emotional states and analysis results to its knowledge base, accumulating information for future improvements. The input is the system's response information adjusted or determined in step 5. This information is added to the knowledge base and stored as reference information for handling similar cases. The output is an updated knowledge base.

[0400] (Application Example 2)

[0401] Next, we will explain application example 2. In the following explanation, the data processing device 12 will be referred to as the "server," and the smart glasses 214 will be referred to as the "terminal."

[0402] Current information systems lack real-time incident response that takes user emotions into consideration, resulting in insufficient optimization of system reliability and user experience. Furthermore, rapid and appropriate improvements are required in resolving security incidents and system performance bottlenecks.

[0403] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means.

[0404] In this invention, the server includes means for collecting log information in real time, means for converting the log information into a unified format, and means for extracting and classifying error logs from the log information using a generative AI model. This enables the rapid identification of security incidents and system performance bottlenecks, and allows for the adjustment of the interface to take user sentiment into consideration.

[0405] "Log information" refers to data that records the operating status of an information system.

[0406] "Methods for collecting information in real time" refer to methods for instantly acquiring information and storing it in a database or similar system.

[0407] "Methods for converting to a unified format" refer to methods for organizing data expressed in different formats into a consistent format.

[0408] "Using a generative AI model" means using a model that leverages machine learning techniques to find patterns and features from data.

[0409] "Means for extracting and classifying error logs" refers to a method for identifying errors in a system and organizing them according to similar error patterns.

[0410] A "security incident" is an event that causes intentional or accidental unauthorized access or threat to a system or data.

[0411] A "performance bottleneck" is a major factor or point of failure that degrades the overall performance of a system.

[0412] A "knowledge base" is a database that stores past cases and learned information to be used for decision-making and problem-solving.

[0413] "Means of recognizing user emotions" refers to technologies that determine a user's emotional state by analyzing their input data.

[0414] "Adjusting the user interface" means modifying and optimizing the operation screen and procedures to improve user convenience.

[0415] To implement this invention, a server for real-time monitoring of the information system and a terminal equipped with an emotion engine for detecting the user's emotions are required.

[0416] The server continuously collects log information from information systems and converts it into a unified format. Next, it uses a generative AI model to analyze this log information, extracting and classifying error logs. During this process, the server instantly detects security incidents and performance bottlenecks within the system based on specific error patterns, and alerts users and administrators. The analysis results are automatically added to a knowledge base and communicated to the entire team.

[0417] The device is equipped with an emotion engine that analyzes user emotions in real time based on user input, particularly text and voice data. If a user experiences frustration or anxiety while using the system, the device immediately evaluates those emotions and adjusts the user interface in conjunction with the server to provide a better user experience.

[0418] For example, if a user operates a smart home security system and expresses anxiety, the emotion engine can detect that emotion, and the server can suggest simplifying the user interface. Furthermore, using a generative AI model, it is possible to prioritize processing the most important error messages the system encounters.

[0419] An example of a prompt message is, "Given the user's speech data, determine the primary emotions detected, and suggest UI adjustments based on the levels of anxiety or frustration." This is intended to detect the primary emotions based on the user's speech data and suggest UI adjustments based on the level of anxiety or frustration.

[0420] The flow of a specific process in Application Example 2 will be explained using Figure 14.

[0421] Step 1:

[0422] The server collects log information from information systems in real time. This log information contains detailed records of various system events. The input log data is stored in a database inside the server.

[0423] Step 2:

[0424] The server converts the collected log information into a unified format. Here, log data stored in different formats and styles is organized into a consistent data format. The resulting unified log data becomes the input for the next analysis step.

[0425] Step 3:

[0426] The server uses a generative AI model to analyze log data in a unified format, extracting and classifying error logs. During the analysis, pattern recognition technology is used to distinguish between normal logs and abnormal (error) logs. As a result, specific error logs are extracted and sent to the next step.

[0427] Step 4:

[0428] The server identifies security incidents and performance bottlenecks based on extracted error logs. Here, it uses past incident data as a reference and a generative AI model to make predictions and determine the presence of problems. Identified incident information is output as a warning.

[0429] Step 5:

[0430] The server adds the analysis results to the knowledge base and automatically notifies the entire group of incident information. This notification process allows the team to quickly share incident details and take appropriate action.

[0431] Step 6:

[0432] The device receives user input, particularly voice and text data, and analyzes emotions using an emotion engine. This analysis classifies the user's emotional state and identifies emotions such as frustration and anxiety.

[0433] Step 7:

[0434] The device adjusts the user interface in cooperation with the server based on the analyzed user emotions. Specifically, if the user feels anxious, it simplifies the screen and provides audio guidance, among other interface improvements. An example of a prompt for this process is, "Given the user's speech data, determine the primary emotions detected and suggest UI adjustments based on the levels of anxiety or frustration."

[0435] The specific processing unit 290 transmits the result of the specific processing to the smart glasses 214. In the smart glasses 214, the control unit 46A causes the speaker 240 to output the result of the specific processing. The microphone 238 acquires audio indicating user input for the result of the specific processing. The control unit 46A transmits the audio data indicating user input acquired by the microphone 238 to the data processing unit 12. In the data processing unit 12, the specific processing unit 290 acquires the audio data.

[0436] Data generation model 58 is a type of so-called generative AI (Artificial Intelligence). One example of data generation model 58 is ChatGPT (Internet search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search) <url: https: gemini.google.com ?hl="ja">Examples of generative AI include the following. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 is input with prompts containing instructions, and with inference data such as audio data representing speech, text data representing text, and image data representing images. The data generation model 58 infers from the input inference data according to the instructions indicated by the prompts, and outputs the inference results in data formats such as audio data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0437] In the above embodiment, an example was given in which specific processing is performed by the data processing device 12, but the technology of this disclosure is not limited thereto, and the specific processing may also be performed by the smart glasses 214.

[0438] [Third Embodiment]

[0439] Figure 5 shows an example of the configuration of the data processing system 310 according to the third embodiment.

[0440] As shown in Figure 5, the data processing system 310 includes a data processing device 12 and a headset terminal 314. An example of the data processing device 12 is a server.

[0441] The data processing device 12 comprises a computer 22, a database 24, and a communication interface 26. The computer 22 is an example of a "computer" related to the technology of this disclosure. The computer 22 comprises a processor 28, RAM 30, and storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication interface 26 are also connected to the bus 34. The communication interface 26 is connected to a network 54. An example of the network 54 is a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0442] The headset terminal 314 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication interface 44, and a display 343. The computer 36 includes a processor 46, RAM 48, and storage 50. The processor 46, RAM 48, and storage 50 are connected to a bus 52. The microphone 238, speaker 240, camera 42, and display 343 are also connected to the bus 52.

[0443] The microphone 238 receives voice signals from the user 20 and receives instructions from the user 20. The microphone 238 captures the voice signals from the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to the instructions from the processor 46.

[0444] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an image sensor such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the area around the user 20 (for example, an imaging range defined by a field of view equivalent to the width of a typical healthy person's field of vision).

[0445] Communication interface 44 is connected to network 54. Communication interfaces 44 and 26 are responsible for the exchange of various information between processor 46 and processor 28 via network 54. The exchange of various information between processor 46 and processor 28 using communication interfaces 44 and 26 is performed in a secure manner.

[0446] Figure 6 shows an example of the main functions of the data processing device 12 and the headset terminal 314. As shown in Figure 6, the data processing device 12 performs specific processing using the processor 28. The storage 32 stores the specific processing program 56.

[0447] The specific processing program 56 is an example of a "program" relating to the technology of this disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0448] The storage 32 stores the data generation model 58 and the emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0449] In the headset terminal 314, the processor 46 performs the reception output processing. The storage 50 stores the reception output program 60. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output processing is realized by the processor 46 operating as a control unit 46A according to the reception output program 60 executed on the RAM 48.

[0450] Next, the specific processing performed by the specific processing unit 290 of the data processing device 12 will be described. In the following description, the data processing device 12 will be referred to as the "server" and the headset terminal 314 will be referred to as the "terminal".

[0451] The system according to the present invention includes a program for monitoring the operating status of an information system in real time, analyzing log data, and quickly identifying and resolving problems. The operation of this program is described below.

[0452] First, the server receives log data sent from each component of the system in real time and converts it into a unified format. This allows for consistent analysis of log data in different formats.

[0453] Next, the server analyzes the log data using a generative model. This analysis identifies bottlenecks causing errors and performance degradation, and based on that, identifies the root cause and solution. This process includes predictive algorithms that leverage historical log data and incident history.

[0454] Furthermore, the server detects sections of log data related to security incidents and, if necessary, warns the user with details of the incident. This warning is provided in real time to encourage a quick response.

[0455] The analysis results are added to the system's knowledge base. This knowledge base allows teams to share information, leading to more efficient problem-solving and prevention of future incidents.

[0456] As a concrete example, consider a scenario where a server detects a significant network delay. The server analyzes log data and identifies an abnormally high load on a specific router. Once the cause of the problem is identified, the user can adjust network settings to distribute the load on that router, thereby resolving the delay issue. Furthermore, this solution is recorded in a knowledge base, which can be used to address similar cases in the future.

[0457] Thus, the system of the present invention can improve the reliability and efficiency of the system by enabling rapid error identification and resolution through real-time analysis, and further by accumulating and sharing knowledge.

[0458] The following describes the processing flow.

[0459] Step 1:

[0460] The server collects log data sent from each application and device within the system in real time. This process uses a file watcher that periodically checks for updates to the log files, immediately detecting newly recorded log entries.

[0461] Step 2:

[0462] The server converts the collected log data in various formats into a unified format. Specifically, it uses regular expressions to extract timestamps, error levels, message content, etc., from log entries and organizes them into JSON or XML format.

[0463] Step 3:

[0464] The server analyzes the transformed log data using a generative model. This model is based on machine learning algorithms and extracts error logs from the log data, classifying them based on the error level and message content.

[0465] Step 4:

[0466] The server identifies the cause of the error based on the error log and proposes a solution. At this stage, a predictive algorithm based on past incident data is applied to suggest solutions for similar problems.

[0467] Step 5:

[0468] The server detects security incidents based on log data. It monitors unusual user behavior and system access, and issues real-time warnings to users if an anomaly is detected.

[0469] Step 6:

[0470] The server analyzes system performance data to identify bottlenecks causing performance degradation. This uses monitoring data such as CPU usage and memory usage, and suggests improvement measures.

[0471] Step 7:

[0472] The server adds these analysis results to the knowledge base and automatically notifies the entire team in real time. Users can then access the knowledge base and share past incident information within the team, which helps prevent future incidents.

[0473] (Example 1)

[0474] Next, we will describe Example 1. In the following description, the data processing device 12 will be referred to as the "server," and the headset-type terminal 314 will be referred to as the "terminal."

[0475] In increasingly complex information processing systems, real-time error detection and rapid response are essential. However, conventional systems have struggled with the diverse formats of log information, making rapid and accurate analysis difficult. Furthermore, in addition to early detection and countermeasures for safety incidents, there has been a lack of mechanisms for learning effective solutions from past cases and efficiently accumulating and sharing knowledge. Therefore, there is a need to comprehensively solve the various problems that systems face.

[0476] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 1 is realized by the following means.

[0477] In this invention, the server includes means for acquiring log information in real time, means for converting the log information into a standard format, and means for extracting and classifying abnormal logs from the log information using a generative artificial intelligence model. This enables the unified analysis of diverse log information in real time, allowing for rapid error detection, the presentation of countermeasures, and the effective accumulation and sharing of knowledge.

[0478] "Log information" refers to data files that record the operation and status of an information processing system.

[0479] "Real-time" is a temporal concept that indicates that information acquisition and processing occur immediately.

[0480] A "standard format" is a common data format used to handle different data formats in a unified manner.

[0481] A "generative artificial intelligence model" is a machine learning model used to analyze data and learn patterns.

[0482] An "abnormal log" is log information that includes errors and warnings that deviate from normal system operation.

[0483] "Classification" is the act of dividing information into categories based on specific criteria.

[0484] A "security incident" refers to a problem or accident related to the security of an information system.

[0485] A "bottleneck" is a factor that limits the performance or processing speed of a system.

[0486] A "solution" is a plan or action to solve a specific problem.

[0487] "Analysis results" refer to conclusions or insights derived from the analysis of data.

[0488] A "knowledge aggregate" is a database that compiles past analysis results and empirical knowledge.

[0489] "Automatic notification" refers to a system that provides necessary information without requiring manual intervention.

[0490] A "factor" is a cause or factor that leads to a result.

[0491] A "solution" is a specific method or means of solving a problem.

[0492] "Case data" refers to information about specific events and situations that have occurred in the past.

[0493] A "working team" is a group formed to achieve a specific objective.

[0494] This invention is a technology for analyzing multiple log data in real time during the operation of an information processing system, and for quickly identifying and resolving problems. This system functions through the collaboration of a server, terminals, and users.

[0495] First, the server acquires log information from various components of the information processing system. Since log information is often in different formats, the server converts it to a standard format. This makes it possible to consistently analyze log information in different formats. The server uses a generative artificial intelligence model to extract and classify anomalies from the log information. In this analysis process, pattern recognition algorithms are used to identify system bottlenecks and safety incidents.

[0496] The terminal operates a database as a collection of knowledge, storing and sharing analysis results provided from the server. The interface on the terminal allows the team to view and edit analysis results and past case data, facilitating information sharing.

[0497] Users receive notifications from the server and take necessary actions to resolve the issue based on the results. For example, they might adjust the settings of specific network components and distribute the load to resolve latency or performance problems.

[0498] As a concrete example, if the server detects an abnormal delay in the network one day, the user can identify the cause and take immediate action. In this case, the server generates a prompt message such as, "Split the high-load session from a specific device and redistribute it across the entire network." This allows the user to receive assistance in taking specific measures.

[0499] With the system configuration described above, the present invention enables efficient and precise real-time analysis in complex and diverse information processing systems, and improves the reliability and efficiency of the entire system through the accumulation and sharing of knowledge.

[0500] The flow of the specific processing in Example 1 will be explained using Figure 11.

[0501] Step 1:

[0502] The server collects log information in real time from each component of the system. Its input is log information in various formats generated by each component. Specifically, the server immediately retrieves this raw information and temporarily stores it in various storage locations for later analysis. The output consists of log information awaiting conversion to a unified format.

[0503] Step 2:

[0504] The server converts the collected log information into a standard format. The input consists of log information in different formats prepared in Step 1. The server analyzes these logs and converts each item into a standardized timestamp and message structure. The output is log information formatted in a way that can be interpreted by the generating AI model.

[0505] Step 3:

[0506] The server analyzes the log information, which has been converted to a standard format, using a generative artificial intelligence model. The input includes the log information converted in step 2. Specifically, the server utilizes the AI ​​model to scan the data and identify patterns in abnormal logs. The output is an analysis result that includes error classification and an initial diagnosis of the cause.

[0507] Step 4:

[0508] The server classifies the error log and identifies the cause based on the analysis results, and generates prompt messages suggesting solutions. The input is the analysis results from step 3. The server analyzes this and uses AI to generate specific countermeasures and improvement measures appropriate to the situation. The output provides prompt messages indicating the actions the user should take.

[0509] Step 5:

[0510] The server detects security incidents in the log information and issues warnings to the user as needed. The input consists of log information in a standard format prepared in step 2 and the analysis results from steps 3 and 4. Specifically, the server uses an anomaly detection algorithm to immediately identify unauthorized access and security threats. The output includes warning messages to allow the user to react quickly.

[0511] Step 6:

[0512] The server adds the analysis results to the knowledge set and automatically notifies the work team via terminals. Inputs include analysis results and warnings from steps 4 and 5. Outputs include the newly updated knowledge set data and related notifications. This allows each member to easily access and prepare for similar problems.

[0513] (Application Example 1)

[0514] Next, we will explain Application Example 1. In the following explanation, the data processing device 12 will be referred to as the "server," and the headset-type terminal 314 will be referred to as the "terminal."

[0515] In today's information technology environment, real-time monitoring and rapid problem-solving are essential to maintaining system reliability and efficiency. However, properly analyzing vast amounts of log data and taking immediate action is not easy. Furthermore, there is a need for effective methods to learn from past incidents and share the knowledge gained. In particular, there is a demand for immediate notifications and displays utilizing mobile devices.

[0516] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 1 is realized by the following means.

[0517] In this invention, the server includes means for collecting log data in real time, means for converting the log data into a unified format, and means for extracting and classifying error logs from the log data using a generative model. This enables immediate analysis of data collected from each component of the information system. Furthermore, by incorporating means for visualizing the analysis results using a mobile device and notifying them in real time, administrators can quickly address problems anytime, anywhere. This system significantly improves the reliability and efficiency of the server and enables proactive problem solving by leveraging knowledge from past incidents.

[0518] "Log data" refers to data that records the operating status and error information of an information system.

[0519] "Means of real-time collection" refers to a device or process for instantly acquiring log data the moment information is generated.

[0520] "Methods for converting to a unified format" refers to a function that organizes and converts log data recorded in different formats into a consistent format.

[0521] A "generative model" is a mathematical or computational model designed to perform pattern recognition or prediction using historical data.

[0522] An "error log" is a record that shows abnormalities or problems that occurred during the operation of a system.

[0523] A "security incident" is an unauthorized access, data breach, or other breach that could compromise the confidentiality, integrity, or availability of an information system.

[0524] A "system performance failure" is a problem that arises when an information system fails to perform as expected.

[0525] "Means of proposing improvement measures" refers to the function of presenting appropriate actions or measures to solve identified problems.

[0526] A "knowledge base" is a collection of information that systematically organizes past incidents and problem-solving solutions so that they can be used later.

[0527] A "management body" is a team or organization responsible for the operation and maintenance of a system.

[0528] A "portable information terminal" refers to a handheld information display device such as a smartphone or tablet.

[0529] "Visualization" is the process of visually displaying data and analysis results to communicate them in an easy-to-understand manner.

[0530] "Immediately" means that something is done without any delay.

[0531] This invention realizes a system that improves the performance of information systems by collecting and analyzing log data in real time. A specific embodiment of this system is described below.

[0532] The server first receives log data in real time from each component within the system. This process utilizes a data collection framework such as Fluentd. Since the received log data may be in various formats, it is converted to a unified format via Fluentd. This conversion enables consistent analysis within the database.

[0533] Next, the server uses software tools such as TensorFlow and Scikit-learn to build generative models and analyze log data in a unified format. In this analysis process, the system identifies the causes of errors and system performance issues and proposes solutions based on these findings. Furthermore, in the event of a security incident, it can immediately identify the details and generate appropriate warnings.

[0534] Furthermore, analysis results and warnings are displayed in real time on mobile devices. A notification system using Firebase Push Notifications allows users to quickly understand the situation no matter where they are. This application uses the analysis results to update its knowledge base, accumulating information to prevent future incidents.

[0535] For example, if a specific server experiences an abnormal load during business hours, this system immediately detects the situation and sends a notification to the user's mobile device, including a suggestion for load balancing. Based on this information, the user can respond quickly and restore stable system operation. This rapid feedback and response process significantly improves the efficiency of the information system.

[0536] Examples of prompt messages include the following:

[0537] "Please analyze the abnormal logs detected on the servers within the data center. Generate a report on the cause and recommended countermeasures. Also, check if there have been similar cases in the past and include past countermeasures."

[0538] The flow of a specific process in Application Example 1 will be explained using Figure 12.

[0539] Step 1:

[0540] The server collects all incoming log data in real time from each component of the system. This input data includes information such as time, message content, and error level. The server uses Fluentd to convert log data in different formats into a standardized, unified format and temporarily stores it in a database.

[0541] Step 2:

[0542] The server analyzes the log data, which has been converted to a unified format, using a generating AI model. The input data used is the data converted in step 1, and the output generates error types and frequencies, as well as the overall system operating status. This analysis utilizes a machine learning model using TensorFlow to perform data calculations for anomaly detection and to identify performance bottlenecks.

[0543] Step 3:

[0544] Based on the analysis results, the server generates solutions to identified errors and performance issues and updates its knowledge base. This data, based on input from the generated AI model, is output as a concrete action plan for the user. It proposes standard solutions to identified problems and stores past success stories and countermeasures in the knowledge base.

[0545] Step 4:

[0546] The device displays real-time analysis results from the server and immediately notifies the administrator. Input data includes server analysis results and knowledge base update information. Output includes direct notifications using Firebase Push Notifications and detailed displays on the device screen. This allows users to stay informed about the system status regardless of their location.

[0547] Step 5:

[0548] Users perform system configuration changes and troubleshooting based on notifications from their terminals. Inputs include solutions provided by the terminal and system log information, while output results in improved system performance and problem resolution. Specific actions include adjusting network settings and reviewing resource allocation. This process enables optimal system operation.

[0549] Furthermore, an emotion engine that estimates the user's emotions may be incorporated. That is, the identification processing unit 290 may use the emotion identification model 59 to estimate the user's emotions and perform identification processing using the user's emotions.

[0550] The system according to the present invention is based on a function that analyzes log data of an information system in real time, and adds an emotion engine that recognizes user emotions in real time. By combining technical insights derived from the analysis of log data with the emotional state of the user captured by the emotion engine, this system achieves more responsive system operation.

[0551] First, the server collects log data in real time and converts it into a unified format. Next, it analyzes the log data using a generative model to extract and classify error logs. This allows for the early detection of anomalies and bottlenecks within the system, and enables root cause identification and solution proposals based on these findings. This process utilizes past incident data for learning.

[0552] In addition, the emotion engine analyzes user input, such as text and voice, to extract the user's emotional state. This emotional information can be used to adjust the system's operation, particularly the user interface. For example, if a user is frustrated, the system can suggest improving response speed or simplifying interactions.

[0553] Furthermore, the server adds sentiment information to the knowledge base and records incidents related to emotions. This lays the foundation for developing future system improvements that take emotions into account.

[0554] As a concrete example, consider a case where a user is dissatisfied with the system's response to a particular operation on a given day. The emotion engine detects this situation in real time, and by comparing this information with the system's analysis results, the server promptly proposes countermeasures. For example, it might suggest simplifying the operation procedure or reviewing resource allocation to shorten response times. As a result, user dissatisfaction is reduced, the knowledge base is updated, and the ability to handle similar cases improves.

[0555] Thus, by integrating emotion recognition and log analysis, the system of the present invention can optimize the user experience and improve the reliability and efficiency of the system.

[0556] The following describes the processing flow.

[0557] Step 1:

[0558] The server collects log data generated from each application and hardware in real time. This is done using tools that continuously monitor log file updates and automatically receive log data whenever it is generated.

[0559] Step 2:

[0560] The server converts the collected log data into a unified format. Specifically, it uses regular expressions to extract necessary information (such as timestamps and error messages) from log entries and organizes it into an easily parsable data format such as JSON.

[0561] Step 3:

[0562] The server analyzes the log data transformed by the generative model. It extracts error logs from the log data and classifies them based on the type and location of the error. This analysis identifies potential problems in the system.

[0563] Step 4:

[0564] The emotion engine analyzes user text messages and voice input in real time to identify emotions. It uses natural language processing (NLP) techniques to infer emotions from text and voice analysis to infer emotions from intonation and tone.

[0565] Step 5:

[0566] The server integrates analyzed log data and sentiment information to adjust system responses. For example, if it detects that a user is expressing dissatisfaction, the server may suggest improvements to the user interface and use this as a trigger to optimize system performance.

[0567] Step 6:

[0568] The server adds analyzed log data and sentiment data to a knowledge base, recording incidents involving emotions. This allows the entire team to share incident information and use it for future problem feedback.

[0569] Step 7:

[0570] After receiving improvement suggestions from the server, the user adjusts system operations and settings. They send back feedback on the interface and evaluate the effectiveness of the system response.

[0571] In this way, this system integrates technical log analysis and emotion recognition, enabling intelligent system operation tailored to the user's needs and emotional state.

[0572] (Example 2)

[0573] Next, we will describe Example 2. In the following description, the data processing device 12 will be referred to as the "server," and the headset-type terminal 314 will be referred to as the "terminal."

[0574] In the operation of information systems, while real-time extraction and processing of error logs are required, system response optimization that reflects the emotional state of users is not adequately performed. Furthermore, there is a lack of mechanisms to share this information across the entire organization and to implement rapid responses and improvements.

[0575] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 2 is realized by the following means.

[0576] In this invention, the server includes means for collecting log information in real time, means for extracting and classifying error logs using a generative AI model, and means for analyzing the user's emotional state. This enables rapid processing of error logs and adjustment of responses based on the user's emotions.

[0577] "Log information" refers to records of data collected in real time from information systems.

[0578] A "unified format" is a data format that facilitates analysis by converting data from different formats into a consistent format.

[0579] A "generative AI model" is a mathematical model that uses artificial intelligence to analyze data and perform pattern recognition and prediction.

[0580] An "error" refers to a problem or anomaly that prevents a system from functioning normally.

[0581] "Methods for identifying causes and proposing solutions" refers to the process of analyzing the causes of errors or problems and providing solutions.

[0582] A "security incident" refers to an event or action that could potentially affect the security of a system.

[0583] A "bottleneck" refers to a factor or process that reduces the processing power of a system.

[0584] A "knowledge base" is a database that stores past experiences and analysis results related to system operation.

[0585] "Text and voice input" refers to information provided by the user to the system in the form of text or voice.

[0586] "Emotional state" refers to the psychological state a user exhibits through their input into the system.

[0587] "Means for adjusting system response" refers to functions that modify and optimize system operation based on the user's emotional state and analysis results.

[0588] This invention improves system efficiency and user experience in an information processing system by performing real-time analysis of log information and system responses that reflect the user's emotional state.

[0589] The server collects log information from information systems in real time and converts it into a unified format. This format conversion facilitates subsequent analysis. Based on the collected log information, an AI model is used to extract and classify errors, enabling early detection of anomalies and bottlenecks within the system.

[0590] The emotion engine uses natural language processing techniques to analyze text and voice input from the user and extract their emotional state. The extracted emotional information is used by the server to optimize system responses. Specifically, if the user is expressing frustration, the server re-evaluates resource allocation to improve response speed. It also suggests simplifying the user interface if the operation is complex.

[0591] The system's knowledge base is updated by combining emotional information and analysis results. This creates a comprehensive database including past event data, laying the foundation for future system improvements.

[0592] For example, if a user inputs something like, "This operation takes too long," the emotion engine immediately analyzes that dissatisfaction. The server then compares this emotion information with log analysis to identify the bottleneck process and suggest improvements. For instance, improving the system's response speed can alleviate user dissatisfaction.

[0593] An example of a prompt for a generative AI model is, "Analyze the user's current emotional state from their log data and generate suggestions for the system's response."

[0594] Thus, the system of the present invention can provide a highly responsive information processing system by combining log analysis and emotion recognition.

[0595] The flow of the specific processing in Example 2 will be explained using Figure 13.

[0596] Step 1:

[0597] The server collects log information from information systems in real time. The input consists of raw log data from network devices and applications. The server receives this data and integrates each data entry, adding timestamps as needed, to create a pure data stream.

[0598] Step 2:

[0599] The server converts the collected log information into a unified format. The input is the raw log data collected in Step 1. This data is analyzed and converted into a unified format that is easy for the generating AI model to process. The output is log data converted into a unified format, guaranteeing data consistency and completeness.

[0600] Step 3:

[0601] The server uses a generative AI model to extract and classify errors from log data in a unified format. The input is the log data in a unified format generated in step 2. The data is fed into the AI ​​model to detect and classify errors and anomalies. In this process, machine learning algorithms are used to identify specific error patterns, and the output is an error report classified by severity.

[0602] Step 4:

[0603] The emotion engine receives text and voice input from the user, analyzes it, and extracts the user's emotional state. Input includes natural language instructions and voice data obtained from the user interface. The data is processed using an emotion analysis algorithm, and the output is the user's emotional state (e.g., satisfied, dissatisfied, stressed).

[0604] Step 5:

[0605] The server combines the sentiment information obtained by the sentiment engine with the error report from step 3 to adjust the system's response. The inputs are the sentiment data and error classification data from the previous step. The server refers to these and, if necessary, reallocates system resources or adjusts processes. The output is a proposal for optimized system settings and user interface changes.

[0606] Step 6:

[0607] The server adds emotional states and analysis results to its knowledge base, accumulating information for future improvements. The input is the system's response information adjusted or determined in step 5. This information is added to the knowledge base and stored as reference information for handling similar cases. The output is an updated knowledge base.

[0608] (Application Example 2)

[0609] Next, we will explain application example 2. In the following explanation, the data processing device 12 will be referred to as the "server," and the headset-type terminal 314 will be referred to as the "terminal."

[0610] Current information systems lack real-time incident response that takes user emotions into consideration, resulting in insufficient optimization of system reliability and user experience. Furthermore, rapid and appropriate improvements are required in resolving security incidents and system performance bottlenecks.

[0611] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means.

[0612] In this invention, the server includes means for collecting log information in real time, means for converting the log information into a unified format, and means for extracting and classifying error logs from the log information using a generative AI model. This enables the rapid identification of security incidents and system performance bottlenecks, and allows for the adjustment of the interface to take user sentiment into consideration.

[0613] "Log information" refers to data that records the operating status of an information system.

[0614] "Methods for collecting information in real time" refer to methods for instantly acquiring information and storing it in a database or similar system.

[0615] "Methods for converting to a unified format" refer to methods for organizing data expressed in different formats into a consistent format.

[0616] "Using a generative AI model" means using a model that leverages machine learning techniques to find patterns and features from data.

[0617] "Means for extracting and classifying error logs" refers to a method for identifying errors in a system and organizing them according to similar error patterns.

[0618] A "security incident" is an event that causes intentional or accidental unauthorized access or threat to a system or data.

[0619] A "performance bottleneck" is a major factor or point of failure that degrades the overall performance of a system.

[0620] A "knowledge base" is a database that stores past cases and learned information to be used for decision-making and problem-solving.

[0621] "Means of recognizing user emotions" refers to technologies that determine a user's emotional state by analyzing their input data.

[0622] "Adjusting the user interface" means modifying and optimizing the operation screen and procedures to improve user convenience.

[0623] To implement this invention, a server for real-time monitoring of the information system and a terminal equipped with an emotion engine for detecting the user's emotions are required.

[0624] The server continuously collects log information from information systems and converts it into a unified format. Next, it uses a generative AI model to analyze this log information, extracting and classifying error logs. During this process, the server instantly detects security incidents and performance bottlenecks within the system based on specific error patterns, and alerts users and administrators. The analysis results are automatically added to a knowledge base and communicated to the entire team.

[0625] The device is equipped with an emotion engine that analyzes user emotions in real time based on user input, particularly text and voice data. If a user experiences frustration or anxiety while using the system, the device immediately evaluates those emotions and adjusts the user interface in conjunction with the server to provide a better user experience.

[0626] For example, if a user operates a smart home security system and expresses anxiety, the emotion engine can detect that emotion, and the server can suggest simplifying the user interface. Furthermore, using a generative AI model, it is possible to prioritize processing the most important error messages the system encounters.

[0627] An example of a prompt message is, "Given the user's speech data, determine the primary emotions detected, and suggest UI adjustments based on the levels of anxiety or frustration." This is intended to detect the primary emotions based on the user's speech data and suggest UI adjustments based on the level of anxiety or frustration.

[0628] The flow of a specific process in Application Example 2 will be explained using Figure 14.

[0629] Step 1:

[0630] The server collects log information from information systems in real time. This log information contains detailed records of various system events. The input log data is stored in a database inside the server.

[0631] Step 2:

[0632] The server converts the collected log information into a unified format. Here, log data stored in different formats and styles is organized into a consistent data format. The resulting unified log data becomes the input for the next analysis step.

[0633] Step 3:

[0634] The server uses a generative AI model to analyze log data in a unified format, extracting and classifying error logs. During the analysis, pattern recognition technology is used to distinguish between normal logs and abnormal (error) logs. As a result, specific error logs are extracted and sent to the next step.

[0635] Step 4:

[0636] The server identifies security incidents and performance bottlenecks based on extracted error logs. Here, it uses past incident data as a reference and a generative AI model to make predictions and determine the presence of problems. Identified incident information is output as a warning.

[0637] Step 5:

[0638] The server adds the analysis results to the knowledge base and automatically notifies the entire group of incident information. This notification process allows the team to quickly share incident details and take appropriate action.

[0639] Step 6:

[0640] The device receives user input, particularly voice and text data, and analyzes emotions using an emotion engine. This analysis classifies the user's emotional state and identifies emotions such as frustration and anxiety.

[0641] Step 7:

[0642] The device adjusts the user interface in cooperation with the server based on the analyzed user emotions. Specifically, if the user feels anxious, it simplifies the screen and provides audio guidance, among other interface improvements. An example of a prompt for this process is, "Given the user's speech data, determine the primary emotions detected and suggest UI adjustments based on the levels of anxiety or frustration."

[0643] The specific processing unit 290 transmits the result of the specific processing to the headset terminal 314. In the headset terminal 314, the control unit 46A causes the speaker 240 and display 343 to output the result of the specific processing. The microphone 238 acquires audio indicating user input for the result of the specific processing. The control unit 46A transmits the audio data indicating user input acquired by the microphone 238 to the data processing unit 12. In the data processing unit 12, the specific processing unit 290 acquires the audio data.

[0644] Data generation model 58 is a type of so-called generative AI (Artificial Intelligence). One example of data generation model 58 is ChatGPT (Internet search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search) <url: https: gemini.google.com ?hl="ja">Examples of generative AI include the following. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 is input with prompts containing instructions, and with inference data such as audio data representing speech, text data representing text, and image data representing images. The data generation model 58 infers from the input inference data according to the instructions indicated by the prompts, and outputs the inference results in data formats such as audio data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0645] In the above embodiment, an example was given in which specific processing is performed by the data processing device 12, but the technology of this disclosure is not limited thereto, and specific processing may also be performed by the headset terminal 314.

[0646] [Fourth Embodiment]

[0647] Figure 7 shows an example of the configuration of the data processing system 410 according to the fourth embodiment.

[0648] As shown in Figure 7, the data processing system 410 includes a data processing device 12 and a robot 414. An example of the data processing device 12 is a server.

[0649] The data processing device 12 comprises a computer 22, a database 24, and a communication interface 26. The computer 22 is an example of a "computer" related to the technology of this disclosure. The computer 22 comprises a processor 28, RAM 30, and storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication interface 26 are also connected to the bus 34. The communication interface 26 is connected to a network 54. An example of the network 54 is a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0650] The robot 414 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication interface 44, and a controlled object 443. The computer 36 includes a processor 46, RAM 48, and storage 50. The processor 46, RAM 48, and storage 50 are connected to a bus 52. The microphone 238, speaker 240, camera 42, and controlled object 443 are also connected to the bus 52.

[0651] The microphone 238 receives voice signals from the user 20 and receives instructions from the user 20. The microphone 238 captures the voice signals from the user 20, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to the instructions from the processor 46.

[0652] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an image sensor such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, and captures images of the area around the user 20 (for example, an imaging range defined by a field of view equivalent to the width of a typical healthy person's field of vision).

[0653] Communication interface 44 is connected to network 54. Communication interfaces 44 and 26 are responsible for the exchange of various information between processor 46 and processor 28 via network 54. The exchange of various information between processor 46 and processor 28 using communication interfaces 44 and 26 is performed in a secure manner.

[0654] The controlled object 443 includes a display device, LEDs in the eyes, and motors that drive the arms, hands, and feet. The posture and gestures of the robot 414 are controlled by controlling the motors of the arms, hands, and feet. Some of the robot 414's emotions can be expressed by controlling these motors. Furthermore, the robot 414's facial expressions can also be expressed by controlling the illumination state of the LEDs in its eyes.

[0655] Figure 8 shows an example of the main functions of the data processing device 12 and the robot 414. As shown in Figure 8, the data processing device 12 performs specific processing using the processor 28. The storage 32 stores the specific processing program 56.

[0656] The specific processing program 56 is an example of a "program" relating to the technology of this disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 in accordance with the specific processing program 56 executed on the RAM 30.

[0657] The storage 32 stores the data generation model 58 and the emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290.

[0658] In robot 414, the processor 46 performs the reception output processing. The storage 50 stores the reception output program 60. The processor 46 reads the reception output program 60 from the storage 50 and executes the read reception output program 60 on the RAM 48. The reception output processing is realized by the processor 46 operating as a control unit 46A according to the reception output program 60 executed on the RAM 48.

[0659] Next, the specific processing performed by the specific processing unit 290 of the data processing device 12 will be described. In the following description, the data processing device 12 will be referred to as the "server" and the robot 414 as the "terminal".

[0660] The system according to the present invention includes a program for monitoring the operating status of an information system in real time, analyzing log data, and quickly identifying and resolving problems. The operation of this program is described below.

[0661] First, the server receives log data sent from each component of the system in real time and converts it into a unified format. This allows for consistent analysis of log data in different formats.

[0662] Next, the server analyzes the log data using a generative model. This analysis identifies bottlenecks causing errors and performance degradation, and based on that, identifies the root cause and solution. This process includes predictive algorithms that leverage historical log data and incident history.

[0663] Furthermore, the server detects sections of log data related to security incidents and, if necessary, warns the user with details of the incident. This warning is provided in real time to encourage a quick response.

[0664] The analysis results are added to the system's knowledge base. This knowledge base allows teams to share information, leading to more efficient problem-solving and prevention of future incidents.

[0665] As a concrete example, consider a scenario where a server detects a significant network delay. The server analyzes log data and identifies an abnormally high load on a specific router. Once the cause of the problem is identified, the user can adjust network settings to distribute the load on that router, thereby resolving the delay issue. Furthermore, this solution is recorded in a knowledge base, which can be used to address similar cases in the future.

[0666] Thus, the system of the present invention can improve the reliability and efficiency of the system by enabling rapid error identification and resolution through real-time analysis, and further by accumulating and sharing knowledge.

[0667] The following describes the processing flow.

[0668] Step 1:

[0669] The server collects log data sent from each application and device within the system in real time. This process uses a file watcher that periodically checks for updates to the log files, immediately detecting newly recorded log entries.

[0670] Step 2:

[0671] The server converts the collected log data in various formats into a unified format. Specifically, it uses regular expressions to extract timestamps, error levels, message content, etc., from log entries and organizes them into JSON or XML format.

[0672] Step 3:

[0673] The server analyzes the transformed log data using a generative model. This model is based on machine learning algorithms and extracts error logs from the log data, classifying them based on the error level and message content.

[0674] Step 4:

[0675] The server identifies the cause of the error based on the error log and proposes a solution. At this stage, a predictive algorithm based on past incident data is applied to suggest solutions for similar problems.

[0676] Step 5:

[0677] The server detects security incidents based on log data. It monitors unusual user behavior and system access, and issues real-time warnings to users if an anomaly is detected.

[0678] Step 6:

[0679] The server analyzes system performance data to identify bottlenecks causing performance degradation. This uses monitoring data such as CPU usage and memory usage, and suggests improvement measures.

[0680] Step 7:

[0681] The server adds these analysis results to the knowledge base and automatically notifies the entire team in real time. Users can then access the knowledge base and share past incident information within the team, which helps prevent future incidents.

[0682] (Example 1)

[0683] Next, we will describe Example 1. In the following description, the data processing device 12 will be referred to as the "server" and the robot 414 as the "terminal".

[0684] In increasingly complex information processing systems, real-time error detection and rapid response are essential. However, conventional systems have struggled with the diverse formats of log information, making rapid and accurate analysis difficult. Furthermore, in addition to early detection and countermeasures for safety incidents, there has been a lack of mechanisms for learning effective solutions from past cases and efficiently accumulating and sharing knowledge. Therefore, there is a need to comprehensively solve the various problems that systems face.

[0685] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 1 is realized by the following means.

[0686] In this invention, the server includes means for acquiring log information in real time, means for converting the log information into a standard format, and means for extracting and classifying abnormal logs from the log information using a generative artificial intelligence model. This enables the unified analysis of diverse log information in real time, allowing for rapid error detection, the presentation of countermeasures, and the effective accumulation and sharing of knowledge.

[0687] "Log information" refers to data files that record the operation and status of an information processing system.

[0688] "Real-time" is a temporal concept that indicates that information acquisition and processing occur immediately.

[0689] A "standard format" is a common data format used to handle different data formats in a unified manner.

[0690] A "generative artificial intelligence model" is a machine learning model used to analyze data and learn patterns.

[0691] An "abnormal log" is log information that includes errors and warnings that deviate from normal system operation.

[0692] "Classification" is the act of dividing information into categories based on specific criteria.

[0693] A "security incident" refers to a problem or accident related to the security of an information system.

[0694] A "bottleneck" is a factor that limits the performance or processing speed of a system.

[0695] A "solution" is a plan or action to solve a specific problem.

[0696] "Analysis results" refer to conclusions or insights derived from the analysis of data.

[0697] A "knowledge aggregate" is a database that compiles past analysis results and empirical knowledge.

[0698] "Automatic notification" refers to a system that provides necessary information without requiring manual intervention.

[0699] A "factor" is a cause or factor that leads to a result.

[0700] A "solution" is a specific method or means of solving a problem.

[0701] "Case data" refers to information about specific events and situations that have occurred in the past.

[0702] A "working team" is a group formed to achieve a specific objective.

[0703] This invention is a technology for analyzing multiple log data in real time during the operation of an information processing system, and for quickly identifying and resolving problems. This system functions through the collaboration of a server, terminals, and users.

[0704] First, the server acquires log information from various components of the information processing system. Since log information is often in different formats, the server converts it to a standard format. This makes it possible to consistently analyze log information in different formats. The server uses a generative artificial intelligence model to extract and classify anomalies from the log information. In this analysis process, pattern recognition algorithms are used to identify system bottlenecks and safety incidents.

[0705] The terminal operates a database as a collection of knowledge, storing and sharing analysis results provided from the server. The interface on the terminal allows the team to view and edit analysis results and past case data, facilitating information sharing.

[0706] Users receive notifications from the server and take necessary actions to resolve the issue based on the results. For example, they might adjust the settings of specific network components and distribute the load to resolve latency or performance problems.

[0707] As a concrete example, if the server detects an abnormal delay in the network one day, the user can identify the cause and take immediate action. In this case, the server generates a prompt message such as, "Split the high-load session from a specific device and redistribute it across the entire network." This allows the user to receive assistance in taking specific measures.

[0708] With the system configuration described above, the present invention enables efficient and precise real-time analysis in complex and diverse information processing systems, and improves the reliability and efficiency of the entire system through the accumulation and sharing of knowledge.

[0709] The flow of the specific processing in Example 1 will be explained using Figure 11.

[0710] Step 1:

[0711] The server collects log information in real time from each component of the system. Its input is log information in various formats generated by each component. Specifically, the server immediately retrieves this raw information and temporarily stores it in various storage locations for later analysis. The output consists of log information awaiting conversion to a unified format.

[0712] Step 2:

[0713] The server converts the collected log information into a standard format. The input consists of log information in different formats prepared in Step 1. The server analyzes these logs and converts each item into a standardized timestamp and message structure. The output is log information formatted in a way that can be interpreted by the generating AI model.

[0714] Step 3:

[0715] The server analyzes the log information, which has been converted to a standard format, using a generative artificial intelligence model. The input includes the log information converted in step 2. Specifically, the server utilizes the AI ​​model to scan the data and identify patterns in abnormal logs. The output is an analysis result that includes error classification and an initial diagnosis of the cause.

[0716] Step 4:

[0717] The server classifies the error log and identifies the cause based on the analysis results, and generates prompt messages suggesting solutions. The input is the analysis results from step 3. The server analyzes this and uses AI to generate specific countermeasures and improvement measures appropriate to the situation. The output provides prompt messages indicating the actions the user should take.

[0718] Step 5:

[0719] The server detects security incidents in the log information and issues warnings to the user as needed. The input consists of log information in a standard format prepared in step 2 and the analysis results from steps 3 and 4. Specifically, the server uses an anomaly detection algorithm to immediately identify unauthorized access and security threats. The output includes warning messages to allow the user to react quickly.

[0720] Step 6:

[0721] The server adds the analysis results to the knowledge set and automatically notifies the work team via terminals. Inputs include analysis results and warnings from steps 4 and 5. Outputs include the newly updated knowledge set data and related notifications. This allows each member to easily access and prepare for similar problems.

[0722] (Application Example 1)

[0723] Next, we will explain Application Example 1. In the following explanation, the data processing device 12 will be referred to as the "server" and the robot 414 as the "terminal".

[0724] In today's information technology environment, real-time monitoring and rapid problem-solving are essential to maintaining system reliability and efficiency. However, properly analyzing vast amounts of log data and taking immediate action is not easy. Furthermore, there is a need for effective methods to learn from past incidents and share the knowledge gained. In particular, there is a demand for immediate notifications and displays utilizing mobile devices.

[0725] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 1 is realized by the following means.

[0726] In this invention, the server includes means for collecting log data in real time, means for converting the log data into a unified format, and means for extracting and classifying error logs from the log data using a generative model. This enables immediate analysis of data collected from each component of the information system. Furthermore, by incorporating means for visualizing the analysis results using a mobile device and notifying them in real time, administrators can quickly address problems anytime, anywhere. This system significantly improves the reliability and efficiency of the server and enables proactive problem solving by leveraging knowledge from past incidents.

[0727] "Log data" refers to data that records the operating status and error information of an information system.

[0728] "Means of real-time collection" refers to a device or process for instantly acquiring log data the moment information is generated.

[0729] "Methods for converting to a unified format" refers to a function that organizes and converts log data recorded in different formats into a consistent format.

[0730] A "generative model" is a mathematical or computational model designed to perform pattern recognition or prediction using historical data.

[0731] An "error log" is a record that shows abnormalities or problems that occurred during the operation of a system.

[0732] A "security incident" is an unauthorized access, data breach, or other breach that could compromise the confidentiality, integrity, or availability of an information system.

[0733] A "system performance failure" is a problem that arises when an information system fails to perform as expected.

[0734] "Means of proposing improvement measures" refers to the function of presenting appropriate actions or measures to solve identified problems.

[0735] A "knowledge base" is a collection of information that systematically organizes past incidents and problem-solving solutions so that they can be used later.

[0736] A "management body" is a team or organization responsible for the operation and maintenance of a system.

[0737] A "portable information terminal" refers to a handheld information display device such as a smartphone or tablet.

[0738] "Visualization" is the process of visually displaying data and analysis results to communicate them in an easy-to-understand manner.

[0739] "Immediately" means that something is done without any delay.

[0740] This invention realizes a system that improves the performance of information systems by collecting and analyzing log data in real time. A specific embodiment of this system is described below.

[0741] The server first receives log data in real time from each component within the system. This process utilizes a data collection framework such as Fluentd. Since the received log data may be in various formats, it is converted to a unified format via Fluentd. This conversion enables consistent analysis within the database.

[0742] Next, the server uses software tools such as TensorFlow and Scikit-learn to build generative models and analyze log data in a unified format. In this analysis process, the system identifies the causes of errors and system performance issues and proposes solutions based on these findings. Furthermore, in the event of a security incident, it can immediately identify the details and generate appropriate warnings.

[0743] Furthermore, analysis results and warnings are displayed in real time on mobile devices. A notification system using Firebase Push Notifications allows users to quickly understand the situation no matter where they are. This application uses the analysis results to update its knowledge base, accumulating information to prevent future incidents.

[0744] For example, if a specific server experiences an abnormal load during business hours, this system immediately detects the situation and sends a notification to the user's mobile device, including a suggestion for load balancing. Based on this information, the user can respond quickly and restore stable system operation. This rapid feedback and response process significantly improves the efficiency of the information system.

[0745] Examples of prompt messages include the following:

[0746] "Please analyze the abnormal logs detected on the servers within the data center. Generate a report on the cause and recommended countermeasures. Also, check if there have been similar cases in the past and include past countermeasures."

[0747] The flow of a specific process in Application Example 1 will be explained using Figure 12.

[0748] Step 1:

[0749] The server collects all incoming log data in real time from each component of the system. This input data includes information such as time, message content, and error level. The server uses Fluentd to convert log data in different formats into a standardized, unified format and temporarily stores it in a database.

[0750] Step 2:

[0751] The server analyzes the log data, which has been converted to a unified format, using a generating AI model. The input data used is the data converted in step 1, and the output generates error types and frequencies, as well as the overall system operating status. This analysis utilizes a machine learning model using TensorFlow to perform data calculations for anomaly detection and to identify performance bottlenecks.

[0752] Step 3:

[0753] Based on the analysis results, the server generates solutions to identified errors and performance issues and updates its knowledge base. This data, based on input from the generated AI model, is output as a concrete action plan for the user. It proposes standard solutions to identified problems and stores past success stories and countermeasures in the knowledge base.

[0754] Step 4:

[0755] The device displays real-time analysis results from the server and immediately notifies the administrator. Input data includes server analysis results and knowledge base update information. Output includes direct notifications using Firebase Push Notifications and detailed displays on the device screen. This allows users to stay informed about the system status regardless of their location.

[0756] Step 5:

[0757] Users perform system configuration changes and troubleshooting based on notifications from their terminals. Inputs include solutions provided by the terminal and system log information, while output results in improved system performance and problem resolution. Specific actions include adjusting network settings and reviewing resource allocation. This process enables optimal system operation.

[0758] Furthermore, an emotion engine that estimates the user's emotions may be incorporated. That is, the identification processing unit 290 may use the emotion identification model 59 to estimate the user's emotions and perform identification processing using the user's emotions.

[0759] The system according to the present invention is based on a function that analyzes log data of an information system in real time, and adds an emotion engine that recognizes user emotions in real time. By combining technical insights derived from the analysis of log data with the emotional state of the user captured by the emotion engine, this system achieves more responsive system operation.

[0760] First, the server collects log data in real time and converts it into a unified format. Next, it analyzes the log data using a generative model to extract and classify error logs. This allows for the early detection of anomalies and bottlenecks within the system, and enables root cause identification and solution proposals based on these findings. This process utilizes past incident data for learning.

[0761] In addition, the emotion engine analyzes user input, such as text and voice, to extract the user's emotional state. This emotional information can be used to adjust the system's operation, particularly the user interface. For example, if a user is frustrated, the system can suggest improving response speed or simplifying interactions.

[0762] Furthermore, the server adds sentiment information to the knowledge base and records incidents related to emotions. This lays the foundation for developing future system improvements that take emotions into account.

[0763] As a concrete example, consider a case where a user is dissatisfied with the system's response to a particular operation on a given day. The emotion engine detects this situation in real time, and by comparing this information with the system's analysis results, the server promptly proposes countermeasures. For example, it might suggest simplifying the operation procedure or reviewing resource allocation to shorten response times. As a result, user dissatisfaction is reduced, the knowledge base is updated, and the ability to handle similar cases improves.

[0764] Thus, by integrating emotion recognition and log analysis, the system of the present invention can optimize the user experience and improve the reliability and efficiency of the system.

[0765] The following describes the processing flow.

[0766] Step 1:

[0767] The server collects log data generated from each application and hardware in real time. This is done using tools that continuously monitor log file updates and automatically receive log data whenever it is generated.

[0768] Step 2:

[0769] The server converts the collected log data into a unified format. Specifically, it uses regular expressions to extract necessary information (such as timestamps and error messages) from log entries and organizes it into an easily parsable data format such as JSON.

[0770] Step 3:

[0771] The server analyzes the log data transformed by the generative model. It extracts error logs from the log data and classifies them based on the type and location of the error. This analysis identifies potential problems in the system.

[0772] Step 4:

[0773] The emotion engine analyzes user text messages and voice input in real time to identify emotions. It uses natural language processing (NLP) techniques to infer emotions from text and voice analysis to infer emotions from intonation and tone.

[0774] Step 5:

[0775] The server integrates analyzed log data and sentiment information to adjust system responses. For example, if it detects that a user is expressing dissatisfaction, the server may suggest improvements to the user interface and use this as a trigger to optimize system performance.

[0776] Step 6:

[0777] The server adds analyzed log data and sentiment data to a knowledge base, recording incidents involving emotions. This allows the entire team to share incident information and use it for future problem feedback.

[0778] Step 7:

[0779] After receiving improvement suggestions from the server, the user adjusts system operations and settings. They send back feedback on the interface and evaluate the effectiveness of the system response.

[0780] In this way, this system integrates technical log analysis and emotion recognition, enabling intelligent system operation tailored to the user's needs and emotional state.

[0781] (Example 2)

[0782] Next, we will describe Example 2. In the following description, the data processing device 12 will be referred to as the "server" and the robot 414 as the "terminal".

[0783] In the operation of information systems, while real-time extraction and processing of error logs are required, system response optimization that reflects the emotional state of users is not adequately performed. Furthermore, there is a lack of mechanisms to share this information across the entire organization and to implement rapid responses and improvements.

[0784] The identification process performed by the identification processing unit 290 of the data processing device 12 in Example 2 is realized by the following means.

[0785] In this invention, the server includes means for collecting log information in real time, means for extracting and classifying error logs using a generative AI model, and means for analyzing the user's emotional state. This enables rapid processing of error logs and adjustment of responses based on the user's emotions.

[0786] "Log information" refers to records of data collected in real time from information systems.

[0787] A "unified format" is a data format that facilitates analysis by converting data from different formats into a consistent format.

[0788] A "generative AI model" is a mathematical model that uses artificial intelligence to analyze data and perform pattern recognition and prediction.

[0789] An "error" refers to a problem or anomaly that prevents a system from functioning normally.

[0790] "Methods for identifying causes and proposing solutions" refers to the process of analyzing the causes of errors or problems and providing solutions.

[0791] A "security incident" refers to an event or action that could potentially affect the security of a system.

[0792] A "bottleneck" refers to a factor or process that reduces the processing power of a system.

[0793] A "knowledge base" is a database that stores past experiences and analysis results related to system operation.

[0794] "Text and voice input" refers to information provided by the user to the system in the form of text or voice.

[0795] "Emotional state" refers to the psychological state a user exhibits through their input into the system.

[0796] "Means for adjusting system response" refers to functions that modify and optimize system operation based on the user's emotional state and analysis results.

[0797] This invention improves system efficiency and user experience in an information processing system by performing real-time analysis of log information and system responses that reflect the user's emotional state.

[0798] The server collects log information from information systems in real time and converts it into a unified format. This format conversion facilitates subsequent analysis. Based on the collected log information, an AI model is used to extract and classify errors, enabling early detection of anomalies and bottlenecks within the system.

[0799] The emotion engine uses natural language processing techniques to analyze text and voice input from the user and extract their emotional state. The extracted emotional information is used by the server to optimize system responses. Specifically, if the user is expressing frustration, the server re-evaluates resource allocation to improve response speed. It also suggests simplifying the user interface if the operation is complex.

[0800] The system's knowledge base is updated by combining emotional information and analysis results. This creates a comprehensive database including past event data, laying the foundation for future system improvements.

[0801] For example, if a user inputs something like, "This operation takes too long," the emotion engine immediately analyzes that dissatisfaction. The server then compares this emotion information with log analysis to identify the bottleneck process and suggest improvements. For instance, improving the system's response speed can alleviate user dissatisfaction.

[0802] An example of a prompt for a generative AI model is, "Analyze the user's current emotional state from their log data and generate suggestions for the system's response."

[0803] Thus, the system of the present invention can provide a highly responsive information processing system by combining log analysis and emotion recognition.

[0804] The flow of the specific processing in Example 2 will be explained using Figure 13.

[0805] Step 1:

[0806] The server collects log information from information systems in real time. The input consists of raw log data from network devices and applications. The server receives this data and integrates each data entry, adding timestamps as needed, to create a pure data stream.

[0807] Step 2:

[0808] The server converts the collected log information into a unified format. The input is the raw log data collected in Step 1. This data is analyzed and converted into a unified format that is easy for the generating AI model to process. The output is log data converted into a unified format, guaranteeing data consistency and completeness.

[0809] Step 3:

[0810] The server uses a generative AI model to extract and classify errors from log data in a unified format. The input is the log data in a unified format generated in step 2. The data is fed into the AI ​​model to detect and classify errors and anomalies. In this process, machine learning algorithms are used to identify specific error patterns, and the output is an error report classified by severity.

[0811] Step 4:

[0812] The emotion engine receives text and voice input from the user, analyzes it, and extracts the user's emotional state. Input includes natural language instructions and voice data obtained from the user interface. The data is processed using an emotion analysis algorithm, and the output is the user's emotional state (e.g., satisfied, dissatisfied, stressed).

[0813] Step 5:

[0814] The server combines the sentiment information obtained by the sentiment engine with the error report from step 3 to adjust the system's response. The inputs are the sentiment data and error classification data from the previous step. The server refers to these and, if necessary, reallocates system resources or adjusts processes. The output is a proposal for optimized system settings and user interface changes.

[0815] Step 6:

[0816] The server adds emotional states and analysis results to its knowledge base, accumulating information for future improvements. The input is the system's response information adjusted or determined in step 5. This information is added to the knowledge base and stored as reference information for handling similar cases. The output is an updated knowledge base.

[0817] (Application Example 2)

[0818] Next, we will explain application example 2. In the following explanation, the data processing device 12 will be referred to as the "server" and the robot 414 as the "terminal".

[0819] Current information systems lack real-time incident response that takes user emotions into consideration, resulting in insufficient optimization of system reliability and user experience. Furthermore, rapid and appropriate improvements are required in resolving security incidents and system performance bottlenecks.

[0820] The specific processing performed by the specific processing unit 290 of the data processing device 12 in Application Example 2 is realized by the following means.

[0821] In this invention, the server includes means for collecting log information in real time, means for converting the log information into a unified format, and means for extracting and classifying error logs from the log information using a generative AI model. This enables the rapid identification of security incidents and system performance bottlenecks, and allows for the adjustment of the interface to take user sentiment into consideration.

[0822] "Log information" refers to data that records the operating status of an information system.

[0823] "Methods for collecting information in real time" refer to methods for instantly acquiring information and storing it in a database or similar system.

[0824] "Methods for converting to a unified format" refer to methods for organizing data expressed in different formats into a consistent format.

[0825] "Using a generative AI model" means using a model that leverages machine learning techniques to find patterns and features from data.

[0826] "Means for extracting and classifying error logs" refers to a method for identifying errors in a system and organizing them according to similar error patterns.

[0827] A "security incident" is an event that causes intentional or accidental unauthorized access or threat to a system or data.

[0828] A "performance bottleneck" is a major factor or point of failure that degrades the overall performance of a system.

[0829] A "knowledge base" is a database that stores past cases and learned information to be used for decision-making and problem-solving.

[0830] "Means of recognizing user emotions" refers to technologies that determine a user's emotional state by analyzing their input data.

[0831] "Adjusting the user interface" means modifying and optimizing the operation screen and procedures to improve user convenience.

[0832] To implement this invention, a server for real-time monitoring of the information system and a terminal equipped with an emotion engine for detecting the user's emotions are required.

[0833] The server continuously collects log information from information systems and converts it into a unified format. Next, it uses a generative AI model to analyze this log information, extracting and classifying error logs. During this process, the server instantly detects security incidents and performance bottlenecks within the system based on specific error patterns, and alerts users and administrators. The analysis results are automatically added to a knowledge base and communicated to the entire team.

[0834] The device is equipped with an emotion engine that analyzes user emotions in real time based on user input, particularly text and voice data. If a user experiences frustration or anxiety while using the system, the device immediately evaluates those emotions and adjusts the user interface in conjunction with the server to provide a better user experience.

[0835] For example, if a user operates a smart home security system and expresses anxiety, the emotion engine can detect that emotion, and the server can suggest simplifying the user interface. Furthermore, using a generative AI model, it is possible to prioritize processing the most important error messages the system encounters.

[0836] An example of a prompt message is, "Given the user's speech data, determine the primary emotions detected, and suggest UI adjustments based on the levels of anxiety or frustration." This is intended to detect the primary emotions based on the user's speech data and suggest UI adjustments based on the level of anxiety or frustration.

[0837] The flow of a specific process in Application Example 2 will be explained using Figure 14.

[0838] Step 1:

[0839] The server collects log information from information systems in real time. This log information contains detailed records of various system events. The input log data is stored in a database inside the server.

[0840] Step 2:

[0841] The server converts the collected log information into a unified format. Here, log data stored in different formats and styles is organized into a consistent data format. The resulting unified log data becomes the input for the next analysis step.

[0842] Step 3:

[0843] The server uses a generative AI model to analyze log data in a unified format, extracting and classifying error logs. During the analysis, pattern recognition technology is used to distinguish between normal logs and abnormal (error) logs. As a result, specific error logs are extracted and sent to the next step.

[0844] Step 4:

[0845] The server identifies security incidents and performance bottlenecks based on extracted error logs. Here, it uses past incident data as a reference and a generative AI model to make predictions and determine the presence of problems. Identified incident information is output as a warning.

[0846] Step 5:

[0847] The server adds the analysis results to the knowledge base and automatically notifies the entire group of incident information. This notification process allows the team to quickly share incident details and take appropriate action.

[0848] Step 6:

[0849] The device receives user input, particularly voice and text data, and analyzes emotions using an emotion engine. This analysis classifies the user's emotional state and identifies emotions such as frustration and anxiety.

[0850] Step 7:

[0851] The device adjusts the user interface in cooperation with the server based on the analyzed user emotions. Specifically, if the user feels anxious, it simplifies the screen and provides audio guidance, among other interface improvements. An example of a prompt for this process is, "Given the user's speech data, determine the primary emotions detected and suggest UI adjustments based on the levels of anxiety or frustration."

[0852] The specific processing unit 290 transmits the result of the specific processing to the robot 414. In the robot 414, the control unit 46A causes the speaker 240 and the controlled object 443 to output the result of the specific processing. The microphone 238 acquires audio indicating user input for the result of the specific processing. The control unit 46A transmits the audio data indicating user input acquired by the microphone 238 to the data processing unit 12. In the data processing unit 12, the specific processing unit 290 acquires the audio data.

[0853] Data generation model 58 is a type of so-called generative AI (Artificial Intelligence). One example of data generation model 58 is ChatGPT (Internet search<URL: https: / / openai.com / blog / chatgpt> ), Gemini (Internet search) <url: https: gemini.google.com ?hl="ja">Examples of generative AI include the following. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 is input with prompts containing instructions, and with inference data such as audio data representing speech, text data representing text, and image data representing images. The data generation model 58 infers from the input inference data according to the instructions indicated by the prompts, and outputs the inference results in data formats such as audio data and text data. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization.

[0854] In the above embodiment, an example was given in which specific processing is performed by the data processing device 12, but the technology of this disclosure is not limited thereto, and the specific processing may also be performed by the robot 414.

[0855] Furthermore, the emotion identification model 59, acting as an emotion engine, may determine the user's emotion according to a specific mapping. Specifically, the emotion identification model 59 may determine the user's emotion according to a specific mapping, which is an emotion map (see Figure 9). Similarly, the emotion identification model 59 may also determine the robot's emotion, and the identification processing unit 290 may perform identification processing using the robot's emotion.

[0856] Figure 9 shows an emotion map 400 in which multiple emotions are mapped. In the emotion map 400, emotions are arranged in concentric circles radiating from the center. The closer to the center of the concentric circles, the more primitive the emotions are located. Further out of the concentric circles, emotions representing states and actions arising from mental states are located. Emotion is a concept that includes feelings and mental states. On the left side of the concentric circles, emotions that are generally generated from reactions occurring in the brain are located. On the right side of the concentric circles, emotions that are generally induced by situational judgment are located. Above and below the concentric circles, emotions that are generally generated from reactions occurring in the brain and induced by situational judgment are located. In addition, the emotion of "pleasure" is located on the upper side of the concentric circles, and the emotion of "displeasure" is located on the lower side. Thus, in the emotion map 400, multiple emotions are mapped based on the structure in which emotions arise, and emotions that are likely to occur simultaneously are mapped close together.

[0857] These emotions are distributed at the 3 o'clock position on the Emotion Map 400, and usually fluctuate between feelings of security and anxiety. In the right half of the Emotion Map 400, situational awareness takes precedence over internal feelings, resulting in a calm impression.

[0858] The inside of the Emotion Map 400 represents inner thoughts, while the outside represents actions. Therefore, the further you go from the outside of the Emotion Map 400, the more visible (expressed in actions) your emotions become.

[0859] Here, human emotions are based on various balances, such as posture and blood sugar levels. When these balances deviate from the ideal, it results in discomfort, and when they approach the ideal, it results in pleasure. Similarly, in robots, cars, motorcycles, etc., emotions can be created based on various balances, such as posture and battery level. When these balances deviate from the ideal, it results in discomfort, and when they approach the ideal, it results in pleasure. The emotion map can be generated, for example, based on Dr. Mitsuyoshi's emotion map (Research on a system for analyzing brain physiological signals of speech emotion recognition and emotion, Tokushima University, doctoral dissertation: https: / / ci.nii.ac.jp / naid / 500000375379). The left half of the emotion map contains emotions belonging to a region called "response," where sensation is dominant. The right half of the emotion map contains emotions belonging to a region called "situation," where situational awareness is dominant.

[0860] The emotion map defines two emotions that promote learning. One is the emotion around the middle of the negative "repentance" and "reflection" on the situation side. In other words, it is when the robot experiences negative emotions such as "I never want to feel this way again" or "I don't want to be scolded again." The other is the emotion around the positive "desire" on the reaction side. In other words, it is when the robot has positive feelings such as "I want more" or "I want to know more."

[0861] The emotion identification model 59 inputs user input into a pre-trained neural network, obtains emotion values ​​representing each emotion shown in the emotion map 400, and determines the user's emotion. This neural network is pre-trained based on multiple training data sets, which are combinations of user input and emotion values ​​representing each emotion shown in the emotion map 400. Furthermore, this neural network is trained so that emotions located close together have similar values, as shown in the emotion map 900 in Figure 10. Figure 10 shows an example where multiple emotions such as "reassured," "calm," and "confident" have similar emotion values.

[0862] The above description primarily focuses on the functions of the data processing device 12 in relation to this disclosure. However, the system related to this disclosure is not necessarily implemented on a server. The system related to this disclosure may be implemented as a general information processing system. This disclosure may be implemented, for example, as a software program that runs on a personal computer or as an application that runs on a smartphone. The method related to this disclosure may be provided to users in SaaS (Software as a Service) format.

[0863] In the above embodiment, an example was given in which a specific process is performed by a single computer 22. However, the technology of this disclosure is not limited thereto, and a distributed processing of the specific process may be performed by multiple computers, including computer 22. For example, a data generation model 58 may be provided in an external device of the data processing device 12, and the external device may generate data according to the input data.

[0864] In the above embodiment, an example was given in which the specific processing program 56 is stored in the storage 32, but the technology of this disclosure is not limited thereto. For example, the specific processing program 56 may be stored in a portable, computer-readable, non-temporary storage medium such as a USB (Universal Serial Bus) memory. The specific processing program 56 stored in the non-temporary storage medium is installed in the computer 22 of the data processing device 12. The processor 28 executes specific processing according to the specific processing program 56.

[0865] Alternatively, the specific processing program 56 may be stored in a storage device such as a server connected to the data processing device 12 via the network 54, and the specific processing program 56 may be downloaded and installed on the computer 22 in response to a request from the data processing device 12.

[0866] Furthermore, it is not necessary to store the entirety of the specific processing program 56 in a storage device such as a server connected to the data processing device 12 via the network 54, or to store the entirety of the specific processing program 56 in the storage 32; it is acceptable to store only a portion of the specific processing program 56.

[0867] The following types of processors can be used as hardware resources to perform specific processing. Examples of processors include a CPU, a general-purpose processor that functions as a hardware resource to perform specific processing by executing software, i.e., a program. Other examples of processors include dedicated electrical circuits, such as FPGAs (Field-Programmable Gate Arrays), PLDs (Programmable Logic Devices), or ASICs (Application Specific Integrated Circuits), which have circuit configurations specifically designed to perform specific processing. All of these processors have built-in or connected memory, and all of them perform specific processing by using memory.

[0868] The hardware resource that performs a specific process may consist of one of these various processors, or it may consist of a combination of two or more processors of the same or different types (for example, a combination of multiple FPGAs, or a combination of a CPU and an FPGA). Alternatively, the hardware resource that performs a specific process may consist of a single processor.

[0869] Examples of configurations using a single processor include, firstly, a configuration in which one or more CPUs and software are combined to form a single processor, and this processor functions as a hardware resource that performs a specific process. Secondly, there is a configuration using a processor that realizes the functions of the entire system, including multiple hardware resources that perform a specific process, on a single IC chip, as exemplified by SoCs (System-on-a-chip). In this way, a specific process is realized using one or more of the above types of processors as hardware resources.

[0870] Furthermore, the hardware structure of these various processors can more specifically utilize electrical circuits that combine circuit elements such as semiconductor devices. Also, the specific processing described above is merely an example. Therefore, it goes without saying that unnecessary steps can be deleted, new steps added, or the processing order rearranged, as long as it does not deviate from the main purpose.

[0871] The descriptions and illustrations presented above are detailed explanations of the technical aspects of this disclosure and are merely examples of the technical aspects. For example, the above descriptions of the structure, function, operation, and effect are examples of the structure, function, operation, and effect of the technical aspects of this disclosure. Therefore, it goes without saying that you may delete unnecessary parts, add new elements, or replace elements in the descriptions and illustrations presented above, as long as you do not deviate from the essence of the technical aspects of this disclosure. Furthermore, in order to avoid confusion and facilitate understanding of the technical aspects of this disclosure, explanations of common technical knowledge and the like that do not require special explanation to enable the implementation of the technical aspects of this disclosure have been omitted from the descriptions and illustrations presented above.

[0872] All documents, patent applications, and technical standards described herein are incorporated by reference to the same extent as if each individual document, patent application, and technical standard were specifically and individually noted to be incorporated by reference.

[0873] The following is further disclosed regarding the embodiments described above.

[0874] (Claim 1)

[0875] A means of collecting log data in real time,

[0876] Means for converting the log data into a unified format,

[0877] A means for extracting and classifying error logs from the log data using a generative model,

[0878] A means for identifying the cause and proposing a solution based on the aforementioned error log,

[0879] Means for detecting and warning about security incidents,

[0880] A means to identify system performance bottlenecks and propose improvement measures,

[0881] A system that includes a means to add analysis results to a knowledge base and automatically notify the team.

[0882] (Claim 2)

[0883] The system according to claim 1, characterized in that the means for identifying the cause and proposing a solution identifies the cause and proposes a solution by predicting it using a generative model based on past incident data.

[0884] (Claim 3)

[0885] The system according to claim 1, characterized in that the knowledge base update and notification means adds analysis results in real time and automatically notifies the entire team, thereby sharing information about past incidents.

[0886] "Example 1"

[0887] (Claim 1)

[0888] A means of acquiring log information in real time,

[0889] Means for converting the log information into a standard format,

[0890] A means for extracting and classifying abnormal logs from the log information using a generative artificial intelligence model,

[0891] A means for identifying the cause and proposing a solution based on the aforementioned anomaly log,

[0892] Means for detecting and warning about safety incidents,

[0893] A means of identifying performance bottlenecks in information processing systems and proposing improvement measures,

[0894] A system that includes a means of adding analysis results to a knowledge base and automatically notifying the work team.

[0895] (Claim 2)

[0896] The system according to claim 1, characterized in that the means for identifying factors and proposing solutions identifies factors and proposes solutions by predicting them using an artificial intelligence model generated based on past case data.

[0897] (Claim 3)

[0898] The system according to claim 1, characterized in that the means for updating and notifying the knowledge set adds analysis results in real time and automatically notifies the entire work team, thereby sharing information about past cases.

[0899] "Application Example 1"

[0900] (Claim 1)

[0901] A means of collecting log data in real time,

[0902] Means for converting the log data into a unified format,

[0903] A means for extracting and classifying error logs from the log data using a generative model,

[0904] A means for identifying the cause and proposing a solution based on the aforementioned error log,

[0905] Means for detecting and warning about security incidents,

[0906] A means to identify system performance issues and propose solutions,

[0907] A means of adding the analysis results to a knowledge base and automatically notifying the management organization,

[0908] A system that includes means for visualizing analysis results using a mobile device and notifying them in real time.

[0909] (Claim 2)

[0910] The system according to claim 1, characterized in that the means for identifying the cause and proposing a solution identifies the cause and proposes a solution by predicting it using a statistical model based on past failure data.

[0911] (Claim 3)

[0912] The system according to claim 1, characterized in that the knowledge base update and notification means automatically notifies the administrator on a mobile device by immediately adding analysis results and sharing information about past failures.

[0913] "Example 2 of combining an emotion engine"

[0914] (Claim 1)

[0915] A means of collecting log information in real time,

[0916] Means for converting the log information into a unified format,

[0917] A means for extracting and classifying errors from the log information using a generative AI model,

[0918] A means of identifying the cause and proposing a solution based on the aforementioned error,

[0919] A means of detecting and warning about security incidents,

[0920] A means to identify bottlenecks in data processing performance and propose improvement measures,

[0921] A means of adding analysis results to a knowledge base and automatically notifying the organization,

[0922] A means of analyzing the emotional state from the user's text or voice input,

[0923] Means for adjusting the system response based on the aforementioned emotional information,

[0924] A means of updating a knowledge base by combining the aforementioned emotional information and analysis results,

[0925] A system that includes this.

[0926] (Claim 2)

[0927] The system according to claim 1, characterized in that the means for identifying the cause and proposing a solution involves predicting the cause using an AI model generated based on past event data, thereby identifying the cause and proposing a solution.

[0928] (Claim 3)

[0929] The system according to claim 1, characterized in that the knowledge base update and notification means adds analysis results in real time and automatically notifies the entire organization, thereby sharing information about past events.

[0930] "Application example 2 when combining with an emotional engine"

[0931] (Claim 1)

[0932] A means of collecting log information in real time,

[0933] Means for converting the log information into a unified format,

[0934] A means for extracting and classifying error logs from the log information using a generative AI model,

[0935] A means for identifying the cause based on the aforementioned error log and proposing a solution,

[0936] A means of detecting and warning about security incidents,

[0937] A means to identify system performance bottlenecks and propose improvement measures,

[0938] A means of adding the analysis results to a knowledge base and automatically notifying the group,

[0939] A system that includes means for recognizing user emotions and adjusting the user interface.

[0940] (Claim 2)

[0941] The system according to claim 1, characterized in that the means for identifying the cause and proposing a solution identifies the cause and proposes a solution by predicting it using an AI model generated based on past incident data.

[0942] (Claim 3)

[0943] The system according to claim 1, characterized in that the knowledge base update and notification means adds analysis results in real time and automatically notifies the entire group, thereby sharing information about past incidents. [Explanation of Symbols]

[0944] 10, 210, 310, 410 Data Processing Systems 12 Data Processing Devices 14 Smart Devices 214 Smart Glasses 314 Headset-type terminal 414 Robots< / url:> < / url:> < / url:> < / url:>

Claims

1. A means of collecting log data in real time, Means for converting the log data into a unified format, A means for extracting and classifying error logs from the log data using a generative model, A means for identifying the cause and proposing a solution based on the aforementioned error log, Means for detecting and warning about security incidents, A means to identify system performance issues and propose solutions, A means of adding the analysis results to a knowledge base and automatically notifying the management organization, A system that includes means for visualizing analysis results using a mobile device and notifying them in real time.

2. The system according to claim 1, characterized in that the means for identifying the cause and proposing a solution identifies the cause and proposes a solution by predicting it using a statistical model based on past failure data.

3. The system according to claim 1, characterized in that the knowledge base update and notification means automatically notifies the administrator on a mobile device by immediately adding analysis results and sharing information about past failures.

Images