system

Abstract

The system according to this embodiment aims to detect network anomalies in real time and respond immediately. [Solution] The system according to the embodiment comprises a collection unit, an analysis unit, an alert unit, and an automation unit. The collection unit collects data for continuously monitoring the network status. The analysis unit analyzes the data collected by the collection unit and detects anomalies. The alert unit immediately issues an alert when an anomaly is detected by the analysis unit. The automation unit performs partial automation of initial response based on the alert issued by the alert unit.

Description

Technical Field

[0001] The technology of the present disclosure relates to a system.

Background Art

[0002] Patent Document 1 discloses a persona chatbot control method performed by at least one processor, including steps of receiving a user utterance, adding the user utterance to a prompt including an instruction sentence related to an explanation of a chatbot character, encoding the prompt, and inputting the encoded prompt into a language model to generate a chatbot utterance in response to the user utterance.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] In the prior art, there is a problem that it is difficult to detect network anomalies in real time and respond immediately.

[0005] The system according to the embodiment aims to detect network anomalies in real time and respond immediately.

Means for Solving the Problems

[0006] The system according to this embodiment comprises a data collection unit, an analysis unit, an alert unit, and an automation unit. The data collection unit collects data for continuously monitoring the network status. The analysis unit analyzes the data collected by the data collection unit and detects anomalies. The alert unit immediately issues an alert when an anomaly is detected by the analysis unit. The automation unit performs partial automation of initial response based on the alert issued by the alert unit. [Effects of the Invention]

[0007] The system according to this embodiment can detect network anomalies in real time and respond immediately. [Brief explanation of the drawing]

[0008] [Figure 1] This is a conceptual diagram showing an example of the configuration of a data processing system according to the first embodiment. [Figure 2] This is a conceptual diagram showing an example of the essential functions of a data processing device and a smart device according to the first embodiment. [Figure 3] This is a conceptual diagram showing an example of the configuration of a data processing system according to the second embodiment. [Figure 4] This is a conceptual diagram showing an example of the main functions of a data processing device and smart glasses according to the second embodiment. [Figure 5] This is a conceptual diagram showing an example of the configuration of a data processing system according to the third embodiment. [Figure 6] This is a conceptual diagram showing an example of the main functions of a data processing device and a headset-type terminal according to the third embodiment. [Figure 7] This is a conceptual diagram showing an example of the configuration of a data processing system according to the fourth embodiment. [Figure 8] This is a conceptual diagram showing an example of the main functions of a data processing device and a robot according to the fourth embodiment. [Figure 9] This shows an emotion map where multiple emotions are mapped. [Figure 10] This shows an emotion map where multiple emotions are mapped. [Modes for carrying out the invention]

[0009] Hereinafter, an example of an embodiment of the system relating to the technology of this disclosure will be described with reference to the attached drawings.

[0010] First, let's explain the terminology used in the following explanation.

[0011] In the following embodiments, the signed processor (hereinafter simply referred to as "processor") may be a single arithmetic unit or a combination of multiple arithmetic units. Furthermore, the processor may be a single type of arithmetic unit or a combination of multiple types of arithmetic units. Examples of arithmetic units include CPU (Central Processing Unit), GPU (Graphics Processing Unit), GPGPU (General-Purpose computing on Graphics Processing Units), APU (Accelerated Processing Unit), or TPU (Tensor Processing Unit).

[0012] In the following embodiments, signed RAM (Random Access Memory) is a memory that temporarily stores information and is used as work memory by the processor.

[0013] In the following embodiments, the signed storage is one or more non-volatile storage devices that store various programs and various parameters. Examples of non-volatile storage devices include flash memory (SSD (Solid State Drive)), magnetic disks (e.g., hard disks), or magnetic tapes.

[0014] In the following embodiments, the labeled communication I / F (Interface) is an interface including a communication processor, an antenna, and the like. The communication I / F controls communication between a plurality of computers. Examples of communication standards applied to the communication I / F include wireless communication standards such as 5G (5th Generation Mobile Communication System), Wi-Fi (registered trademark), or Bluetooth (registered trademark).

[0015] In the following embodiments, "A and / or B" is synonymous with "at least one of A and B". That is, "A and / or B" means that it may be only A, only B, or a combination of A and B. Also, in this specification, when expressing three or more matters connected by "and / or", the same concept as "A and / or B" is applied.

[0016] [First Embodiment] FIG. 1 shows an example of the configuration of a data processing system 10 according to the first embodiment.

[0017] As shown in FIG. 1, the data processing system 10 includes a data processing device 12 and a smart device 14. An example of the data processing device 12 is a server.

[0018] The data processing device 12 includes a computer 22, a database 24, and a communication I / F 26. The computer 22 includes a processor 28, a RAM 30, and a storage 32. The processor 28, the RAM 30, and the storage 32 are connected to a bus 34. Also, the database 24 and the communication I / F 26 are connected to the bus 34. The communication I / F 26 is connected to a network 54. Examples of the network 54 include a WAN (Wide Area Network) and / or a LAN (Local Area Network).

[0019] The smart device 14 comprises a computer 36, a receiving device 38, an output device 40, a camera 42, and a communication interface 44. The computer 36 comprises a processor 46, RAM 48, and storage 50. The processor 46, RAM 48, and storage 50 are connected to a bus 52. The receiving device 38, output device 40, and camera 42 are also connected to the bus 52.

[0020] The reception device 38 is equipped with a touch panel 38A and a microphone 38B, and accepts user input. The touch panel 38A accepts user input via touch by detecting contact with an object (e.g., a pen or finger). The microphone 38B accepts user input via voice by detecting the user's voice. The control unit 46A transmits data indicating the user input received by the touch panel 38A and microphone 38B to the data processing unit 12. In the data processing unit 12, the specific processing unit 290 (see Figure 2) acquires the data indicating the user input.

[0021] The output device 40 includes a display 40A and a speaker 40B, and presents data to the user by outputting the data in a form perceptible to the user (e.g., audio and / or text). The display 40A displays visible information such as text and images according to instructions from the processor 46. The speaker 40B outputs audio according to instructions from the processor 46. The camera 42 is a small digital camera equipped with an optical system such as a lens, aperture, and shutter, and an image sensor such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor.

[0022] Communication interface 44 is connected to network 54. Communication interfaces 44 and 26 are responsible for the exchange of various types of information between processor 46 and processor 28 via network 54.

[0023] Figure 2 shows an example of the main functions of the data processing device 12 and the smart device 14.

[0024] As shown in Figure 2, in the data processing device 12, a specific processing is performed by the processor 28. A specific processing program 56 is stored in the storage 32. The specific processing program 56 is an example of a "program" related to the technology of this disclosure. The processor 28 reads the specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 operating as a specific processing unit 290 according to the specific processing program 56 executed on the RAM 30.

[0025] Storage 32 stores the data generation model 58 and the emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290. The identification processing unit 290 can estimate the user's emotions using the emotion identification model 59 and perform identification processing using the user's emotions. The emotion estimation function (emotion identification function) using the emotion identification model 59 performs various estimations and predictions regarding the user's emotions, including but not limited to these examples. Furthermore, emotion estimation and prediction also include, for example, emotion analysis.

[0026] In the smart device 14, specific processing is performed by the processor 46. The storage 50 stores a specific processing program 60. The specific processing program 60 is used in conjunction with the specific processing program 56 by the data processing system 10. The processor 46 reads the specific processing program 60 from the storage 50 and executes the read specific processing program 60 on the RAM 48. The specific processing is realized by the processor 46 operating as a control unit 46A according to the specific processing program 60 executed on the RAM 48. The smart device 14 also has a data generation model 58 and an emotion identification model 59, similar to the data generation model and emotion identification model 59, and can perform processing similar to that of the specific processing unit 290 using these models.

[0027] Furthermore, other devices besides the data processing device 12 may also have the data generation model 58. For example, a server device (e.g., a generation server) may have the data generation model 58. In this case, the data processing device 12 obtains processing results (such as prediction results) using the data generation model 58 by communicating with the server device having the data generation model 58. The data processing device 12 may also be a server device or a terminal device owned by a user (e.g., a mobile phone, robot, home appliance, etc.). Next, an example of processing by the data processing system 10 according to the first embodiment will be described.

[0028] (Example of form 1) The AI ​​agent system according to an embodiment of the present invention is a system that constantly monitors the state of a network, immediately issues an alert when an anomaly is detected, and automates part of the initial response. This AI agent system aims to integrate and monitor various data sources such as video data, log data, and network traffic data in real time. For example, the AI ​​agent system collects various data sources such as video data, log data, and network traffic data in order to constantly monitor the state of the network. This data includes packet-level data from network interfaces, logs from servers, routers, switches, etc., and video feeds from surveillance cameras and sensors. The collected data is labeled (normal, abnormal) as necessary for anomaly detection, and preprocessing such as noise removal, normalization, and data formatting is performed. Next, the AI ​​agent system selects an algorithm suitable for anomaly detection and constructs an AI model. For example, for time-series data, time-series analysis models (e.g., LSTM, GRU), machine learning models (e.g., random forest, support vector machine), and deep learning models specialized for anomaly detection (e.g., autoencoder, GAN) can be considered. Using the selected algorithm, the dataset is split into training and validation sets, and training is performed while optimizing hyperparameters such as model structure, learning rate, and batch size. After training, the model's performance is evaluated using validation data, and the model is adjusted as needed. The constructed AI model is configured to process data in real time and detect anomalies. When an anomaly is detected, an alert is issued immediately, and some initial responses are automated. For example, simple troubleshooting can be performed automatically. Furthermore, the AI ​​agent system continuously monitors the model's performance, and if performance degrades, the model is adjusted or retrained. The model is periodically retrained using new data to maintain and improve accuracy. In addition, the model is improved based on feedback from network engineers, and if new anomaly patterns are discovered, the model is retrained using that data.In this way, the AI ​​agent system constantly monitors the network status, immediately issues alerts when an anomaly is detected, and automates some of the initial response, enabling stable network operation, reduced downtime, and rapid fault response.

[0029] The AI ​​agent system according to this embodiment comprises a data collection unit, an analysis unit, an alert unit, and an automation unit. The data collection unit collects various data sources, such as video data, log data, and network traffic data, to continuously monitor the network status. The data collection unit collects, for example, packet-level data from network interfaces. The data collection unit can also collect logs from servers, routers, switches, etc. The data collection unit can also collect video feeds from surveillance cameras and sensors, for example. The analysis unit analyzes the data collected by the data collection unit and detects anomalies. The analysis unit detects anomalies using, for example, a time-series analysis model. The analysis unit can also detect anomalies using, for example, a machine learning model. The analysis unit can also detect anomalies using, for example, a deep learning model specialized for anomaly detection. The alert unit issues an alert immediately when an anomaly is detected by the analysis unit. The alert unit issues an alert using, for example, email. The alert unit can also issue an alert using, for example, SMS. The alert unit can also issue an alert using, for example, push notifications. The automation unit performs partial automation of initial response based on alerts issued by the alert unit. For example, the automation unit can automatically perform simple troubleshooting. The automation unit can also automatically restart network devices. For example, the automation unit can automatically restart specific services. As a result, the AI ​​agent system according to the embodiment can constantly monitor the network status, immediately issue an alert when an anomaly is detected, and perform partial automation of initial response.

[0030] The data collection unit collects diverse data sources, including video data, log data, and network traffic data, to continuously monitor the network status. Specifically, it collects packet-level data from network interfaces, enabling a detailed understanding of network traffic conditions and abnormal packet flows. Furthermore, by collecting logs from servers, routers, switches, etc., it can monitor the operational status and error logs of each device, allowing for early detection of signs of anomalies. It can also collect video feeds from surveillance cameras and sensors, enabling real-time monitoring of physical security conditions and environmental changes. The data collection unit centrally manages the information obtained from these diverse data sources and collects and updates data in real time, ensuring that the network status is always up-to-date. In addition, the data collection unit can flexibly configure the data collection frequency and method, achieving optimal data collection according to specific situations and conditions. For example, if network traffic suddenly increases, the collection frequency can be increased to collect detailed data and quickly identify the cause of the anomaly. Moreover, by utilizing cloud-based data storage, the data collection unit can efficiently store and manage large amounts of data and utilize the data in cooperation with the analysis unit and other systems. This allows the data collection unit to comprehensively monitor the network status and play a crucial role in supporting early detection and rapid response to anomalies.

[0031] The analysis unit analyzes the data collected by the collection unit and detects anomalies. Specifically, it uses a time-series analysis model to analyze fluctuations in network traffic and detect abnormal movements that deviate from normal patterns. For example, it can detect sudden increases or decreases in traffic during specific time periods and determine if this is a sign of a network anomaly. It can also use machine learning models to compare the current data with normal operating patterns learned from past data to identify anomalies. This makes it possible to handle unknown anomaly patterns. Furthermore, using deep learning models specialized for anomaly detection enables more advanced anomaly detection. Deep learning models learn complex patterns based on large amounts of data and can detect anomalies with high accuracy. For example, they can detect subtle fluctuations in network traffic and minute anomalies in log data. By using a combination of these models, the analysis unit can improve the accuracy and reliability of anomaly detection. In addition, the analysis unit updates the anomaly detection results in real time, allowing it to always understand the network status with the latest information. This enables immediate response when an anomaly occurs. Furthermore, the analysis unit can accumulate past anomaly data and analyze the trends and patterns of anomalies, which can be used to predict future anomalies and formulate preventive measures. This allows the analysis unit to play a crucial role in improving network stability and reliability.

[0032] The alert unit immediately issues an alert when an anomaly is detected by the analysis unit. Specifically, it can issue alerts via email to quickly notify relevant parties of the occurrence of an anomaly. For example, it can send alert emails to network administrators and system engineers containing detailed information about the anomaly and recommended countermeasures. It can also issue alerts via SMS, ensuring that notifications are reliably sent even in emergencies where a rapid response is required. Furthermore, it is possible to issue alerts using push notifications, sending real-time notifications to mobile devices such as smartphones and tablets. This allows relevant parties to always receive the latest information and respond quickly. The alert unit can flexibly configure the content and sending method of alerts, and can select the optimal notification method according to the type and severity of the anomaly. For example, if a serious anomaly is detected, multiple notification methods can be used in combination to reliably transmit the information. In addition, the alert unit manages the alert history and can understand the trends in anomaly occurrence and response history by referring to past alert information. In this way, the alert unit can support early detection and rapid response to anomalies, playing an important role in improving network stability and reliability.

[0033] The automation unit automates initial responses based on alerts issued by the alert unit. Specifically, it automates simple troubleshooting to quickly resolve network anomalies. For example, if a specific error message is detected, it automatically resolves the problem according to a pre-configured response procedure. It can also automatically restart network devices, quickly resolving temporary anomalies and malfunctions. Furthermore, it can automatically restart specific services, enabling immediate response in the event of service outages or delays. By implementing these automated responses, the automation unit can improve network stability and reliability. The automation unit operates based on pre-configured rules and scripts, enabling it to implement the optimal response according to the type and severity of the anomaly. For example, it automates minor anomalies and prompts manual responses for major anomalies, achieving efficient operation. The automation unit also records the results of its responses, allowing for later review and identification of the effectiveness of the responses and areas for improvement. In this way, the automation unit can streamline network anomaly response and play a crucial role in supporting quick and appropriate responses.

[0034] The data collection unit can collect various data sources, such as video data, log data, and network traffic data. For example, the data collection unit can collect video data from surveillance cameras. For example, the data collection unit can also collect log data from servers and routers. For example, the data collection unit can also collect network traffic data from network interfaces. By collecting various data sources, the network status can be monitored more accurately. Some or all of the above-described processing in the data collection unit may be performed using AI, for example, or without AI. For example, the data collection unit can input video data into a generating AI and have the generating AI perform analysis of the video data.

[0035] The analysis unit can analyze the collected data and detect anomalies. For example, the analysis unit can analyze the collected data using a time-series analysis model. The analysis unit can also analyze the collected data using a machine learning model. The analysis unit can also analyze the collected data using a deep learning model specialized for anomaly detection. This allows for the detection of anomalies by analyzing the collected data. Some or all of the above-described processes in the analysis unit may be performed using AI, for example, or without AI. For example, the analysis unit can input the collected data into a generating AI and have the generating AI perform anomaly detection.

[0036] The alert unit can immediately issue an alert when an anomaly is detected. For example, the alert unit can issue an alert via email when an anomaly is detected. The alert unit can also issue an alert via SMS when an anomaly is detected. The alert unit can also issue an alert via push notification when an anomaly is detected. This enables a rapid response by issuing an alert immediately when an anomaly is detected. Some or all of the above processing in the alert unit may be performed using AI, for example, or without AI. For example, the alert unit can cause a generating AI to issue an alert when an anomaly is detected.

[0037] The automation unit can automate part of the initial response. For example, the automation unit can automatically perform simple troubleshooting. For example, the automation unit can automatically restart network devices. For example, the automation unit can automatically restart specific services. By partially automating the initial response, rapid troubleshooting becomes possible. Some or all of the above processes in the automation unit may be performed using AI, for example, or without AI. For example, the automation unit can have a generating AI perform simple troubleshooting.

[0038] The automation unit can perform simple troubleshooting automatically. For example, the automation unit can automatically restart network devices. The automation unit can also automatically restart specific services. For example, the automation unit can automatically reset network settings. This enables rapid problem resolution by automating simple troubleshooting. Some or all of the above processes in the automation unit may be performed using AI, for example, or without AI. For example, the automation unit can have a generating AI perform the restart of network devices.

[0039] The analysis unit can detect anomalies using time series analysis models, machine learning models, and deep learning models specialized for anomaly detection. For example, the analysis unit can detect anomalies using a time series analysis model. The analysis unit can also detect anomalies using a machine learning model. The analysis unit can also detect anomalies using a deep learning model specialized for anomaly detection. This improves the accuracy of anomaly detection by using different analysis models. Some or all of the above-described processes in the analysis unit may be performed using, for example, generative AI, or without generative AI. For example, the analysis unit can have a generative AI execute a time series analysis model.

[0040] The data collection unit can collect packet-level data from network interfaces, logs from servers, routers, switches, etc., and video feeds from surveillance cameras and sensors. For example, the data collection unit can collect packet-level data from network interfaces. The data collection unit can also collect logs from servers, routers, switches, etc. The data collection unit can also collect video feeds from surveillance cameras and sensors, etc. This allows for more accurate monitoring of the network status by collecting diverse data sources. Some or all of the processing described above in the data collection unit may be performed using, for example, a generative AI, or not using a generative AI. For example, the data collection unit can input packet-level data from network interfaces into a generative AI and have the generative AI perform data analysis.

[0041] The data collection unit can dynamically change the frequency of data collection according to the network load. For example, if the network load is high, the data collection unit can reduce the frequency of data collection to maintain network stability. For example, if the network load is low, the data collection unit can increase the frequency of data collection to collect more detailed data. For example, if the network load fluctuates, the data collection unit can monitor the load status in real time and collect data at an appropriate frequency. This allows the network to maintain stability by changing the frequency of data collection according to the network load. Some or all of the above processing in the data collection unit may be performed using, for example, a generative AI, or without a generative AI. For example, the data collection unit can input the network load status to a generative AI and have the generative AI adjust the frequency of data collection.

[0042] The data collection unit can automatically select the type of data to collect according to the network status. For example, if the network status is normal, the data collection unit will collect only basic data. If the network status is abnormal, the data collection unit can also collect detailed log data and traffic data. If the network status is unstable, the data collection unit can also collect additional video data and sensor data. This enables efficient data collection by selecting the type of data to collect according to the network status. Some or all of the above processing in the data collection unit may be performed using, for example, a generative AI, or without a generative AI. For example, the data collection unit can input the network status to a generative AI and have the generative AI select the type of data to collect.

[0043] The data collection unit can prioritize the collection of highly relevant data by considering the geographical distribution of the network during data collection. For example, the data collection unit can prioritize the collection of data from a specific region based on the geographical distribution of the network. The data collection unit can also prioritize the collection of data from important locations based on the geographical distribution of the network. The data collection unit can also prioritize the collection of data from areas prone to anomalies based on the geographical distribution of the network. In this way, by collecting data while considering the geographical distribution of the network, important data can be prioritized. Some or all of the above processing in the data collection unit may be performed using, for example, a generative AI, or without a generative AI. For example, the data collection unit can input the geographical distribution of the network into a generative AI and have the generative AI select highly relevant data.

[0044] The data collection unit can optimize the range of data to be collected by considering network topology information during data collection. For example, the data collection unit can prioritize the collection of data from important nodes based on network topology information. The data collection unit can also prioritize the collection of data from nodes prone to anomalies based on network topology information. The data collection unit can also optimize the range of data collection based on network topology information to efficiently collect data. This enables efficient data collection by optimizing the range of data collection by considering network topology information. Some or all of the above processing in the data collection unit may be performed using, for example, a generative AI, or without a generative AI. For example, the data collection unit can input network topology information into a generative AI and have the generative AI optimize the range of data to be collected.

[0045] The analysis unit can optimize its analysis algorithm by referring to past anomalous data during analysis. For example, the analysis unit can select an algorithm that improves the accuracy of anomaly detection based on past anomalous data. The analysis unit can also adjust the anomaly detection threshold based on past anomalous data. For example, the analysis unit can learn anomaly detection patterns based on past anomalous data and optimize the analysis algorithm. This improves the accuracy of the analysis algorithm by referring to past anomalous data. Some or all of the above processes in the analysis unit may be performed using, for example, a generative AI, or without using a generative AI. For example, the analysis unit can input past anomalous data into a generative AI and have the generative AI perform the optimization of the analysis algorithm.

[0046] The analysis unit can apply different analysis methods depending on the network traffic pattern during analysis. For example, the analysis unit can select an appropriate analysis method based on the network traffic pattern. The analysis unit can also apply an analysis method that improves the accuracy of anomaly detection based on the network traffic pattern. The analysis unit can also adjust the anomaly detection threshold based on the network traffic pattern. This improves the accuracy of anomaly detection by applying an analysis method according to the network traffic pattern. Some or all of the above processing in the analysis unit may be performed using a generative AI, for example, or without a generative AI. For example, the analysis unit can input the network traffic pattern into a generative AI and have the generative AI select an appropriate analysis method.

[0047] The analysis unit can display analysis results while considering the geographical distribution of the network. For example, the analysis unit can prioritize displaying analysis results for a specific region based on the geographical distribution of the network. The analysis unit can also prioritize displaying analysis results for important locations based on the geographical distribution of the network. The analysis unit can also prioritize displaying analysis results for areas where anomalies are likely to occur based on the geographical distribution of the network. In this way, by displaying analysis results while considering the geographical distribution of the network, information for important regions can be prioritized. Some or all of the above processing in the analysis unit may be performed using, for example, a generation AI, or without a generation AI. For example, the analysis unit can input the geographical distribution of the network into a generation AI and have the generation AI perform the display of analysis results.

[0048] The analysis unit can improve the accuracy of its analysis by referring to network topology information during the analysis. For example, the analysis unit can improve the accuracy of analyzing important nodes based on network topology information. The analysis unit can also improve the accuracy of analyzing nodes prone to anomalies based on network topology information. The analysis unit can also optimize the scope of the analysis and perform the analysis efficiently based on network topology information. This improves the accuracy of the analysis by referring to network topology information. Some or all of the above-described processes in the analysis unit may be performed using, for example, a generative AI, or without a generative AI. For example, the analysis unit can input network topology information into a generative AI and have the generative AI perform the task of improving the accuracy of the analysis.

[0049] The alert unit can evaluate the importance of an alert when an alert occurs by referring to past alert history. For example, the alert unit can evaluate the importance of an alert based on past alert history. The alert unit can also determine the priority of an alert based on past alert history. For example, the alert unit can adjust the notification method for an alert based on past alert history. This allows the importance of an alert to be evaluated by referring to past alert history. Some or all of the above processing in the alert unit may be performed using, for example, a generation AI, or without a generation AI. For example, the alert unit can input past alert history into a generation AI and have the generation AI perform an evaluation of the importance of the alert.

[0050] The alert unit can customize the content of alerts according to network traffic conditions when an alert occurs. For example, the alert unit can customize the content of alerts based on network traffic conditions. The alert unit can also determine the priority of alerts based on network traffic conditions. The alert unit can also adjust the notification method of alerts based on network traffic conditions. This allows for appropriate alert notifications by customizing the content of alerts according to network traffic conditions. Some or all of the above processing in the alert unit may be performed using, for example, a generation AI, or without a generation AI. For example, the alert unit can input network traffic conditions into a generation AI and have the generation AI customize the content of the alerts.

[0051] The alert unit can select recipients for alert notifications when an alert occurs, taking into account the geographical distribution of the network. For example, the alert unit can prioritize notifications for alerts in specific regions based on the geographical distribution of the network. The alert unit can also prioritize notifications for alerts in important locations based on the geographical distribution of the network. The alert unit can also prioritize notifications for alerts in areas prone to anomalies based on the geographical distribution of the network. In this way, by selecting recipients for alert notifications while considering the geographical distribution of the network, alerts in important regions can be prioritized. Some or all of the above processing in the alert unit may be performed using, for example, a generation AI, or without a generation AI. For example, the alert unit can input the geographical distribution of the network into a generation AI and have the generation AI perform the selection of alert notification recipients.

[0052] The alert unit can optimize the content of an alert by referring to network topology information when an alert occurs. For example, the alert unit can optimize the content of alerts for critical nodes based on network topology information. The alert unit can also optimize the content of alerts for nodes prone to anomalies based on network topology information. The alert unit can also optimize the scope of alert notifications and send notifications efficiently based on network topology information. This allows for the optimization of alert content by referring to network topology information. Some or all of the above processing in the alert unit may be performed using, for example, a generation AI, or without a generation AI. For example, the alert unit can input network topology information into a generation AI and have the generation AI perform the optimization of the alert content.

[0053] The automation unit can select the optimal automation procedure by referring to past troubleshooting history during automation. For example, the automation unit selects the optimal automation procedure based on past troubleshooting history. The automation unit can also determine troubleshooting priorities based on past troubleshooting history. The automation unit can also adjust the content of the automation procedure based on past troubleshooting history. This allows the system to select the optimal automation procedure by referring to past troubleshooting history. Some or all of the above processes in the automation unit may be performed using, for example, a generating AI, or without using a generating AI. For example, the automation unit can input past troubleshooting history into a generating AI and have the generating AI select the optimal automation procedure.

[0054] The automation unit can dynamically change the scope of automation in accordance with network traffic conditions during automation. For example, the automation unit dynamically changes the scope of automation based on network traffic conditions. The automation unit can also determine the priority of automation based on network traffic conditions. The automation unit can also adjust the content of automation procedures based on network traffic conditions. This enables efficient automation by dynamically changing the scope of automation in accordance with network traffic conditions. Some or all of the above-described processes in the automation unit may be performed using, for example, a generative AI, or without a generative AI. For example, the automation unit can input network traffic conditions into a generative AI and cause the generative AI to dynamically change the scope of automation.

[0055] The automation unit can optimize the automation procedure by considering the geographical distribution of the network during automation. For example, the automation unit can prioritize the execution of automation procedures for a specific region based on the geographical distribution of the network. The automation unit can also prioritize the execution of automation procedures for important locations based on the geographical distribution of the network. The automation unit can also prioritize the execution of automation procedures for areas prone to anomalies based on the geographical distribution of the network. In this way, by optimizing the automation procedure by considering the geographical distribution of the network, automation procedures for important areas can be prioritized. Some or all of the above processing in the automation unit may be performed using, for example, a generative AI, or without a generative AI. For example, the automation unit can input the geographical distribution of the network into a generative AI and have the generative AI perform the optimization of the automation procedure.

[0056] The automation unit can improve the accuracy of automation by referring to network topology information during automation. For example, the automation unit can improve the automation accuracy of critical nodes based on network topology information. The automation unit can also improve the automation accuracy of nodes prone to anomalies based on network topology information. The automation unit can also optimize the scope of automation and perform automation efficiently based on network topology information. This improves the accuracy of automation by referring to network topology information. Some or all of the above processing in the automation unit may be performed using, for example, a generative AI, or without a generative AI. For example, the automation unit can input network topology information into a generative AI and have the generative AI perform the improvement of automation accuracy.

[0057] The system according to the embodiment is not limited to the example described above, and various modifications are possible, for example, as follows.

[0058] The data collection unit can dynamically change the priority of data collection according to the network status. For example, if the network status is stable, it can perform normal data collection. If the network status is unstable, it can prioritize the collection of important data. If the network status is abnormal, it can collect detailed data and quickly provide it to the analysis unit. This enables efficient data collection according to the network status. Some or all of the above processing in the data collection unit may be performed using a generative AI, or it may be performed without a generative AI. For example, the data collection unit can input the network status to the generative AI and have the generative AI execute a change in the data collection priority.

[0059] The automation unit can select the optimal automation procedure by referring to past troubleshooting history. For example, it can select the optimal automation procedure based on past troubleshooting history. It can also determine troubleshooting priorities based on past troubleshooting history. It can also adjust the content of the automation procedure based on past troubleshooting history. In this way, the optimal automation procedure can be selected by referring to past troubleshooting history. Some or all of the above processes in the automation unit may be performed using a generation AI, or they may be performed without a generation AI. For example, the automation unit can input past troubleshooting history into a generation AI and have the generation AI perform the selection of the optimal automation procedure.

[0060] The analysis unit can apply different analysis methods depending on the network traffic pattern. For example, it can select an appropriate analysis method based on the network traffic pattern. It can also apply an analysis method that improves the accuracy of anomaly detection based on the network traffic pattern. It can also adjust the anomaly detection threshold based on the network traffic pattern. As a result, the accuracy of anomaly detection is improved by applying an analysis method according to the network traffic pattern. Some or all of the above processing in the analysis unit may be performed using a generation AI, or it may be performed without a generation AI. For example, the analysis unit can input the network traffic pattern into a generation AI and have the generation AI select an appropriate analysis method.

[0061] The analysis unit can optimize its analysis algorithm by referring to past anomaly data. For example, it can select an algorithm that improves the accuracy of anomaly detection based on past anomaly data. It can also adjust the anomaly detection threshold based on past anomaly data. It can also learn anomaly detection patterns based on past anomaly data and optimize the analysis algorithm. In this way, the accuracy of the analysis algorithm is improved by referring to past anomaly data. Some or all of the above processes in the analysis unit may be performed using a generative AI, or they may be performed without a generative AI. For example, the analysis unit can input past anomaly data into a generative AI and have the generative AI perform the optimization of the analysis algorithm.

[0062] The automation unit can dynamically change the scope of automation according to network traffic conditions. For example, it can dynamically change the scope of automation based on network traffic conditions. It can also determine the priority of automation based on network traffic conditions. It can also adjust the content of automation procedures based on network traffic conditions. This enables efficient automation by dynamically changing the scope of automation according to network traffic conditions. Some or all of the above processes in the automation unit may be performed using a generative AI, or they may be performed without a generative AI. For example, the automation unit can input network traffic conditions into a generative AI and cause the generative AI to dynamically change the scope of automation.

[0063] The following briefly describes the processing flow for example form 1.

[0064] Step 1: The collection unit collects various data sources, such as video data, log data, and network traffic data, to continuously monitor the network status. For example, it collects packet-level data from network interfaces, logs from servers, routers, switches, etc., and video feeds from surveillance cameras and sensors. Step 2: The analysis unit analyzes the data collected by the collection unit and detects anomalies. For example, it detects anomalies using time series analysis models, machine learning models, or deep learning models specialized for anomaly detection. Step 3: The alert unit immediately issues an alert when an anomaly is detected by the analysis unit. For example, the alert is sent via email, SMS, or push notification. Step 4: The automation unit performs some automated initial response based on alerts issued by the alert unit. For example, it automatically performs simple troubleshooting, restarts network devices, and restarts specific services.

[0065] (Example of form 2) The AI ​​agent system according to an embodiment of the present invention is a system that constantly monitors the state of a network, immediately issues an alert when an anomaly is detected, and automates part of the initial response. This AI agent system aims to integrate and monitor various data sources such as video data, log data, and network traffic data in real time. For example, the AI ​​agent system collects various data sources such as video data, log data, and network traffic data in order to constantly monitor the state of the network. This data includes packet-level data from network interfaces, logs from servers, routers, switches, etc., and video feeds from surveillance cameras and sensors. The collected data is labeled (normal, abnormal) as necessary for anomaly detection, and preprocessing such as noise removal, normalization, and data formatting is performed. Next, the AI ​​agent system selects an algorithm suitable for anomaly detection and constructs an AI model. For example, for time-series data, time-series analysis models (e.g., LSTM, GRU), machine learning models (e.g., random forest, support vector machine), and deep learning models specialized for anomaly detection (e.g., autoencoder, GAN) can be considered. Using the selected algorithm, the dataset is split into training and validation sets, and training is performed while optimizing hyperparameters such as model structure, learning rate, and batch size. After training, the model's performance is evaluated using validation data, and the model is adjusted as needed. The constructed AI model is configured to process data in real time and detect anomalies. When an anomaly is detected, an alert is issued immediately, and some initial responses are automated. For example, simple troubleshooting can be performed automatically. Furthermore, the AI ​​agent system continuously monitors the model's performance, and if performance degrades, the model is adjusted or retrained. The model is periodically retrained using new data to maintain and improve accuracy. In addition, the model is improved based on feedback from network engineers, and if new anomaly patterns are discovered, the model is retrained using that data.In this way, the AI ​​agent system constantly monitors the network status, immediately issues alerts when an anomaly is detected, and automates some of the initial response, enabling stable network operation, reduced downtime, and rapid fault response.

[0066] The AI ​​agent system according to this embodiment comprises a data collection unit, an analysis unit, an alert unit, and an automation unit. The data collection unit collects various data sources, such as video data, log data, and network traffic data, to continuously monitor the network status. The data collection unit collects, for example, packet-level data from network interfaces. The data collection unit can also collect logs from servers, routers, switches, etc. The data collection unit can also collect video feeds from surveillance cameras and sensors, for example. The analysis unit analyzes the data collected by the data collection unit and detects anomalies. The analysis unit detects anomalies using, for example, a time-series analysis model. The analysis unit can also detect anomalies using, for example, a machine learning model. The analysis unit can also detect anomalies using, for example, a deep learning model specialized for anomaly detection. The alert unit issues an alert immediately when an anomaly is detected by the analysis unit. The alert unit issues an alert using, for example, email. The alert unit can also issue an alert using, for example, SMS. The alert unit can also issue an alert using, for example, push notifications. The automation unit performs partial automation of initial response based on alerts issued by the alert unit. For example, the automation unit can automatically perform simple troubleshooting. The automation unit can also automatically restart network devices. For example, the automation unit can automatically restart specific services. As a result, the AI ​​agent system according to the embodiment can constantly monitor the network status, immediately issue an alert when an anomaly is detected, and perform partial automation of initial response.

[0067] The data collection unit collects diverse data sources, including video data, log data, and network traffic data, to continuously monitor the network status. Specifically, it collects packet-level data from network interfaces, enabling a detailed understanding of network traffic conditions and abnormal packet flows. Furthermore, by collecting logs from servers, routers, switches, etc., it can monitor the operational status and error logs of each device, allowing for early detection of signs of anomalies. It can also collect video feeds from surveillance cameras and sensors, enabling real-time monitoring of physical security conditions and environmental changes. The data collection unit centrally manages the information obtained from these diverse data sources and collects and updates data in real time, ensuring that the network status is always up-to-date. In addition, the data collection unit can flexibly configure the data collection frequency and method, achieving optimal data collection according to specific situations and conditions. For example, if network traffic suddenly increases, the collection frequency can be increased to collect detailed data and quickly identify the cause of the anomaly. Moreover, by utilizing cloud-based data storage, the data collection unit can efficiently store and manage large amounts of data and utilize the data in cooperation with the analysis unit and other systems. This allows the data collection unit to comprehensively monitor the network status and play a crucial role in supporting early detection and rapid response to anomalies.

[0068] The analysis unit analyzes the data collected by the collection unit and detects anomalies. Specifically, it uses a time-series analysis model to analyze fluctuations in network traffic and detect abnormal movements that deviate from normal patterns. For example, it can detect sudden increases or decreases in traffic during specific time periods and determine if this is a sign of a network anomaly. It can also use machine learning models to compare the current data with normal operating patterns learned from past data to identify anomalies. This makes it possible to handle unknown anomaly patterns. Furthermore, using deep learning models specialized for anomaly detection enables more advanced anomaly detection. Deep learning models learn complex patterns based on large amounts of data and can detect anomalies with high accuracy. For example, they can detect subtle fluctuations in network traffic and minute anomalies in log data. By using a combination of these models, the analysis unit can improve the accuracy and reliability of anomaly detection. In addition, the analysis unit updates the anomaly detection results in real time, allowing it to always understand the network status with the latest information. This enables immediate response when an anomaly occurs. Furthermore, the analysis unit can accumulate past anomaly data and analyze the trends and patterns of anomalies, which can be used to predict future anomalies and formulate preventive measures. This allows the analysis unit to play a crucial role in improving network stability and reliability.

[0069] The alert unit immediately issues an alert when an anomaly is detected by the analysis unit. Specifically, it can issue alerts via email to quickly notify relevant parties of the occurrence of an anomaly. For example, it can send alert emails to network administrators and system engineers containing detailed information about the anomaly and recommended countermeasures. It can also issue alerts via SMS, ensuring that notifications are reliably sent even in emergencies where a rapid response is required. Furthermore, it is possible to issue alerts using push notifications, sending real-time notifications to mobile devices such as smartphones and tablets. This allows relevant parties to always receive the latest information and respond quickly. The alert unit can flexibly configure the content and sending method of alerts, and can select the optimal notification method according to the type and severity of the anomaly. For example, if a serious anomaly is detected, multiple notification methods can be used in combination to reliably transmit the information. In addition, the alert unit manages the alert history and can understand the trends in anomaly occurrence and response history by referring to past alert information. In this way, the alert unit can support early detection and rapid response to anomalies, playing an important role in improving network stability and reliability.

[0070] The automation unit automates initial responses based on alerts issued by the alert unit. Specifically, it automates simple troubleshooting to quickly resolve network anomalies. For example, if a specific error message is detected, it automatically resolves the problem according to a pre-configured response procedure. It can also automatically restart network devices, quickly resolving temporary anomalies and malfunctions. Furthermore, it can automatically restart specific services, enabling immediate response in the event of service outages or delays. By implementing these automated responses, the automation unit can improve network stability and reliability. The automation unit operates based on pre-configured rules and scripts, enabling it to implement the optimal response according to the type and severity of the anomaly. For example, it automates minor anomalies and prompts manual responses for major anomalies, achieving efficient operation. The automation unit also records the results of its responses, allowing for later review and identification of the effectiveness of the responses and areas for improvement. In this way, the automation unit can streamline network anomaly response and play a crucial role in supporting quick and appropriate responses.

[0071] The data collection unit can collect various data sources, such as video data, log data, and network traffic data. For example, the data collection unit can collect video data from surveillance cameras. For example, the data collection unit can also collect log data from servers and routers. For example, the data collection unit can also collect network traffic data from network interfaces. By collecting various data sources, the network status can be monitored more accurately. Some or all of the above-described processing in the data collection unit may be performed using AI, for example, or without AI. For example, the data collection unit can input video data into a generating AI and have the generating AI perform analysis of the video data.

[0072] The analysis unit can analyze the collected data and detect anomalies. For example, the analysis unit can analyze the collected data using a time-series analysis model. The analysis unit can also analyze the collected data using a machine learning model. The analysis unit can also analyze the collected data using a deep learning model specialized for anomaly detection. This allows for the detection of anomalies by analyzing the collected data. Some or all of the above-described processes in the analysis unit may be performed using AI, for example, or without AI. For example, the analysis unit can input the collected data into a generating AI and have the generating AI perform anomaly detection.

[0073] The alert unit can immediately issue an alert when an anomaly is detected. For example, the alert unit can issue an alert via email when an anomaly is detected. The alert unit can also issue an alert via SMS when an anomaly is detected. The alert unit can also issue an alert via push notification when an anomaly is detected. This enables a rapid response by issuing an alert immediately when an anomaly is detected. Some or all of the above processing in the alert unit may be performed using AI, for example, or without AI. For example, the alert unit can cause a generating AI to issue an alert when an anomaly is detected.

[0074] The automation unit can automate part of the initial response. For example, the automation unit can automatically perform simple troubleshooting. For example, the automation unit can automatically restart network devices. For example, the automation unit can automatically restart specific services. By partially automating the initial response, rapid troubleshooting becomes possible. Some or all of the above processes in the automation unit may be performed using AI, for example, or without AI. For example, the automation unit can have a generating AI perform simple troubleshooting.

[0075] The automation unit can perform simple troubleshooting automatically. For example, the automation unit can automatically restart network devices. The automation unit can also automatically restart specific services. For example, the automation unit can automatically reset network settings. This enables rapid problem resolution by automating simple troubleshooting. Some or all of the above processes in the automation unit may be performed using AI, for example, or without AI. For example, the automation unit can have a generating AI perform the restart of network devices.

[0076] The analysis unit can detect anomalies using time series analysis models, machine learning models, and deep learning models specialized for anomaly detection. For example, the analysis unit can detect anomalies using a time series analysis model. The analysis unit can also detect anomalies using a machine learning model. The analysis unit can also detect anomalies using a deep learning model specialized for anomaly detection. This improves the accuracy of anomaly detection by using different analysis models. Some or all of the above-described processes in the analysis unit may be performed using, for example, generative AI, or without generative AI. For example, the analysis unit can have a generative AI execute a time series analysis model.

[0077] The data collection unit can collect packet-level data from network interfaces, logs from servers, routers, switches, etc., and video feeds from surveillance cameras and sensors. For example, the data collection unit can collect packet-level data from network interfaces. The data collection unit can also collect logs from servers, routers, switches, etc. The data collection unit can also collect video feeds from surveillance cameras and sensors, etc. This allows for more accurate monitoring of the network status by collecting diverse data sources. Some or all of the processing described above in the data collection unit may be performed using, for example, a generative AI, or not using a generative AI. For example, the data collection unit can input packet-level data from network interfaces into a generative AI and have the generative AI perform data analysis.

[0078] The data collection unit can estimate the user's emotions and adjust the timing of data collection based on the estimated emotions. For example, if the user is stressed, the data collection unit can reduce the frequency of data collection to alleviate the system load. For example, if the user is relaxed, the data collection unit can increase the frequency of data collection to collect more detailed data. For example, if the user is in a hurry, the data collection unit can prioritize collecting only important data and process it quickly. This reduces the system load by adjusting the timing of data collection according to the user's emotions. Emotion estimation is achieved using an emotion estimation function, such as an emotion engine or generative AI. Generative AI may be, but is not limited to, text generation AI (e.g., LLM) or multimodal generation AI. Some or all of the above processing in the data collection unit may be performed using AI or not. For example, the data collection unit can input user emotion data into a generative AI and have the generative AI perform emotion estimation.

[0079] The data collection unit can dynamically change the frequency of data collection according to the network load. For example, if the network load is high, the data collection unit can reduce the frequency of data collection to maintain network stability. For example, if the network load is low, the data collection unit can increase the frequency of data collection to collect more detailed data. For example, if the network load fluctuates, the data collection unit can monitor the load status in real time and collect data at an appropriate frequency. This allows the network to maintain stability by changing the frequency of data collection according to the network load. Some or all of the above processing in the data collection unit may be performed using, for example, a generative AI, or without a generative AI. For example, the data collection unit can input the network load status to a generative AI and have the generative AI adjust the frequency of data collection.

[0080] The data collection unit can automatically select the type of data to collect according to the network status. For example, if the network status is normal, the data collection unit will collect only basic data. If the network status is abnormal, the data collection unit can also collect detailed log data and traffic data. If the network status is unstable, the data collection unit can also collect additional video data and sensor data. This enables efficient data collection by selecting the type of data to collect according to the network status. Some or all of the above processing in the data collection unit may be performed using, for example, a generative AI, or without a generative AI. For example, the data collection unit can input the network status to a generative AI and have the generative AI select the type of data to collect.

[0081] The data collection unit can estimate the user's emotions and determine the priority of data to collect based on the estimated emotions. For example, if the user is stressed, the data collection unit may prioritize collecting only important data. If the user is relaxed, the data collection unit may prioritize collecting detailed data. If the user is in a hurry, the data collection unit may prioritize collecting data that needs to be processed quickly. This allows for the priority collection of important data by determining the priority of data to collect according to the user's emotions. Emotion estimation is achieved using an emotion estimation function, such as an emotion engine or generative AI. Generative AI may be, but is not limited to, text generation AI (e.g., LLM) or multimodal generation AI. Some or all of the processing described above in the data collection unit may be performed using AI or not. For example, the data collection unit can input user emotion data into a generative AI and have the generative AI perform emotion estimation.

[0082] The data collection unit can prioritize the collection of highly relevant data by considering the geographical distribution of the network during data collection. For example, the data collection unit can prioritize the collection of data from a specific region based on the geographical distribution of the network. The data collection unit can also prioritize the collection of data from important locations based on the geographical distribution of the network. The data collection unit can also prioritize the collection of data from areas prone to anomalies based on the geographical distribution of the network. In this way, by collecting data while considering the geographical distribution of the network, important data can be prioritized. Some or all of the above processing in the data collection unit may be performed using, for example, a generative AI, or without a generative AI. For example, the data collection unit can input the geographical distribution of the network into a generative AI and have the generative AI select highly relevant data.

[0083] The data collection unit can optimize the range of data to be collected by considering network topology information during data collection. For example, the data collection unit can prioritize the collection of data from important nodes based on network topology information. The data collection unit can also prioritize the collection of data from nodes prone to anomalies based on network topology information. The data collection unit can also optimize the range of data collection based on network topology information to efficiently collect data. This enables efficient data collection by optimizing the range of data collection by considering network topology information. Some or all of the above processing in the data collection unit may be performed using, for example, a generative AI, or without a generative AI. For example, the data collection unit can input network topology information into a generative AI and have the generative AI optimize the range of data to be collected.

[0084] The analysis unit can estimate the user's emotions and adjust the display method of the analysis results based on the estimated user emotions. For example, if the user is nervous, the analysis unit can provide a simple and highly visible display method. For example, if the user is relaxed, the analysis unit can also provide a display method that includes detailed information. For example, if the user is in a hurry, the analysis unit can also provide a display method that gets straight to the point. By adjusting the display method of the analysis results according to the user's emotions, a highly visible display becomes possible. Emotion estimation is achieved using an emotion estimation function, for example, using an emotion engine or a generative AI. The generative AI is, but is not limited to, a text generation AI (e.g., LLM) or a multimodal generation AI. Some or all of the above processing in the analysis unit may be performed using AI, for example, or without AI. For example, the analysis unit can input user emotion data into a generative AI and have the generative AI perform emotion estimation.

[0085] The analysis unit can optimize its analysis algorithm by referring to past anomalous data during analysis. For example, the analysis unit can select an algorithm that improves the accuracy of anomaly detection based on past anomalous data. The analysis unit can also adjust the anomaly detection threshold based on past anomalous data. For example, the analysis unit can learn anomaly detection patterns based on past anomalous data and optimize the analysis algorithm. This improves the accuracy of the analysis algorithm by referring to past anomalous data. Some or all of the above processes in the analysis unit may be performed using, for example, a generative AI, or without using a generative AI. For example, the analysis unit can input past anomalous data into a generative AI and have the generative AI perform the optimization of the analysis algorithm.

[0086] The analysis unit can apply different analysis methods depending on the network traffic pattern during analysis. For example, the analysis unit can select an appropriate analysis method based on the network traffic pattern. The analysis unit can also apply an analysis method that improves the accuracy of anomaly detection based on the network traffic pattern. The analysis unit can also adjust the anomaly detection threshold based on the network traffic pattern. This improves the accuracy of anomaly detection by applying an analysis method according to the network traffic pattern. Some or all of the above processing in the analysis unit may be performed using a generative AI, for example, or without a generative AI. For example, the analysis unit can input the network traffic pattern into a generative AI and have the generative AI select an appropriate analysis method.

[0087] The analysis unit can estimate the user's emotions and prioritize the analysis results based on the estimated emotions. For example, if the user is tense, the analysis unit can prioritize displaying important analysis results. For example, if the user is relaxed, the analysis unit can prioritize displaying detailed analysis results. For example, if the user is in a hurry, the analysis unit can prioritize displaying analysis results that require immediate attention. In this way, by prioritizing the analysis results according to the user's emotions, important analysis results can be displayed preferentially. Emotion estimation is achieved using an emotion estimation function, for example, using an emotion engine or generative AI. Generative AI is, but is not limited to, text generation AI (e.g., LLM) or multimodal generation AI. Some or all of the above processing in the analysis unit may be performed using AI, for example, or without AI. For example, the analysis unit can input user emotion data into a generative AI and have the generative AI perform emotion estimation.

[0088] The analysis unit can display analysis results while considering the geographical distribution of the network. For example, the analysis unit can prioritize displaying analysis results for a specific region based on the geographical distribution of the network. The analysis unit can also prioritize displaying analysis results for important locations based on the geographical distribution of the network. The analysis unit can also prioritize displaying analysis results for areas where anomalies are likely to occur based on the geographical distribution of the network. In this way, by displaying analysis results while considering the geographical distribution of the network, information for important regions can be prioritized. Some or all of the above processing in the analysis unit may be performed using, for example, a generation AI, or without a generation AI. For example, the analysis unit can input the geographical distribution of the network into a generation AI and have the generation AI perform the display of analysis results.

[0089] The analysis unit can improve the accuracy of its analysis by referring to network topology information during the analysis. For example, the analysis unit can improve the accuracy of analyzing important nodes based on network topology information. The analysis unit can also improve the accuracy of analyzing nodes prone to anomalies based on network topology information. The analysis unit can also optimize the scope of the analysis and perform the analysis efficiently based on network topology information. This improves the accuracy of the analysis by referring to network topology information. Some or all of the above-described processes in the analysis unit may be performed using, for example, a generative AI, or without a generative AI. For example, the analysis unit can input network topology information into a generative AI and have the generative AI perform the task of improving the accuracy of the analysis.

[0090] The alert unit can estimate the user's emotions and adjust the alert notification method based on the estimated emotions. For example, if the user is stressed, the alert unit can provide a simple and highly visible alert notification method. For example, if the user is relaxed, the alert unit can also provide an alert notification method that includes detailed information. For example, if the user is in a hurry, the alert unit can also provide a concise alert notification method. By adjusting the alert notification method according to the user's emotions, highly visible alert notifications are possible. Emotion estimation is achieved using an emotion estimation function, for example, using an emotion engine or generative AI. Generative AI is, but is not limited to, text generation AI (e.g., LLM) or multimodal generation AI. Some or all of the above processing in the alert unit may be performed using AI, for example, or without AI. For example, the alert unit can input user emotion data into a generative AI and have the generative AI perform emotion estimation.

[0091] The alert unit can evaluate the importance of an alert when an alert occurs by referring to past alert history. For example, the alert unit can evaluate the importance of an alert based on past alert history. The alert unit can also determine the priority of an alert based on past alert history. For example, the alert unit can adjust the notification method for an alert based on past alert history. This allows the importance of an alert to be evaluated by referring to past alert history. Some or all of the above processing in the alert unit may be performed using, for example, a generation AI, or without a generation AI. For example, the alert unit can input past alert history into a generation AI and have the generation AI perform an evaluation of the importance of the alert.

[0092] The alert unit can customize the content of alerts according to network traffic conditions when an alert occurs. For example, the alert unit can customize the content of alerts based on network traffic conditions. The alert unit can also determine the priority of alerts based on network traffic conditions. The alert unit can also adjust the notification method of alerts based on network traffic conditions. This allows for appropriate alert notifications by customizing the content of alerts according to network traffic conditions. Some or all of the above processing in the alert unit may be performed using, for example, a generation AI, or without a generation AI. For example, the alert unit can input network traffic conditions into a generation AI and have the generation AI customize the content of the alerts.

[0093] The alert unit can estimate the user's emotions and prioritize alerts based on the estimated emotions. For example, if the user is stressed, the alert unit will prioritize important alerts. For example, if the user is relaxed, the alert unit may prioritize detailed alerts. For example, if the user is in a hurry, the alert unit may prioritize alerts that require immediate attention. This allows important alerts to be prioritized by determining the priority of alerts according to the user's emotions. Emotion estimation is achieved using an emotion estimation function, for example, using an emotion engine or generative AI. Generative AI is, but is not limited to, text generation AI (e.g., LLM) or multimodal generation AI. Some or all of the above processing in the alert unit may be performed using AI or not using AI. For example, the alert unit can input user emotion data into a generative AI and have the generative AI perform emotion estimation.

[0094] The alert unit can select recipients for alert notifications when an alert occurs, taking into account the geographical distribution of the network. For example, the alert unit can prioritize notifications for alerts in specific regions based on the geographical distribution of the network. The alert unit can also prioritize notifications for alerts in important locations based on the geographical distribution of the network. The alert unit can also prioritize notifications for alerts in areas prone to anomalies based on the geographical distribution of the network. In this way, by selecting recipients for alert notifications while considering the geographical distribution of the network, alerts in important regions can be prioritized. Some or all of the above processing in the alert unit may be performed using, for example, a generation AI, or without a generation AI. For example, the alert unit can input the geographical distribution of the network into a generation AI and have the generation AI perform the selection of alert notification recipients.

[0095] The alert unit can optimize the content of an alert by referring to network topology information when an alert occurs. For example, the alert unit can optimize the content of alerts for critical nodes based on network topology information. The alert unit can also optimize the content of alerts for nodes prone to anomalies based on network topology information. The alert unit can also optimize the scope of alert notifications and send notifications efficiently based on network topology information. This allows for the optimization of alert content by referring to network topology information. Some or all of the above processing in the alert unit may be performed using, for example, a generation AI, or without a generation AI. For example, the alert unit can input network topology information into a generation AI and have the generation AI perform the optimization of the alert content.

[0096] The automation unit can estimate the user's emotions and adjust the automated procedures based on the estimated user emotions. For example, if the user is tense, the automation unit can provide simple and easy-to-understand automated procedures. For example, if the user is relaxed, the automation unit can also provide automated procedures that include detailed information. For example, if the user is in a hurry, the automation unit can also provide automated procedures that require a quick response. This provides easy-to-understand automated procedures by adjusting the automated procedures according to the user's emotions. Emotion estimation is achieved using an emotion estimation function, for example, using an emotion engine or generative AI. Generative AI is, but is not limited to, text generation AI (e.g., LLM) or multimodal generation AI. Some or all of the above processing in the automation unit may be performed using AI, for example, or not using AI. For example, the automation unit can input user emotion data into a generative AI and have the generative AI perform emotion estimation.

[0097] The automation unit can select the optimal automation procedure by referring to past troubleshooting history during automation. For example, the automation unit selects the optimal automation procedure based on past troubleshooting history. The automation unit can also determine troubleshooting priorities based on past troubleshooting history. The automation unit can also adjust the content of the automation procedure based on past troubleshooting history. This allows the system to select the optimal automation procedure by referring to past troubleshooting history. Some or all of the above processes in the automation unit may be performed using, for example, a generating AI, or without using a generating AI. For example, the automation unit can input past troubleshooting history into a generating AI and have the generating AI select the optimal automation procedure.

[0098] The automation unit can dynamically change the scope of automation in accordance with network traffic conditions during automation. For example, the automation unit dynamically changes the scope of automation based on network traffic conditions. The automation unit can also determine the priority of automation based on network traffic conditions. The automation unit can also adjust the content of automation procedures based on network traffic conditions. This enables efficient automation by dynamically changing the scope of automation in accordance with network traffic conditions. Some or all of the above-described processes in the automation unit may be performed using, for example, a generative AI, or without a generative AI. For example, the automation unit can input network traffic conditions into a generative AI and cause the generative AI to dynamically change the scope of automation.

[0099] The automation unit can estimate the user's emotions and determine the priority of automation based on the estimated user emotions. For example, if the user is tense, the automation unit may prioritize executing important automation procedures. For example, if the user is relaxed, the automation unit may also prioritize executing detailed automation procedures. For example, if the user is in a hurry, the automation unit may also prioritize executing automation procedures that require a quick response. This allows for the priority of important automation procedures to be executed by determining the priority of automation according to the user's emotions. Emotion estimation is achieved using an emotion estimation function, for example, using an emotion engine or generative AI. Generative AI is, but is not limited to, text generation AI (e.g., LLM) or multimodal generation AI. Some or all of the above processing in the automation unit may be performed using AI, for example, or without AI. For example, the automation unit can input user emotion data into a generative AI and have the generative AI perform emotion estimation.

[0100] The automation unit can optimize the automation procedure by considering the geographical distribution of the network during automation. For example, the automation unit can prioritize the execution of automation procedures for a specific region based on the geographical distribution of the network. The automation unit can also prioritize the execution of automation procedures for important locations based on the geographical distribution of the network. The automation unit can also prioritize the execution of automation procedures for areas prone to anomalies based on the geographical distribution of the network. In this way, by optimizing the automation procedure by considering the geographical distribution of the network, automation procedures for important areas can be prioritized. Some or all of the above processing in the automation unit may be performed using, for example, a generative AI, or without a generative AI. For example, the automation unit can input the geographical distribution of the network into a generative AI and have the generative AI perform the optimization of the automation procedure.

[0101] The automation unit can improve the accuracy of automation by referring to network topology information during automation. For example, the automation unit can improve the automation accuracy of critical nodes based on network topology information. The automation unit can also improve the automation accuracy of nodes prone to anomalies based on network topology information. The automation unit can also optimize the scope of automation and perform automation efficiently based on network topology information. This improves the accuracy of automation by referring to network topology information. Some or all of the above processing in the automation unit may be performed using, for example, a generative AI, or without a generative AI. For example, the automation unit can input network topology information into a generative AI and have the generative AI perform the improvement of automation accuracy.

[0102] The system according to the embodiment is not limited to the example described above, and various modifications are possible, for example, as follows.

[0103] The analysis unit can estimate the user's emotions and dynamically adjust the anomaly detection threshold based on the estimated emotions. For example, if the user is stressed, the anomaly detection threshold can be set lower to detect anomalies more sensitively. If the user is relaxed, the anomaly detection threshold can be set higher to reduce false positives. If the user is in a hurry, the threshold can be adjusted to detect only important anomalies. This allows for the optimization of anomaly detection accuracy according to the user's emotions. Emotion estimation is achieved using an emotion engine or generative AI. Some or all of the above-described processes in the analysis unit may be performed using AI or not. For example, the analysis unit can input user emotion data into a generative AI and have the generative AI perform emotion estimation.

[0104] The data collection unit can dynamically change the priority of data collection according to the network status. For example, if the network status is stable, it can perform normal data collection. If the network status is unstable, it can prioritize the collection of important data. If the network status is abnormal, it can collect detailed data and quickly provide it to the analysis unit. This enables efficient data collection according to the network status. Some or all of the above processing in the data collection unit may be performed using a generative AI, or it may be performed without a generative AI. For example, the data collection unit can input the network status to the generative AI and have the generative AI execute a change in the data collection priority.

[0105] The alert unit can estimate the user's emotions and customize the content of the alert based on the estimated emotions. For example, if the user is stressed, it can provide an alert containing only concise and important information. If the user is relaxed, it can also provide an alert with detailed information. If the user is in a hurry, it can prioritize providing information that requires immediate attention. This allows the content of the alert to be optimized according to the user's emotions. Emotion estimation is achieved using an emotion engine or generative AI. Some or all of the above processing in the alert unit may be performed using AI or not. For example, the alert unit can input user emotion data into a generative AI and have the generative AI perform emotion estimation.

[0106] The automation unit can select the optimal automation procedure by referring to past troubleshooting history. For example, it can select the optimal automation procedure based on past troubleshooting history. It can also determine troubleshooting priorities based on past troubleshooting history. It can also adjust the content of the automation procedure based on past troubleshooting history. In this way, the optimal automation procedure can be selected by referring to past troubleshooting history. Some or all of the above processes in the automation unit may be performed using a generation AI, or they may be performed without a generation AI. For example, the automation unit can input past troubleshooting history into a generation AI and have the generation AI perform the selection of the optimal automation procedure.

[0107] The analysis unit can apply different analysis methods depending on the network traffic pattern. For example, it can select an appropriate analysis method based on the network traffic pattern. It can also apply an analysis method that improves the accuracy of anomaly detection based on the network traffic pattern. It can also adjust the anomaly detection threshold based on the network traffic pattern. As a result, the accuracy of anomaly detection is improved by applying an analysis method according to the network traffic pattern. Some or all of the above processing in the analysis unit may be performed using a generation AI, or it may be performed without a generation AI. For example, the analysis unit can input the network traffic pattern into a generation AI and have the generation AI select an appropriate analysis method.

[0108] The data collection unit can estimate the user's emotions and adjust the timing of data collection based on the estimated emotions. For example, if the user is stressed, the frequency of data collection can be reduced to lessen the system load. If the user is relaxed, the frequency of data collection can be increased to collect more detailed data. If the user is in a hurry, only important data can be prioritized and processed quickly. This reduces the system load by adjusting the timing of data collection according to the user's emotions. Emotion estimation is achieved using an emotion engine or generative AI. Some or all of the processing described above in the data collection unit may be performed using AI or not. For example, the data collection unit can input user emotion data into a generative AI and have the generative AI perform emotion estimation.

[0109] The analysis unit can optimize its analysis algorithm by referring to past anomaly data. For example, it can select an algorithm that improves the accuracy of anomaly detection based on past anomaly data. It can also adjust the anomaly detection threshold based on past anomaly data. It can also learn anomaly detection patterns based on past anomaly data and optimize the analysis algorithm. In this way, the accuracy of the analysis algorithm is improved by referring to past anomaly data. Some or all of the above processes in the analysis unit may be performed using a generative AI, or they may be performed without a generative AI. For example, the analysis unit can input past anomaly data into a generative AI and have the generative AI perform the optimization of the analysis algorithm.

[0110] The alert unit can estimate the user's emotions and adjust the alert notification method based on the estimated emotions. For example, if the user is stressed, it can provide a simple and highly visible alert notification method. If the user is relaxed, it can also provide an alert notification method that includes detailed information. If the user is in a hurry, it can also provide an alert notification method that gets straight to the point. By adjusting the alert notification method according to the user's emotions, highly visible alert notifications become possible. Emotion estimation is achieved using an emotion engine or generative AI. Some or all of the above processing in the alert unit may be performed using AI or not. For example, the alert unit can input user emotion data into a generative AI and have the generative AI perform emotion estimation.

[0111] The automation unit can dynamically change the scope of automation according to network traffic conditions. For example, it can dynamically change the scope of automation based on network traffic conditions. It can also determine the priority of automation based on network traffic conditions. It can also adjust the content of automation procedures based on network traffic conditions. This enables efficient automation by dynamically changing the scope of automation according to network traffic conditions. Some or all of the above processes in the automation unit may be performed using a generative AI, or they may be performed without a generative AI. For example, the automation unit can input network traffic conditions into a generative AI and cause the generative AI to dynamically change the scope of automation.

[0112] The analysis unit can estimate the user's emotions and prioritize the analysis results based on the estimated emotions. For example, if the user is nervous, important analysis results can be displayed preferentially. If the user is relaxed, detailed analysis results can be displayed preferentially. If the user is in a hurry, analysis results requiring immediate attention can be displayed preferentially. In this way, by prioritizing the analysis results according to the user's emotions, important analysis results can be displayed preferentially. Emotion estimation is achieved using an emotion engine or a generative AI. Some or all of the above-described processes in the analysis unit may be performed using AI or not. For example, the analysis unit can input user emotion data into a generative AI and have the generative AI perform emotion estimation.

[0113] The following briefly describes the processing flow for example form 2.

[0114] Step 1: The collection unit collects various data sources, such as video data, log data, and network traffic data, to continuously monitor the network status. For example, it collects packet-level data from network interfaces, logs from servers, routers, switches, etc., and video feeds from surveillance cameras and sensors. Step 2: The analysis unit analyzes the data collected by the collection unit and detects anomalies. For example, it detects anomalies using time series analysis models, machine learning models, or deep learning models specialized for anomaly detection. Step 3: The alert unit immediately issues an alert when an anomaly is detected by the analysis unit. For example, the alert is sent via email, SMS, or push notification. Step 4: The automation unit performs some automated initial response based on alerts issued by the alert unit. For example, it automatically performs simple troubleshooting, restarts network devices, and restarts specific services.

[0115] The specific processing unit 290 transmits the result of the specific processing to the smart device 14. In the smart device 14, the control unit 46A causes the output device 40 to output the result of the specific processing. The microphone 38B acquires audio indicating user input for the result of the specific processing. The control unit 46A transmits the audio data indicating user input acquired by the microphone 38B to the data processing device 12. In the data processing device 12, the specific processing unit 290 acquires the audio data.

[0116] Data generation model 58 is a form of so-called generative AI (Artificial Intelligence). An example of data generation model 58 is ChatGPT (registered trademark) (Internet search).<URL: https: / / openai.com / blog / chatgpt> Examples of generative AI include text generation AI, image generation AI, and multimodal generation AI. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 is input with prompts containing instructions, and with inference data such as audio data representing speech, text data representing text, and image data representing images (e.g., still image data or video data). The data generation model 58 infers from the input inference data according to the instructions indicated by the prompts, and outputs the inference result in one or more data formats from audio data, text data, and image data. The data generation model 58 includes, for example, text generation AI, image generation AI, and multimodal generation AI. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization. The specific processing unit 290 performs the specific processing described above using the data generation model 58. The data generation model 58 may be a fine-tuned model that outputs inference results from prompts that do not contain instructions, in which case the data generation model 58 can output inference results from prompts that do not contain instructions. In the data processing device 12, etc., there are multiple types of data generation models 58, and the data generation model 58 includes AI other than generative AI. AI other than generative AI includes, for example, linear regression, logistic regression, decision trees, random forests, support vector machines (SVMs), k-means clustering, convolutional neural networks (CNNs), recurrent neural networks (RNNs), generative adversarial networks (GANs), or naive Bayes, and can perform various processes, but is not limited to these examples. Also, the AI ​​may be an AI agent. Furthermore, when the processing of each of the above parts is performed by the AI, the processing may be performed by the AI ​​in part or in whole, but is not limited to this example.Furthermore, processing performed by AI, including generative AI, may be replaced with rule-based processing, and rule-based processing may be replaced with processing performed by AI, including generative AI.

[0117] Furthermore, the processing performed by the data processing system 10 described above is carried out by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the smart device 14, but it may also be carried out by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the smart device 14. In addition, the specific processing unit 290 of the data processing device 12 acquires or collects information necessary for processing from the smart device 14 or an external device, and the smart device 14 acquires or collects information necessary for processing from the data processing device 12 or an external device.

[0118] Each of the multiple elements described above, including the data collection unit, analysis unit, alert unit, and automation unit, is implemented in at least one of the smart device 14 and the data processing unit 12. For example, the data collection unit collects video data and network traffic data using the camera 42 and communication I / F 44 of the smart device 14. The analysis unit is implemented in the specific processing unit 290 of the data processing unit 12, for example, to analyze the collected data and detect anomalies. The alert unit is implemented in the control unit 46A of the smart device 14, for example, to issue an alert via email or push notification when an anomaly is detected. The automation unit is implemented in the specific processing unit 290 of the data processing unit 12, for example, to automate some of the initial response. The correspondence between each unit and the device or control unit is not limited to the example described above, and various changes are possible.

[0119] [Second Embodiment] Figure 3 shows an example of the configuration of the data processing system 210 according to the second embodiment.

[0120] As shown in Figure 3, the data processing system 210 includes a data processing device 12 and smart glasses 214. An example of the data processing device 12 is a server.

[0121] The data processing device 12 comprises a computer 22, a database 24, and a communication interface 26. The computer 22 comprises a processor 28, RAM 30, and storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication interface 26 are also connected to the bus 34. The communication interface 26 is connected to a network 54. An example of the network 54 is a WAN and / or LAN.

[0122] The smart glasses 214 include a computer 36, a microphone 238, a speaker 240, a camera 42, and a communication interface 44. The computer 36 includes a processor 46, RAM 48, and storage 50. The processor 46, RAM 48, and storage 50 are connected to a bus 52. The microphone 238, speaker 240, and camera 42 are also connected to the bus 52.

[0123] The microphone 238 receives voice signals from the user and accepts instructions from the user. The microphone 238 captures the voice signals from the user, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to the instructions from the processor 46.

[0124] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an image sensor such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, which captures images of the area around the user (for example, an imaging range defined by a field of view equivalent to the field of vision of a typical healthy person).

[0125] Communication interface 44 is connected to network 54. Communication interfaces 44 and 26 are responsible for the exchange of various information between processor 46 and processor 28 via network 54. The exchange of various information between processor 46 and processor 28 using communication interfaces 44 and 26 is performed in a secure manner.

[0126] Figure 4 shows an example of the main functions of the data processing device 12 and the smart glasses 214. As shown in Figure 4, the data processing device 12 performs specific processing by the processor 28. The storage 32 stores the specific processing program 56.

[0127] The processor 28 reads a specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 acting as a specific processing unit 290 according to the specific processing program 56 executed on the RAM 30.

[0128] Storage 32 stores the data generation model 58 and the emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290. The identification processing unit 290 can estimate the user's emotions using the emotion identification model 59 and perform identification processing using the user's emotions. The emotion estimation function (emotion identification function) using the emotion identification model 59 performs various estimations and predictions regarding the user's emotions, including but not limited to these examples. Furthermore, emotion estimation and prediction also include, for example, emotion analysis.

[0129] In the smart glasses 214, specific processing is performed by the processor 46. The storage 50 stores a specific processing program 60. The processor 46 reads the specific processing program 60 from the storage 50 and executes the read specific processing program 60 on the RAM 48. The specific processing is realized by the processor 46 acting as a control unit 46A according to the specific processing program 60 executed on the RAM 48. The smart glasses 214 also have a data generation model 58 and an emotion identification model 59, similar to the data generation model and emotion identification model 59, and can perform processing similar to that of the specific processing unit 290 using these models.

[0130] Furthermore, other devices besides the data processing device 12 may also have the data generation model 58. For example, a server device may have the data generation model 58. In this case, the data processing device 12 obtains processing results (such as prediction results) using the data generation model 58 by communicating with the server device that has the data generation model 58. Also, the data processing device 12 may be a server device or a terminal device owned by the user (for example, a mobile phone, robot, home appliance, etc.).

[0131] The specific processing unit 290 transmits the result of the specific processing to the smart glasses 214. In the smart glasses 214, the control unit 46A causes the speaker 240 to output the result of the specific processing. The microphone 238 acquires audio indicating user input for the result of the specific processing. The control unit 46A transmits the audio data indicating user input acquired by the microphone 238 to the data processing unit 12. In the data processing unit 12, the specific processing unit 290 acquires the audio data.

[0132] The data generation model 58 is a so-called generative AI. An example of a data generation model 58 is a generative AI such as ChatGPT. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 is input with prompts containing instructions, and inference data such as audio data representing speech, text data representing text, and image data representing images (e.g., still image data or video data). The data generation model 58 infers from the input inference data according to the instructions indicated by the prompts, and outputs the inference result in one or more data formats such as audio data, text data, and image data. The data generation model 58 includes, for example, text generation AI, image generation AI, and multimodal generation AI. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization. The specific processing unit 290 performs the specific processing described above using the data generation model 58. The data generation model 58 may be a fine-tuned model that outputs inference results from prompts that do not contain instructions, in which case the data generation model 58 can output inference results from prompts that do not contain instructions. In the data processing device 12, etc., there are multiple types of data generation models 58, and the data generation model 58 includes AI other than generative AI. AI other than generative AI includes, for example, linear regression, logistic regression, decision trees, random forests, support vector machines (SVM), k-means clustering, convolutional neural networks (CNN), recurrent neural networks (RNN), generative adversarial networks (GAN), or naive Bayes, and can perform various processes, but is not limited to these examples. Also, the AI ​​may be an AI agent. Furthermore, when the processing of each part described above is performed by the AI, the processing may be performed by the AI ​​in part or in whole, but is not limited to this example. Also, processing performed by an AI including a generative AI may be replaced by rule-based processing, and rule-based processing may be replaced by processing performed by an AI including a generative AI.

[0133] The data processing system 210 according to the second embodiment performs the same processing as the data processing system 10 according to the first embodiment. The processing by the data processing system 210 is performed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the smart glasses 214, but it may also be performed by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the smart glasses 214. In addition, the specific processing unit 290 of the data processing device 12 acquires or collects information necessary for processing from the smart glasses 214 or an external device, and the smart glasses 214 acquires or collects information necessary for processing from the data processing device 12 or an external device.

[0134] Each of the multiple elements described above, including the data collection unit, analysis unit, alert unit, and automation unit, is implemented in at least one of the smart glasses 214 and the data processing unit 12. For example, the data collection unit collects video data and network traffic data using the camera 42 and communication I / F 44 of the smart glasses 214. The analysis unit is implemented in the specific processing unit 290 of the data processing unit 12, for example, to analyze the collected data and detect anomalies. The alert unit is implemented in the control unit 46A of the smart glasses 214, for example, to issue an alert via email or push notification when an anomaly is detected. The automation unit is implemented in the specific processing unit 290 of the data processing unit 12, for example, to automate some of the initial response. The correspondence between each unit and the device or control unit is not limited to the example described above, and various changes are possible.

[0135] [Third Embodiment] Figure 5 shows an example of the configuration of the data processing system 310 according to the third embodiment.

[0136] As shown in Figure 5, the data processing system 310 includes a data processing device 12 and a headset terminal 314. An example of the data processing device 12 is a server.

[0137] The data processing device 12 comprises a computer 22, a database 24, and a communication interface 26. The computer 22 comprises a processor 28, RAM 30, and storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication interface 26 are also connected to the bus 34. The communication interface 26 is connected to a network 54. An example of the network 54 is a WAN and / or LAN.

[0138] The headset terminal 314 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication interface 44, and a display 343. The computer 36 includes a processor 46, RAM 48, and storage 50. The processor 46, RAM 48, and storage 50 are connected to a bus 52. The microphone 238, speaker 240, camera 42, and display 343 are also connected to the bus 52.

[0139] The microphone 238 receives voice signals from the user and accepts instructions from the user. The microphone 238 captures the voice signals from the user, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to the instructions from the processor 46.

[0140] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an image sensor such as a CMOS (Complementary Metal-Oxide-Semiconductor) image sensor or a CCD (Charge Coupled Device) image sensor, which captures images of the area around the user (for example, an imaging range defined by a field of view equivalent to the field of vision of a typical healthy person).

[0141] Communication interface 44 is connected to network 54. Communication interfaces 44 and 26 are responsible for the exchange of various information between processor 46 and processor 28 via network 54. The exchange of various information between processor 46 and processor 28 using communication interfaces 44 and 26 is performed in a secure manner.

[0142] Figure 6 shows an example of the main functions of the data processing device 12 and the headset terminal 314. As shown in Figure 6, the data processing device 12 performs specific processing using the processor 28. The storage 32 stores the specific processing program 56.

[0143] The processor 28 reads a specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 acting as a specific processing unit 290 according to the specific processing program 56 executed on the RAM 30.

[0144] Storage 32 stores the data generation model 58 and the emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290. The identification processing unit 290 can estimate the user's emotions using the emotion identification model 59 and perform identification processing using the user's emotions. The emotion estimation function (emotion identification function) using the emotion identification model 59 performs various estimations and predictions regarding the user's emotions, including but not limited to these examples. Furthermore, emotion estimation and prediction also include, for example, emotion analysis.

[0145] In the headset terminal 314, specific processing is performed by the processor 46. The storage 50 stores a specific program 60. The processor 46 reads the specific program 60 from the storage 50 and executes the read specific program 60 on the RAM 48. The specific processing is realized by the processor 46 acting as a control unit 46A according to the specific program 60 executed on the RAM 48. The headset terminal 314 also has a data generation model 58 and an emotion identification model 59, similar to the data generation model and emotion identification model 59, and can perform processing similar to that of the specific processing unit 290 using these models.

[0146] Furthermore, other devices besides the data processing device 12 may also have the data generation model 58. For example, a server device may have the data generation model 58. In this case, the data processing device 12 obtains processing results (such as prediction results) using the data generation model 58 by communicating with the server device that has the data generation model 58. Also, the data processing device 12 may be a server device or a terminal device owned by the user (for example, a mobile phone, robot, home appliance, etc.).

[0147] The specific processing unit 290 transmits the result of the specific processing to the headset terminal 314. In the headset terminal 314, the control unit 46A causes the speaker 240 and display 343 to output the result of the specific processing. The microphone 238 acquires audio indicating user input for the result of the specific processing. The control unit 46A transmits the audio data indicating user input acquired by the microphone 238 to the data processing unit 12. In the data processing unit 12, the specific processing unit 290 acquires the audio data.

[0148] The data generation model 58 is a so-called generative AI. An example of a data generation model 58 is a generative AI such as ChatGPT. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 is input with prompts containing instructions, and inference data such as audio data representing speech, text data representing text, and image data representing images (e.g., still image data or video data). The data generation model 58 infers from the input inference data according to the instructions indicated by the prompts, and outputs the inference result in one or more data formats such as audio data, text data, and image data. The data generation model 58 includes, for example, text generation AI, image generation AI, and multimodal generation AI. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization. The specific processing unit 290 performs the specific processing described above using the data generation model 58. The data generation model 58 may be a fine-tuned model that outputs inference results from prompts that do not contain instructions, in which case the data generation model 58 can output inference results from prompts that do not contain instructions. In the data processing device 12, etc., there are multiple types of data generation models 58, and the data generation model 58 includes AI other than generative AI. AI other than generative AI includes, for example, linear regression, logistic regression, decision trees, random forests, support vector machines (SVM), k-means clustering, convolutional neural networks (CNN), recurrent neural networks (RNN), generative adversarial networks (GAN), or naive Bayes, and can perform various processes, but is not limited to these examples. Also, the AI ​​may be an AI agent. Furthermore, when the processing of each part described above is performed by the AI, the processing may be performed by the AI ​​in part or in whole, but is not limited to this example. Also, processing performed by an AI including a generative AI may be replaced by rule-based processing, and rule-based processing may be replaced by processing performed by an AI including a generative AI.

[0149] The data processing system 310 according to the third embodiment performs the same processing as the data processing system 10 according to the first embodiment. The processing by the data processing system 310 is performed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the headset terminal 314, but may also be performed by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the headset terminal 314. In addition, the specific processing unit 290 of the data processing device 12 acquires or collects information necessary for processing from the headset terminal 314 or an external device, and the headset terminal 314 acquires or collects information necessary for processing from the data processing device 12 or an external device.

[0150] Each of the multiple elements described above, including the data collection unit, analysis unit, alert unit, and automation unit, is implemented in at least one of the headset terminal 314 and the data processing unit 12. For example, the data collection unit collects video data and network traffic data using the camera 42 and communication I / F 44 of the headset terminal 314. The analysis unit is implemented in the specific processing unit 290 of the data processing unit 12, for example, to analyze the collected data and detect anomalies. The alert unit is implemented in the control unit 46A of the headset terminal 314, for example, to issue an alert via email or push notification when an anomaly is detected. The automation unit is implemented in the specific processing unit 290 of the data processing unit 12, for example, to automate some of the initial response. The correspondence between each unit and the device or control unit is not limited to the example described above, and various changes are possible.

[0151] [Fourth Embodiment] Figure 7 shows an example of the configuration of the data processing system 410 according to the fourth embodiment.

[0152] As shown in Figure 7, the data processing system 410 includes a data processing device 12 and a robot 414. An example of the data processing device 12 is a server.

[0153] The data processing device 12 comprises a computer 22, a database 24, and a communication interface 26. The computer 22 comprises a processor 28, RAM 30, and storage 32. The processor 28, RAM 30, and storage 32 are connected to a bus 34. The database 24 and the communication interface 26 are also connected to the bus 34. The communication interface 26 is connected to a network 54. An example of the network 54 is a WAN and / or LAN.

[0154] The robot 414 includes a computer 36, a microphone 238, a speaker 240, a camera 42, a communication interface 44, and a controlled object 443. The computer 36 includes a processor 46, RAM 48, and storage 50. The processor 46, RAM 48, and storage 50 are connected to a bus 52. The microphone 238, speaker 240, camera 42, and controlled object 443 are also connected to the bus 52.

[0155] The microphone 238 receives voice signals from the user and accepts instructions from the user. The microphone 238 captures the voice signals from the user, converts the captured voice into audio data, and outputs it to the processor 46. The speaker 240 outputs audio according to the instructions from the processor 46.

[0156] Camera 42 is a small digital camera equipped with an optical system including a lens, aperture, and shutter, and an image sensor such as a CMOS image sensor or CCD image sensor, which captures images of the area around the user (for example, an imaging range defined by a field of view equivalent to the field of vision of a typical healthy person).

[0157] Communication interface 44 is connected to network 54. Communication interfaces 44 and 26 are responsible for the exchange of various information between processor 46 and processor 28 via network 54. The exchange of various information between processor 46 and processor 28 using communication interfaces 44 and 26 is performed in a secure manner.

[0158] The controlled object 443 includes a display device, LEDs in the eyes, and motors that drive the arms, hands, and feet. The posture and gestures of the robot 414 are controlled by controlling the motors of the arms, hands, and feet. Some of the robot 414's emotions can be expressed by controlling these motors. The robot 414's facial expressions can also be expressed by controlling the illumination state of the LEDs in its eyes.

[0159] Figure 8 shows an example of the main functions of the data processing device 12 and the robot 414. As shown in Figure 8, the data processing device 12 performs specific processing using the processor 28. The storage 32 stores the specific processing program 56.

[0160] The processor 28 reads a specific processing program 56 from the storage 32 and executes the read specific processing program 56 on the RAM 30. The specific processing is realized by the processor 28 acting as a specific processing unit 290 according to the specific processing program 56 executed on the RAM 30.

[0161] Storage 32 stores the data generation model 58 and the emotion identification model 59. The data generation model 58 and the emotion identification model 59 are used by the identification processing unit 290. The identification processing unit 290 can estimate the user's emotions using the emotion identification model 59 and perform identification processing using the user's emotions. The emotion estimation function (emotion identification function) using the emotion identification model 59 performs various estimations and predictions regarding the user's emotions, including but not limited to these examples. Furthermore, emotion estimation and prediction also include, for example, emotion analysis.

[0162] In robot 414, specific processing is performed by processor 46. A specific program 60 is stored in storage 50. Processor 46 reads the specific program 60 from storage 50 and executes it on RAM 48. The specific processing is achieved by processor 46 acting as a control unit 46A according to the specific program 60 executed on RAM 48. Robot 414 also has data generation model 58 and emotion identification model 59, similar to those of the robot, and can perform processing similar to that of the specific processing unit 290 using these models.

[0163] Furthermore, other devices besides the data processing device 12 may also have the data generation model 58. For example, a server device may have the data generation model 58. In this case, the data processing device 12 obtains processing results (such as prediction results) using the data generation model 58 by communicating with the server device that has the data generation model 58. Also, the data processing device 12 may be a server device or a terminal device owned by the user (for example, a mobile phone, robot, home appliance, etc.).

[0164] The specific processing unit 290 transmits the result of the specific processing to the robot 414. In the robot 414, the control unit 46A causes the speaker 240 and the controlled object 443 to output the result of the specific processing. The microphone 238 acquires audio indicating user input for the result of the specific processing. The control unit 46A transmits the audio data indicating user input acquired by the microphone 238 to the data processing unit 12. In the data processing unit 12, the specific processing unit 290 acquires the audio data.

[0165] The data generation model 58 is a so-called generative AI. An example of a data generation model 58 is a generative AI such as ChatGPT. The data generation model 58 is obtained by performing deep learning on a neural network. The data generation model 58 is input with prompts containing instructions, and inference data such as audio data representing speech, text data representing text, and image data representing images (e.g., still image data or video data). The data generation model 58 infers from the input inference data according to the instructions indicated by the prompts, and outputs the inference result in one or more data formats such as audio data, text data, and image data. The data generation model 58 includes, for example, text generation AI, image generation AI, and multimodal generation AI. Here, inference refers to, for example, analysis, classification, prediction, and / or summarization. The specific processing unit 290 performs the specific processing described above using the data generation model 58. The data generation model 58 may be a fine-tuned model that outputs inference results from prompts that do not contain instructions, in which case the data generation model 58 can output inference results from prompts that do not contain instructions. In the data processing device 12, etc., there are multiple types of data generation models 58, and the data generation model 58 includes AI other than generative AI. AI other than generative AI includes, for example, linear regression, logistic regression, decision trees, random forests, support vector machines (SVM), k-means clustering, convolutional neural networks (CNN), recurrent neural networks (RNN), generative adversarial networks (GAN), or naive Bayes, and can perform various processes, but is not limited to these examples. Also, the AI ​​may be an AI agent. Furthermore, when the processing of each part described above is performed by the AI, the processing may be performed by the AI ​​in part or in whole, but is not limited to this example. Also, processing performed by an AI including a generative AI may be replaced by rule-based processing, and rule-based processing may be replaced by processing performed by an AI including a generative AI.

[0166] The data processing system 410 according to the fourth embodiment performs the same processing as the data processing system 10 according to the first embodiment. The processing by the data processing system 410 is performed by the specific processing unit 290 of the data processing device 12 or the control unit 46A of the robot 414, but it may also be performed by the specific processing unit 290 of the data processing device 12 and the control unit 46A of the robot 414. In addition, the specific processing unit 290 of the data processing device 12 acquires or collects information necessary for processing from the robot 414 or an external device, and the robot 414 acquires or collects information necessary for processing from the data processing device 12 or an external device.

[0167] Each of the multiple elements described above, including the data collection unit, analysis unit, alert unit, and automation unit, is implemented in at least one of the following: the robot 414 and the data processing unit 12. For example, the data collection unit collects video data and network traffic data using the camera 42 and communication I / F 44 of the robot 414. The analysis unit is implemented, for example, by the specific processing unit 290 of the data processing unit 12, which analyzes the collected data and detects anomalies. The alert unit is implemented, for example, by the control unit 46A of the robot 414, which issues alerts via email or push notification when an anomaly is detected. The automation unit is implemented, for example, by the specific processing unit 290 of the data processing unit 12, which automates some of the initial response. The correspondence between each unit and the device or control unit is not limited to the example described above, and various changes are possible.

[0168] Furthermore, the emotion identification model 59, acting as an emotion engine, may determine the user's emotion according to a specific mapping. Specifically, the emotion identification model 59 may determine the user's emotion according to a specific mapping, which is an emotion map (see Figure 9). Similarly, the emotion identification model 59 may also determine the robot's emotion, and the identification processing unit 290 may perform identification processing using the robot's emotion.

[0169] Figure 9 shows the emotion map 400, in which multiple emotions are mapped. In the emotion map 400, emotions are arranged in concentric circles radiating from the center. The closer to the center of the concentric circles, the more primitive the emotions are located. Further out of the concentric circles, emotions representing states and actions arising from mental states are located. Emotion is a concept that includes feelings and mental states. On the left side of the concentric circles, emotions that are generally generated from reactions occurring in the brain are located. On the right side of the concentric circles, emotions that are generally induced by situational judgment are located. Above and below the concentric circles, emotions that are generally generated from reactions occurring in the brain and induced by situational judgment are located. In addition, the emotion of "pleasure" is located on the upper side of the concentric circles, and the emotion of "displeasure" is located on the lower side. Thus, in the emotion map 400, multiple emotions are mapped based on the structure in which emotions arise, and emotions that are likely to occur simultaneously are mapped close together.

[0170] These emotions are distributed at the 3 o'clock position on the Emotion Map 400, and usually fluctuate between feelings of security and anxiety. In the right half of the Emotion Map 400, situational awareness takes precedence over internal feelings, resulting in a calm impression.

[0171] The inside of the Emotion Map 400 represents inner thoughts, while the outside represents actions. Therefore, the further you go from the outside of the Emotion Map 400, the more visible (expressed in actions) your emotions become.

[0172] Here, human emotions are based on various balances, such as posture and blood sugar levels. When these balances deviate from the ideal, it results in discomfort, and when they approach the ideal, it results in pleasure. Similarly, in robots, cars, and motorcycles, emotions can be created based on various balances, such as posture and battery level. When these balances deviate from the ideal, it results in discomfort, and when they approach the ideal, it results in pleasure. The emotion map can be generated based, for example, on Dr. Mitsuyoshi's emotion map (Research on a system for analyzing brain physiological signals of speech emotion recognition and emotion, Tokushima University, doctoral dissertation: https: / / ci.nii.ac.jp / naid / 500000375379). The left half of the emotion map contains emotions belonging to a region called "response," where sensation is dominant. The right half of the emotion map contains emotions belonging to a region called "situation," where situational awareness is dominant.

[0173] The emotion map defines two emotions that promote learning. One is the emotion around the middle of the negative "repentance" and "reflection" on the situation side. In other words, it is when the robot experiences negative emotions such as "I never want to feel this way again" or "I don't want to be scolded again." The other is the emotion around the positive "desire" on the reaction side. In other words, it is when the robot has positive feelings such as "I want more" or "I want to know more."

[0174] The emotion identification model 59 inputs user input into a pre-trained neural network, obtains emotion values ​​representing each emotion shown in the emotion map 400, and determines the user's emotion. This neural network is pre-trained based on multiple training data sets, which are combinations of user input and emotion values ​​representing each emotion shown in the emotion map 400. Furthermore, this neural network is trained so that emotions located close together have similar values, as shown in the emotion map 900 in Figure 10. Figure 10 shows an example where multiple emotions such as "reassured," "calm," and "confident" have similar emotion values.

[0175] In the above embodiment, an example was given in which a specific process is performed by a single computer 22. However, the technology of this disclosure is not limited thereto, and a distributed processing method for the specific process may be used, which includes computer 22 and multiple other computers.

[0176] In the above embodiment, an example was given in which the specific processing program 56 is stored in the storage 32, but the technology of this disclosure is not limited thereto. For example, the specific processing program 56 may be stored in a portable, computer-readable, non-temporary storage medium such as a USB (Universal Serial Bus) memory. The specific processing program 56 stored in the non-temporary storage medium is installed in the computer 22 of the data processing device 12. The processor 28 executes specific processing according to the specific processing program 56.

[0177] Alternatively, the specific processing program 56 may be stored in a storage device such as a server connected to the data processing device 12 via the network 54, and the specific processing program 56 may be downloaded and installed on the computer 22 in response to a request from the data processing device 12.

[0178] Furthermore, it is not necessary to store the entirety of the specific processing program 56 in a storage device such as a server connected to the data processing device 12 via the network 54, or to store the entirety of the specific processing program 56 in the storage 32; it is acceptable to store only a portion of the specific processing program 56.

[0179] The following types of processors can be used as hardware resources to perform specific processing. Examples of processors include a CPU, a general-purpose processor that functions as a hardware resource to perform specific processing by executing software, i.e., a program. Other examples of processors include dedicated electrical circuits, such as FPGAs (Field-Programmable Gate Arrays), PLDs (Programmable Logic Devices), or ASICs (Application Specific Integrated Circuits), which have circuit configurations specifically designed to perform specific processing. All of these processors have built-in or connected memory, and all of them perform specific processing by using memory.

[0180] The hardware resource that performs a specific process may consist of one of these various processors, or it may consist of a combination of two or more processors of the same or different types (for example, a combination of multiple FPGAs, or a combination of a CPU and an FPGA). Alternatively, the hardware resource that performs a specific process may consist of a single processor.

[0181] Examples of configurations using a single processor include, firstly, a configuration in which one or more CPUs and software are combined to form a single processor, and this processor functions as a hardware resource that performs a specific process. Secondly, there is a configuration using a processor that realizes the functions of the entire system, including multiple hardware resources that perform a specific process, on a single IC chip, as exemplified by SoCs (System-on-a-chip). In this way, a specific process is realized using one or more of the above types of processors as hardware resources.

[0182] Furthermore, the hardware structure of these various processors can more specifically utilize electrical circuits that combine circuit elements such as semiconductor devices. Also, the specific processing described above is merely an example. Therefore, it goes without saying that unnecessary steps can be deleted, new steps added, or the processing order rearranged, as long as it does not deviate from the main purpose.

[0183] Furthermore, although the above-described examples were divided into four embodiments, some or all of these embodiments may be combined. Also, the smart device 14, smart glasses 214, headset terminal 314, and robot 414 are just examples, and they may be combined, or other devices may be used. Also, although the above-described examples were divided into two embodiments, Embodiment 1 and Embodiment 2, these may be combined.

[0184] The descriptions and illustrations presented above are detailed explanations of the technical aspects of this disclosure and are merely examples of the technical aspects. For example, the above descriptions of the structure, function, operation, and effect are examples of the structure, function, operation, and effect of the technical aspects of this disclosure. Therefore, it goes without saying that you may delete unnecessary parts, add new elements, or replace elements in the descriptions and illustrations presented above, as long as you do not deviate from the essence of the technical aspects of this disclosure. Furthermore, in order to avoid confusion and facilitate understanding of the technical aspects of this disclosure, explanations of common technical knowledge and other things that do not require special explanation to enable the implementation of the technical aspects of this disclosure have been omitted from the descriptions and illustrations presented above.

[0185] All documents, patent applications, and technical standards described herein are incorporated by reference to the same extent as if each individual document, patent application, and technical standard were specifically and individually noted to be incorporated by reference.

[0186] (Note 1) A data collection unit for continuously monitoring the network status, An analysis unit analyzes the data collected by the aforementioned collection unit and detects anomalies, An alert unit that immediately issues an alert when an abnormality is detected by the aforementioned analysis unit, The system includes an automation unit that performs partial automation of initial response based on alerts issued by the alert unit. A system characterized by the following features. (Note 2) The aforementioned collection unit is It collects diverse data sources such as video data, log data, and network traffic data. The system described in Appendix 1, characterized by the features described herein. (Note 3) The aforementioned analysis unit, The collected data is analyzed to detect anomalies. The system described in Appendix 1, characterized by the features described herein. (Note 4) The alert unit is, An alert is issued immediately when an anomaly is detected. The system described in Appendix 1, characterized by the features described herein. (Note 5) The aforementioned automation unit, We will implement partial automation of the initial response. The system described in Appendix 1, characterized by the features described herein. (Note 6) The aforementioned automation unit, Automate simple troubleshooting. The system described in Appendix 1, characterized by the features described herein. (Note 7) The aforementioned analysis unit, Anomalies are detected using time series analysis models, machine learning models, and deep learning models specialized for anomaly detection. The system described in Appendix 1, characterized by the features described herein. (Note 8) The aforementioned collection unit is It collects packet-level data from network interfaces, logs from servers, routers, switches, etc., and video feeds from surveillance cameras and sensors. The system described in Appendix 1, characterized by the features described herein. (Note 9) The aforementioned collection unit is We estimate the user's emotions and adjust the timing of data collection based on those estimated emotions. The system described in Appendix 1, characterized by the features described herein. (Note 10) The aforementioned collection unit is The frequency of data collection is dynamically changed according to the network load. The system described in Appendix 1, characterized by the features described herein. (Note 11) The aforementioned collection unit is The type of data to collect is automatically selected based on the network status. The system described in Appendix 1, characterized by the features described herein. (Note 12) The aforementioned collection unit is It estimates the user's emotions and prioritizes the data to collect based on those estimated emotions. The system described in Appendix 1, characterized by the features described herein. (Note 13) The aforementioned collection unit is When collecting data, the geographical distribution of the network is taken into consideration, and highly relevant data is prioritized for collection. The system described in Appendix 1, characterized by the features described herein. (Note 14) The aforementioned collection unit is When collecting data, the scope of data to be collected is optimized by considering the network topology information. The system described in Appendix 1, characterized by the features described herein. (Note 15) The aforementioned analysis unit, It estimates the user's emotions and adjusts how the analysis results are displayed based on the estimated emotions. The system described in Appendix 1, characterized by the features described herein. (Note 16) The aforementioned analysis unit, During analysis, the analysis algorithm is optimized by referring to past anomalous data. The system described in Appendix 1, characterized by the features described herein. (Note 17) The aforementioned analysis unit, During analysis, different analysis methods are applied depending on the network traffic pattern. The system described in Appendix 1, characterized by the features described herein. (Note 18) The aforementioned analysis unit, It estimates the user's emotions and prioritizes the analysis results based on the estimated user emotions. The system described in Appendix 1, characterized by the features described herein. (Note 19) The aforementioned analysis unit, During analysis, the analysis results are displayed while taking into account the geographical distribution of the network. The system described in Appendix 1, characterized by the features described herein. (Note 20) The aforementioned analysis unit, During analysis, network topology information is referenced to improve the accuracy of the analysis. The system described in Appendix 1, characterized by the features described herein. (Note 21) The alert unit is, It estimates the user's emotions and adjusts how alerts are notified based on those emotions. The system described in Appendix 1, characterized by the features described herein. (Note 22) The alert unit is, When an alert occurs, the importance of the alert is evaluated by referring to past alert history. The system described in Appendix 1, characterized by the features described herein. (Note 23) The alert unit is, When an alert is triggered, the content of the alert will be customized according to the network traffic conditions. The system described in Appendix 1, characterized by the features described herein. (Note 24) The alert unit is, It estimates the user's emotions and determines the priority of alerts based on the estimated user emotions. The system described in Appendix 1, characterized by the features described herein. (Note 25) The alert unit is, When an alert occurs, the system selects the recipients of the alert notification, taking into account the geographical distribution of the network. The system described in Appendix 1, characterized by the features described herein. (Note 26) The alert unit is, When an alert occurs, the system optimizes the alert content by referring to network topology information. The system described in Appendix 1, characterized by the features described herein. (Note 27) The aforementioned automation unit, It estimates the user's emotions and adjusts the automated procedures based on the estimated user emotions. The system described in Appendix 1, characterized by the features described herein. (Note 28) The aforementioned automation unit, During automation, the system selects the optimal automation procedure by referring to past troubleshooting history. The system described in Appendix 1, characterized by the features described herein. (Note 29) The aforementioned automation unit, During automation, the scope of automation is dynamically changed according to network traffic conditions. The system described in Appendix 1, characterized by the features described herein. (Note 30) The aforementioned automation unit, It estimates user emotions and determines automation priorities based on the estimated user emotions. The system described in Appendix 1, characterized by the features described herein. (Note 31) The aforementioned automation unit, During automation, the automation process is optimized by considering the geographical distribution of the network. The system described in Appendix 1, characterized by the features described herein. (Note 32) The aforementioned automation unit, During automation, network topology information is referenced to improve the accuracy of the automation process. The system described in Appendix 1, characterized by the features described herein. [Explanation of symbols]

[0187] 10, 210, 310, 410 Data Processing Systems 12 Data Processing Devices 14 Smart Devices 214 Smart Glasses 314 Headset-type terminal 414 Robots

Claims

1. A data collection unit for continuously monitoring the network status, An analysis unit analyzes the data collected by the aforementioned collection unit and detects anomalies, An alert unit that immediately issues an alert when an abnormality is detected by the aforementioned analysis unit, The system includes an automation unit that performs partial automation of initial response based on alerts issued by the alert unit. A system characterized by the following features.

2. The aforementioned collection unit is It collects diverse data sources such as video data, log data, and network traffic data. The system according to feature 1.

3. The aforementioned analysis unit, The collected data is analyzed to detect anomalies. The system according to feature 1.

4. The alert unit is, An alert is issued immediately when an anomaly is detected. The system according to feature 1.

5. The aforementioned automation unit, We will implement partial automation of the initial response. The system according to feature 1.

6. The aforementioned automation unit, Automate simple troubleshooting. The system according to feature 1.

7. The aforementioned analysis unit, Anomalies are detected using time series analysis models, machine learning models, and deep learning models specialized for anomaly detection. The system according to feature 1.

8. The aforementioned collection unit is It collects packet-level data from network interfaces, logs from servers, routers, switches, etc., and video feeds from surveillance cameras and sensors. The system according to feature 1.

Images