AU2016102476A4 - Monitoring on-line activity - Google Patents

Abstract

A computer-implemented apparatus and method configured for use within a data exchange path between at least one sending device and at least one receiving device; the apparatus comprising: 5 - a data capture module for capturing data being exchanged between said sending device and said receiving device; - a decoding module for analysing said captured data to identify one or more indicators of a predetermined data content type; and - a data matching module for matching said indicators with a preconfigured .0 database of meanings and generating response data corresponding to one or more meanings determined to match said one or more indicators. Data request N,. Remote +The Int ernet Server or airspace or Learner's Device Date respons d-at Device Data I ~Modified response data requests 4 EPAIX Server /Console /Transmitter/etc.>..2 PAIX (interception) on~ -- - - - - - -- - - - -- - - - - -- .. . . .. . . . .. . . . . . . - - -- -- - - - - - - - - - - -- - - t.III' m" -s

Description

Data request N,.

Remote +The Int ernet Server or airspace or Learner's Device Date respons d-at Device Data I ~Modified response data requests 4

EPAIX

Server /Console /Transmitter/etc.>..2

PAIX (interception)

on~

--- - - - - -- - - - -- - - - - -- ... . .. . . . .. . . . . . . -- ----- - - - - - - - - - -- - - t.I I' m" -s

MONITORING ON-LINE ACTIVITY

This invention relates generally to an apparatus and method for capturing, processing and analysing data from at least one sending device that is communicating with at least one receiving device for the purpose of monitoring on-line activity of at least one monitored person, and generating an advisory output to at least one other person using at least one other device..

In recent years, on-line activity by many different people and within many different organisations has become commonplace. Such activity is not just limited to one-way internet usage, such as web browsing and accessing web sites, but two-way communication has .0 become equally commonplace, via email, social networking sites, various instant messaging facilities, video communication applications, and the like. Whilst technological advances in these fields are generally recognised as positive, security issues arising out of on-line activities, and the effect that unmonitored internet access and on-line communications can potentially have on nation states, businesses and individuals, has also become of increasing .5 concern.

It is widely recognised that on-line security is of paramount importance, and various firewalls and the like have been developed to maintain the integrity of devices having internet access and protect, at least to a certain extent, a user's privacy and data. Businesses have established the need to monitor, limit and even censor some internet activities by their .0 employees, and equally parents may have a similar need in relation to their children, and internet usage and browser history monitoring systems have been developed for this purpose.

However, a significant problem still exists, particularly in relation to on-line communication facilities but also in relation to internet activity and web browsing, in that such monitoring systems are essentially configured to report activity after the event, by which time of course it may be too late to mitigate any adverse effects. At best this could mean an individual being offended, and at worst could lead to a national or international atrocity.

This may be of particular concern to parents and carers of vulnerable people, for example, in that there is no means for monitoring and possibly truncating potentially harmful on-line activity whilst it is occurring, thereby providing the opportunity to prevent or mitigate harmful effects, without remaining with the person to be monitored and physically watching their on-line activity and their emotional or physiological responses during such activity.

This is, of course, not always possible or practical, and it would be desirable to provide an

apparatus and method which has the potential to monitor on-line activity and provide alerts in

response to potentially harmful content, communications, etc. Current monitoring systems

often look up keywords and, as new technologies emerge, such systems lack the ability to

monitor, and it is an object of at least one aspect of the present invention to address these

issues.

Thus, in accordance with and aspect of the present invention, there is provided a

computer-implemented apparatus configured for use within a data exchange path between at

least one sending device and at least one receiving device; the apparatus comprising:

.0 - a data capture module for capturing data being exchanged between said sending

device and said receiving device;

- a decoding module for analysing said captured data to identify one or more indicators

of a predetermined data content type; and

- a data matching module for matching said indicators with a preconfigured database of

.5 meanings and generating response data corresponding to one or more meanings determined to

match said one or more indicators.

Thus, aspects of the present invention acknowledge that false positives in this regard

exist, and monitoring users can crowd-source to the system to improve its reliability.

In an exemplary embodiment of the present invention, said data captured by said data

capture module may comprise one or more of:

- audio, image and/or video data;

- text and attachments from online chats, text messaging and instant messaging

conducted by a user and at least one remote third party via said computing device;

- any search queries made by a user on said computing device;

- the contents of emails sent and received via said computing device;

- data representative of programs or apps being accessed by a user on said computing

device;

- the username and password used by a user of said computing device to access a

specific website, and data representative of the identity of that website;

- the contact list of a specified user of said computing device;

- data representative of the key strokes or screen selections being made by a user on

said computing device;

- data representative of websites being accessed via said computing device and actions

being performed in relation thereto;

- data representative of the length of time spent on the internet by a specified user;

- data representative of interests or preferences of a specified user of said computing

.0 device;

- data representative of the geographic location of a user and/or one or more remote

third parties with whom they are communicating via said computing device;

- data representative of commands being performed within a specified piece of software

running on said computing device;

.5 - data representative of the intensity of interaction between a user of at least one

sending device and the user of at least one receiving device;

- data representative of the identity of the user of the at least one receiving device by

the at least one user of the at least one sending device.

Alternatively, or in addition, said data captured by said data capture module may

comprise one or more of:

- webcam, microphone and/or heart rate monitor output data in respect of a user of said

computing device;

- EEG or other neurological data from a user of said computing device;

- data representative of the location and/or extent of at least one user of at least one

receiving device or at least one sending device.

In an exemplary embodiment, the decoding device may be configured to access a

database of meanings, which may comprise one or more preconfigured look-up tables including indicators corresponding to respective potential outputs of said decoding module and data representative of respective meanings to be attributed thereto.

Alternatively, or in addition, the database of meanings may include at least one

preconfigured look-up table including contextual indicators corresponding to the

identification of a predetermined content type and a predetermined emotional state of a user

of said computing device, together with data representative of the respective meanings to be

attributed to said contextual indicators (see, for example, Table 1 below).

Table 1 The Trolling Magnitude Scale

TM Motive Mode Gravity Description

1 Playtime Cyber- In the moment and quickly bantering Cyber- regret trolli 2 Tactical Cyber- ng In the moment but don't trickery regret and continue Strategic Cyber- Go out of way to cause 3 bullying problems, but without a sustained and planned long Cyber- term campaign stalki Dominatio Cyber- ng Goes out of the way to 4 n hickery create rich media to target one or more specific individuals

.0 The decoding module may be configured to analyse captured data to identify the

existence therein of a predetermined one or more content types that is/are potentially grossly

offensive, indecent, obscene or of a menacing character and/or that which may cause

harassment, alarm, distress or apprehension. It is important to note here that the context of

the content may be analysed in terms of the wording used (in the case of text data), but may

alternatively, or in addition, be analysed from monitored video or audio data. Thus, in some

exemplary embodiment, faces and/or facial expressions may be identified from monitored

video data, but behaviours can also be analysed and identified from audio data such as words

and/or tone. Alternatively, or in addition, the decoding module may be configured to identify

the social competencies of a user, such as that person's ability to understand the difference between so-called banter and 'cheek'.

Alternatively, or in addition, the decoding module may be configured to extract, from

said captured data, information about the emotional state(s) of a user of said computing

device. Alternatively, or in addition, the decoding module may be configured to identify

character traits about a person, such as levels of tolerance or determination with other users

(see, for example, Table 2 below).

Table 2 Pre-determined emotional states and character traits

# Lurker Loner Stranger Wallflower Forbearer

(Nervous) (Afraid, (Nervous, (Nervous) (Afraid, Lonely) Fear) discouraged, fear, fearful, loneliness, nervous,reserved scared terrified)

:- Elder Catalyst Bouncing (fatigued, rusty, Coconut sleep, wise, (Boredom) (Bored , (Bored) detached) Sleepy, (Bored(*)) Tired)

) Chat Room Striver Exotic Stalker Fan (Devoted, Bob erotic, hopeful, (Bashful, (Possessive (Intoxicated merosn, (Intoxicated) Tense) , Eager, - Bar or romantic, sexy) Hopeful) Club)

-( Ripper Rejector Pitied Emo Kid Failure (Depressed, (Sadness) (Sad, (Sadness(*), (Sad - City despairing, Distressed, Depressed, Centre,) distressed, Gloomy) Gloomy, embarrassed, Despairing) gloom,guilty, helpless, horror, misery, regretful, sad, stress, suicide, unhappy, upset, pity)

:-D Troll Cynic Humorous Homie Fellow (Enjoyment, happy, joy, joyful, (Happiness) (Happy) (Joy(*), (Happy - mischief, silly, Amused) Residential) tease, wit)

-) Big Man Sceptic Patriarchal Hipster Frontman (moral, rigid, rude, selfish, (Critical, (Critical, (Critical, (Thinking- serious, sceptical, Thoughtful) Thinking) Thoughtful) School, thought, snob) University)

) Flirt Follower Orthodox Flower Friend Child (Neutral) (Glad, (Calm(*), (Friendly, Pleased) Please, (Calm, impressed, natural, Serene, Liked - nice, pleasure, Delighted) Countryside relaxed, satisfied) , Garden)

801 Snert Antagonist Pariah Juggalo Foe (Disdainful, disgusted, hostile, (Disgust) (Annoyed) (Disgust(*), (Bothered, jealousy,menace, Irritated) Unfriendly) insecure, nasty obnoxious, rejected, resent) 8-1 Wizard Enthusiast Assiduous Jared Fixer (Elated, excitement, lively, (Cheerful) (Excited) (Cheerful(*)) (Cheerful, optimism, Excited) triumphant)

Ao) Iconoclast Detractor Vanguard Beatnik Freethinker (Disgusted, (Aggressive) (Hateful, (Antagonisti (Disbelievin ridicule) Alarmed) c(*), g) Suspicious)

:@ E-venger Fascist Dangerous Man Baby Fighter (Anger, Angry, enraged, (Anger) (Angry) (Anger(*), (Angry, Hurt displeased, hate, Contemptuo - hatred, hurt, us) Warehouse, outrage, rage, Workplace) scornful, scorn, violent)

-0 MHBFY Pacifist Timid Hippie Family (Grateful, Jenny kind, kindness, (Astonished) (Surprise(*), (Kind, repentant, (Surprise) Content, Surprised) reverent, startled, Acceptance, subdued,

Trusting) thoughtful, timid, warmth, sissy)

Alternatively or in addition, especially with regards to the affective modelling above,

the decoding module may be configured to identify the gaming strategies of the above types

of user through the use of fuzzy, neural-network, tree-search, or similar fonns

player/opponent modelling. The table below shows some of approaches taken by users to

achieve their goals in a strategic or game-like manner that the system could detect or

otherwise monitor (see, for example, the table below).

STIMULUS TYPE (POST CONTEXT TYPE) Social (Snacking) Users do perform snacking offer short bursts of content and consume a lot too. If done by Flirts it can be supportive of a person or group, but if done by Snerts antoganistic to one person or the group they belong to. Emotional (Mobiling) Mobiling is where users use emotions to either become closer to others or make a distance from them. Cognitive (Trolling) Trolling as a more generic pursuit seeks to provoke others, sometimes affect their kudos-points with others users. Physical (Flooding) Flooding is where users get heavily involved with others uses by intensive posting that aims to use the person for some form of gratification. Visual (Spamming) Spamming, often associated with unsolicited mail, is in general the practices of making available ones creative works or changing others to increase the success of meetings one's goals. Relaxational (Lurking) Lurking is enacted by those on the periphery of a community. Their judgements for not taking part often relate to a lack of purpose or control.

Alternatively, or in addition, the decoding module may be configured to identify

moral dispositions about a person, such as inclinations involving "kudos" such as kindness,

patience or generosity, or those involving "flames" such as based on malice or hate for other groups (see, for example, table below).

Flame Group type Kudos Group type

Haters Spods (Like to inflame situations (Take part in multiple debates, for no real benefit to often across many websites, but towers) without beung abusive or inciting flame-wars)

Lolcows Firefighters Like to provoke others so (Get involved in coversations to the attention is on them) try to defuse them, often unsuccessfully)

Bzzzters Blatherer (Like to chat regardless of (Likes to send long or detailed accuracy or usefulness of contributions) messages to help others)

Eyeballs (Like to watch what othersDwe doe fo t ht portnes (Someone who may know a lot on a do for the 'opportune' topic, but lacks what it takes to po menttopossa) positively engages with others) provocative message)

Alternatively, or in addition, the decoding module may be configured to identify the

personal values of a user, such as those values developed over time, such as those leading to

lifestyle choices or personal preferences, such as whether to join a given faith. These may

result in them using computer systems that are made up of interface cuts reflecting those

values (see, for example, Table 3 below)

Table 3 Personal preferences Stage Observabl Show Detect Reward Create e factor Particip Topics Value Networks /

ation Creation Communitie S Stimuli Prospects Power', Autonomy Leader- 4 Controls ,

/ mastery2 1, boards', action Opportuni polls 4 , learning 4 buttons , ty quizzes 4 2 labels 4

, links4

Impetus Anteceden Graphic Meaning 2 Educatio Link t State / Design 4 , , Mental n3 , 4 , colour 4

, Psycholog Typograp object 4 , intellig font size 4

, ical hy, ence 3 underlinin Illustra g4

, tion 4 consistenc 4 2 4 2 Intent Capital / Points , Writing Badges Search 4

, Financial keywords , privacy 4 photogra policy 4

, phy 4 , relevant meta content 4 tags 4

, keywords 4 4 Neuro- Environme Content Posts 3 , Punishme Likes 3

, Response ntal / , replies 3 nts 2 , posts 3

, Physical iconogra , tags 3 rewards 2 replies 3

, phy 4 buddies 3

, up/next buttons 4 Judgemen Time Levels', Definiti Videogra Cinematogr animatio on of phy 4 aphy 4

, n , 4 goals 4 Response Group Reputati Fun 2 , Group Social Dynamics on 3 love 2 identity confidence 3 / Social 1, Likes 3 , reciprocal _links4 Key: 1 Authority cues, 2 Bandwagon cues, 3 Contribution cues, 4

Design cues

Alternatively, or in addition, the decoding module may be configured to identify the

type of system a user is using based on a number of factors about the user interface and the

levels and nature of participation possible in them (see, for example, Table 4 below).

Table 4 Identifying the type of system a user is using.

0. 0 6) 0 4- L

00 CLo M~ 0L S E 0 x .2 0) 0 0C E 0.n 4- 0 LU 00.0 0 a 0

0. 0 0

esna 0 0 0

Mesg0 0 0 0 10

EalLs10 0 1 1~ 0 0- 0

Cht0 0o 0 0

Persoal 1 0 1 0 Hornepas Message 1 1 0 1 1 0 1 01

and

Wieors

Wikis and 1 1 1 1 0 1 110 Hypertext Fiction

In accordance with one aspect of the invention, the apparatus may be configured to disable the secure socket layer within said data exchange path between at least one receiving device and at least one sending device.

The decoding module may be configured to analyse said data captured by said data capture module and identify therein indicators representative of predetermined behaviours of a user of said computing device.

The apparatus may further comprise an output module configured to generate an alert or message corresponding to one or more meanings determined from said database of meanings to match one or more of said indicators. The output module may be configured to .0 transmit said alert or message to a remote third party. The output module may be configured to transmit to a remote third party device, data representative of activity by a user of said computing device that corresponds to said one or more indicators, for display on said remote third party device. The alert or message may include data representative of a recommended action. The apparatus may be configured to determine if said recommended action is or has .5 been taken; and, optionally, to generate and transmit a further message or alert in the event that it is determined that said recommended action has not been taken within a predetermined period of time.

In accordance with another aspect of the present invention, there is provided a computer-implemented method for monitoring a user's on-line activity between at least one .0 sending device and at least one receiving device, the method comprising:

- capturing, by means of a computer-implemented data capture module, user-initiated data being exchanged between said sending and receiving devices;

- using a computer-implemented decoding module to analyse said captured data to identify one or more indicators of a predetermined data content type; and

- matching, using a computer-implemented data matching module, said indicators with a preconfigured database of meanings and generating thereby response data corresponding to one or more meanings determined to match said one or more indicators.

These and other aspects of the present invention will become apparent from the following specific description, in which embodiments of the present invention will now be described, by way of examples only, and with reference to the accompanying drawings, in which:

Figure 1 is a schematic block diagram illustrating a user interacting with a computing

device which is connected to a router via an on-line monitoring device according to an

exemplary embodiment of the invention;

Figure 2 is a schematic block diagram illustrating some of the principal modules of an

on-line monitoring device according to an exemplary embodiment of the present invention;

Figure 3 is a schematic diagram illustrating an exemplary embodiment of the present

invention for use in an educational environment; and

.0 Figure 4 is a schematic diagram illustrating an exemplary embodiment of the present

invention for use in a "bring your own device" application.

Referring to Figure 1 of the drawings, a user 101, defined herein as a 'monitored person', is shown using a computing device 200. The computing device 200 may comprise any device having on-line or internet connectivity. Thus, the computing device may

.5 comprise a mobile telephone, personal digital assistant, laptop, tablet computer, desktop

computer, etc. However, it will be appreciated that the monitored "person" may not

necessarily be a human being, in the sense that alternative exemplary embodiments of the

invention may be applied to monitor on-line activity between an unmanned operational

device, such as a UAV, and a known/unknown third party, so as to generate an alert (and

recommended action) if such activity is determined to be potentially harmful. Thus, the

present invention is not necessarily intended to be limited in this regard, and aspects of the

invention apply broadly to use in respect of any device that supports audio, video and data

exchange. In any event, the device 200 will include a communications interface for

communicating, e.g. via the internet or any other communications network (preferably

wireless, although wired communication links may be used in some cases), with a monitoring

device 300.

The monitoring device 300 includes at least one computing device having a processor,

memory and communications interface. Embodiments of the system described herein use

code executing on one or more processors of the monitoring device 300, but it will be

appreciated that the functions performed may be distributed in some manner, e.g. over more

than one monitoring device. The monitoring device 300 may comprise a stand-alone or bolt- on, dedicated device for this purpose, but may equally comprise a module integrated into a

Wi-fi router 201 or other device through which remote communications are routed and

supported. Alternative exemplary embodiments of the invention could be designed for

central communication and/or exchange systems such as a telephone exchange, mobile phone

mast or CCTV centres, wherein the lookup table could be compiled based on governmental

data, such as known suspects' IP addresses, email addresses, telephone numbers, geographical location, and wherein the resultant monitoring device could be used to monitor

line(s) being used by a suspected person and/or by monitoring audio/visual data.

Further alternative exemplary embodiments of the invention may be designed to

.0 intercept communications sent through electromagnetic waves between two remote devices.

For instance, during a war or other period of civil unrest, persons may be communicating

through unmanned aerial vehicles and the like, which may act as routers to transfer

communications away from official channels such as telephone networks (see also, for

example, the embodiment depicted in Figure 4 of the drawings).

.5 Referring to Figure 2 of the drawings (and Figures 3 and 4 which illustrate more

specific exemplary embodiments of the invention), the monitoring device 300 includes a data

capture module 301 configured to capture data communicated to and from the user's computing device 200 through, for example, a Wi-fi router. In this case, it will be

appreciated by a person skilled in the art that, in order to capture data in a format that can be

.0 analysed, it may be necessary to provide, as part of the monitoring device 300, a function

configured to disable the secure socket layer of the user's computing device 200, whilst maintaining the integrity of the secure socket layer of the router itself, such that HTTPS

communication from the user's computing device 200 to the data capture module 301 of the monitoring device 300 is disabled to enable unencrypted data capture, but maintain HTTPS

communication from the router onward. Of course, such disabling of the HTTPS

communication between the user's computing service and the monitoring device may be selective. For example, HTTPS communication may only be disabled for untrusted sites, like

social networking sites or the like, but remain in place in respect of sites having trusted

certificates such as banking sites and the like.

The data capture module 301 is configured to capture data required to monitor a

user's on-line activity and generate a useful advisory output, as required, and the data which

the module 301 is configured to capture will vary from embodiment to embodiment, according to the nature of the 'monitored person' and the potential hazards required to be identified. Consider, for example, a device according to an exemplary embodiment of the present invention which is configured to enable a parent or carer of a child or vulnerable adult to remotely and automatically monitor their on-line activity and receive an advisory message if potentially harmful activity is identified.

In this case, the monitored person 101 communicates with various remote parties 215, and accesses and views material available on the internet, via the user interface 203 of their computing device 200. On-line communication may take the form of audio, video, imaging or text, or a combination of two or more of these media, and may take place over email, .0 social network, video/audio conferencing, instant messaging, or any other available remote communications function. All such activity and data exchange is routed through the monitoring device 300 and the data capture module 301 is configured to capture any or all such data.

Thus, the data capture module 301 may be configured to receive one or more of:

.5 • Audio, image and video data; • Text and attachments from online chats, text messaging and instant messaging by the monitored person and at least one remote third party; • Any search queries made by the monitored person; • The contents of emails sent and received; .0 • Data representative of programs or apps being accessed by the monitored person; • The username and password used by the monitored person to access a specific website, and data representative of the identity of that website; • The contact list of the monitored person; • Data representative of the key strokes or screen selections being made by the monitored person, which may involve the use of an event handler as will be described in more detail later; • Data representative of websites being accessed by the monitored person and actions being performed in relation thereto, as will be described in more detail later; • Data representative of the length of time spent on the internet by the monitored person; • Data representative of interests or preferences of the person being monitored;

• Data representative of the geographic location of the person being monitored and/or

one or more remote third parties with whom they are communicating;

• Data representative of commands being performed within a specified piece of

software;

• Data representative of the intensity of interaction between the monitored person and at

least one remote third party with whom they are communicating, e.g. such data may

be representative of the numbers of communications therebetween;

• Data representative of the identity of a third party with whom the monitored person is

interacting, for example, on a social level.

.0 Once captured, data is passed to a decoding module 204 before passing to a data

matching module 206 configured to match the captured and decoded data with a database

of meanings, as will be described in more detail later.

If the user is, for example, accessing the Dark Web, incoming data may not be

readable or decipherable by the decoding module 204. The Dark Web is term that refers

.5 specifically to a collection of websites, private VPNs and peer-to-peer communication

facilities, that are not usually publicly accessible and hide the IP addresses of the servers

that run them. Many sites on the so-called Dark Web hide their identity using the Tor

encryption tool, which can be used to hide their identity and 'spoof their location.

Others use similar services, such as 12P. In all cases, though, data received from such sites will be encrypted. Thus, the device of the present invention may be configured to

monitor data flow and identify whether or not the data is in a readable form. If not, this

may suggest that the data is encrypted (for example, it may be in a higher number of bits

than HTTPS), and may therefore provide a flag for potential intervention (from the

above-mentioned database of meanings). Such intervention may, for example, comprise

looking up whether the IP address to which data is being sent and/or from which data is

being received is a known proxy server and, if so, automatically disabling it or give

another recommendation. Alternatively, or in addition, in the event that unreadable data

flow is detected, the system may be configured to simply block that data flow, making it

inaccessible to the user.

In addition to the above-mentioned activity data, the data capture module 301 may be

further configured to receive physiological and/or neurological data representative of the affective state of the monitored person, during on-line activity. Such data may include one or more of:

• Webcam, microphone and/or heart rate monitor output data in respect of the

monitored person, as will be described in more detail later;

• EEG or other neurological data from the monitored person, as will be described in

more detail later;

• Data representative of the location and/or extent of gaze of the monitored person,

as will be described in more detail later.

As with the activity data, such physiological/affective data is decoded by the decoding

.0 module 204 before being passed to the data matching module 206 for matching with a

database of meanings.

The decoding process in this case has two principal aims:

a) Analysis of captured data and extraction of information about the emotional

state(s) of the monitored person; and

.5 b) Analysis of captured data to identify the existence of content that has the potential

to be grossly offensive, indecent, obscene or of a menacing character and that

which may cause harassment, alarm, distress or apprehension.

Referring first to the aim of extraction of information about the emotional state(s) of

the monitored person, reference is made to Bishop, J.(2003). The internet for educating

individuals with social impairments. Journal of Computer Assisted Learning. 19(4), 546-556,

in which a PARLE system is proposed and described which facilitates the automatic analysis

of prosody and facial patterns to extract information about the emotional state(s) of a subject.

Thus, in accordance with one exemplary embodiment of the present invention, audio/video

data obtained in respect of the monitored person via a microphone/webcam can be passed to a

PARLE system of the type described in the above-mentioned reference, within the decoding

module 204, for extracting of such information.

It is known that various emotional expressions produce different changes in

autonomic activity. For example, anger and fear have been shown to cause an increased heart

rate in a subject experiencing those emotions, whereas happiness has been shown to cause a

decrease in the heart rate of the subject. Thus, in an exemplary embodiment of the present

invention, the monitored person may be provided with a heart rate monitor configured to transmit output data representative of the monitored person's heart rate, or changes therein, to the data capture module 301. Once again, such data is passed to the decoding module 204, for analysis and identification of any emotionally representative changes in the monitored person's heart rate, and the resultant data is then once again passed to the data matching module 206.

As mentioned above, EEG and other neurological data from the monitored person may be transmitted to the data capture module 301 for subsequent analysis by the decoding module 204, and the location and extent of gaze of the monitored person may also be obtained and passed to the decoding module 204. These concepts are discussed in a different .0 concept, for example, in Bishop, J. (2012). Taming the chatroom Bob:....Proceedings of the 13 th International Conference on Bioinfomatics and Computational Biology (BIOCOMP'12), Las Vegas, NV, in which the emotional states of a subject and, therefore, any abnormal thought processes can be identified by analysis of Neuro-Response Plasticity, serotonergic involvement, dopaminergic flow, and any dopaminergic-serotonergic asynchronicity, and it .5 will be appreciated by a person skilled in the art that a neural implant or headset that detects EEG or other brain activity could be used to capture data for such analysis.

It will be further appreciated that person skilled in the art will be capable of producing computer-implemented versions of the principles described above and in the above mentioned references.

.0 Turning now to the second of the above-mentioned principal aims of the decoding and analysis process in accordance with this exemplary embodiment of the invention, namely the analysis of captured data to identify the existence of content that has the potential to be grossly offensive, indecent, obscene or of a menacing character and that which may cause harassment, alarm, distress or apprehension, reference is made to Bishop, J.(2005). The role of mediating artifacts in the design of persuasive e-learning systems. The 1" International Conference on Internet Technologies and Applications (ITA'05), Wrexham, GB. Pp. 54-62, for example, in which event handling methods, by which a user's key strokes, screen selections and accessed material can be monitored and determined, are referenced and it will once again be appreciated that a person skilled in the art will be capable of producing computer-implemented versions of the principles referenced therein. The concept of providing monitoring software to enable data exchange activity to be monitored for offensive content is known in the art, in relation to many different types of applications, and can be provided within the decoding module 204 in one or more of many different forms which will be known to a person skilled in the art.

The data matching module may be configured to use lookup tables to assign

decoded/analysed data to a set of meanings, and the content of such lookup tables will, to a

large extent, be dependent on the application for which a specific apparatus is configured.

The following description relates to the above-mentioned exemplary embodiment of the

present invention which is configured to enable a parent or carer of a child or vulnerable adult

to remotely and automatically monitor their on-line activity and receive an advisory message

if potentially harmful activity is identified which may, for example, suggest they toggle their

.0 system settings to prevent access to specific content. This advisory aspect of the present

invention is significant, as it enables variation of an automated features, or the customisation

of the system to automatically detect certain words or persons. In systems such as this, there

are a lot of false positives, and aspects of the present invention enable 'tweaking' of the system on an ongoing basis. In an alternative exemplary embodiment, for example in the

.5 case of a drone intercepting enemy communications, a 'fuzzy' look-up table may become a 'crisp' look-up table if the system advises that something has been identified, even if it

cannot determine precisely what it is..

Thus, the data matching module 206 may include, in the form of a lookup table, a list

of banned websites, such as, for example, those indexed by the Internet Watch Foundation or

.0 Internet Content Rating Association. In this case, data representative of a website visited by

a monitored person is compared against the list of banned websites, and if a match is

determined, then the data matching module may be configured to output an advisory

message. Such a message, which may be transmitted wirelessly or otherwise to a device in

the parent or carer's possession, may be in the form of textual information " monitored person is accessing . . website", and/or textual advice:. "...recommend that you block or prevent access by the monitored person to . . website". Additionally, the data matching module may also be configured to cause a screen shot or live stream of the website in

question to be displayed on their device. In extreme cases, it may also be configured to

automatically block the monitored user's access to the website in question.

Another lookup table that may be provided could include a list of files in respect of

which custom meanings have been programmed. Thus, the parent or carer may wish to

prevent access to specific content, not indexed on standard advisory lists, and these could be provided within a lookup table, together with specific actions or advisory messages to be generated in the event that such websites or files are accessed by the monitored person.

In another exemplary embodiment, a lookup table may be provided which can be

considered to be a high level variation of a bozo list or kill list. A bozo list, in known bozo

filter functions, is a list of specific IP addresses from which messages are required to be

blocked. In an exemplary embodiment of the present invention, a similar list of IP addresses

may be provided, against which specific responses are stored in a lookup table. Such

responses may, of course, simply involve blocking communication with a specific IP address,

but in other circumstances, such responses may vary, depending on the nature of the IP

.0 address, the type and nature of communication occurring between the monitored user and a

specified IP address, and, in some cases, emotional context (see below).

In another exemplary embodiment, a lookup table may be provided which contains

indicators of inappropriate behaviour, either in terms of language used in communications,

websites accessed, or other on-line activity, and a match of any of the decoded data to such

.5 indicators could then result in an advisory message being sent to the parent or carer's device, warning them of potentially inappropriate on-line behaviour.

Two exemplary look-up tables for this purpose are illustrated below. In the first of

these tables, different forms of threat extracted from Twitter can be seen. These are coded

according to whether the posts are cyber-trolling and thus not intended to harm, or whether they are cyber-stalking and thus intended to harm. By associating the text avatars of those

posting with their relationship status in respect of the person to whom they are posting, it is

possible to gain a very accurate picture of what was intended. Making use of imputations in

the postings, such as emoticons, can further contextualise the meanings.

The table below presents the data assigned to "I'ddo a lot worse than." The first message, appears to be more of a social complaint about sexual inequality, namely that the

person believes that if he is asked to perform oral sex on someone that he should expect the

sexual intercourse in return. On this basis, whilst it might appear to the uninformed as a rape

threat, it is actually a statement about scruples in a relationship. It could be presented as a

form of duress, that the poster is saying that if he is not given sexual intercourse in return for

oral sex that he will rape the person. This is, however, not the case, making it easy to see how those untrained in forensic linguistics might misinterpret the meaning leading to an unethical use of the law.

Most of the other statements involving "I'd do a lot worse things than" are used to indicate that if the poster didn't take the course of action they are doing, there would be a lot worse things they could do, which are less moderate. The statement, "I'd do a lot worse things than eat a Tesco burger than Orthodox with the tampon girl" is simply saying that the person is confident in their choices and not those of someone else. The statement, "I'd do a lot worse things than I already do if I didn't have friends & family that cared so much" is simply saying that because of the social support afforded to the poster, there are much worse circumstances

.0 they could be in.

Table: Data for 'I'd do a lot worse than'

Identity Intention Magnitude String Tweet Text (Troller) (Relationship) category IF I EAT THE Cyber-stalking PUSSY AN YOU DONT LET ME FUCK IMA DO MORETHAN more than RAPE YOU IMA rape you KILL YOU Vanguard Freethinker "@ayekayesa: Cyber-stalking @CCriadoPerez rape?! I'd do a lot I'd do a lot vorse things than worse rape you!!" You things than are in Vanguard Freethinker @ameerawr Cyber-stalking @barratt249 I'd do a lot worse things than eat a I'd do a lot tesco burger than worse Orthodox with the things than tampon girl Rejector Fan I'd do a lot worse Cyber-trolling things than I already do if I didn't have I'd do a lot friends & family worse that cared so things than much Orthodox Failure I'd do a lot @FonkyChris Cyber-trolling worse course. I'd do a Orthodox Friend things than lot worse things than that @iGetMoorehead Cyber-trolling I'd do a lot I'd do a lot worse worse things than that things than for bacon Stranger Friend I _I

The following lookup table is an exemplary model for examining non-textual bases for behaviour in respect of cyber-stalking, such as cyber-bullying.

Factor De Laat Description Duration The bullying can be occasional and short-lived or it can be Activeness regular and longstanding. Numbers It might be carried out by one bully or by a group of bullies. Motivation Bullying can relate to either Central exercise of some form of power, or of affiliation with others, such as excluding or blaming the victim. Intensity Bullying can range from horseplay to viscous assault. Intentionality Bullying is premeditated and calculated rather than thoughtless or accidental. Nature Bulling can be physical or psychological. In the case of online bullying it is usually psychological, even if it relates to something physical.

Alternatively, or in addition, the monitored person may also receive an advisory message of this nature on their screen. In a similar vein, the lookup table could also include indicators that the monitored user is showing/not showing consideration to others in their on line activity, and similar advisory messages could be triggered as a result of a match being determined.

Of course, some indicators of potentially harmful on-line activity are only indicative of genuinely harmful activity if put into the right emotional context. For example, an intense set of one-to-one communications between the monitored person and a remote third party may be potentially harmful, in the form of bullying or arguing, or it may not be harmful - it is only possible to determine which if the communications are put into emotional context.

Equally, the phrase "I am going to kill you", is often said in jest, or it may be meant in its literal form. Again, the only way to tell the difference is to put the phrase into the correct

emotional context. Thus, a lookup table may be provided that may be employed if potentially

harmful communications are identified, and can be used to match affective data indicative of

the monitored user's emotional state. Thus, in the former case, where an intense set of one to-one communications has been identified, heart rate data (for example) may be matched

against an appropriate lookup table and, only if the monitored person's heart rate is deemed to be increased as well will the apparatus be triggered to output an advisory message and

display the conversation stream to the parent or carer. If the monitored person's heart rate is .0 not deemed to be increased or, indeed, is deemed to be decreased, it is indicative that the

monitored person is satisfied or happy, and it is likely that the communication stream is not

causing them distress, such that no advisory action needs to be taken. In relation to the

potential facility of the monitoring device to assess a user's risk from cyber-stalkers such as sex predators, the data capture and processing functions of the device could, for example,

.5 include sending a 'ping' to an IP address from which one or more data packets are being received so as to determine the geographical distance of the sender from the monitored

person. Such processing may alternatively, or in addition, comprise determining from the

senders IP address whether or not they are on the same telephone exchange or otherwise

within a predetermined geographical proximity to the monitored person.

.0 This, in accordance with an exemplary embodiment of the invention, the meanings of

the captured and analysed data may be converted (via data matching and lookup tables) into a

recommended response by a response generating module 208. The response may, for

example, involve an instruction to the monitored user's computing device 300 to replace text or other artefacts being displayed to the user with other text which may be more appropriate

to the age, ability, language, learning style, tolerance to harmful and offensive material, risk

of adverse human interaction, or interests of the monitored person. The response may

comprise an instruction to the computing device 300 of the monitored person to change the

user interface of the application they are using to one more appropriate so as to, for example,

resolve low-level data overload or modify menus and other screen objects to include, for

example, language which is easier to understand or to increase accessibility.

Other possible responses include:

• A recommendation or instruction relating to helping the monitored person or

at least one other person overcome poor sensory data, intermittent data and

time lags, which may otherwise result in unwanted emotions or behaviour;

• A recommendation or instruction relating to reducing the difficulty or

complexity of tasks that may otherwise result in unwanted emotions or

behaviour;

• Recommendations or instructions relating to facilitating greater interactions

between the monitored person and at least one other person;

• Recommendations or instructions in order to facilitate the autonomy of the

.0 monitored person, such as adjusting settings or intervening immediately in

relation to self-directed learning or greater awareness of their surroundings;

• An instruction relating to the monitored person's computing device to

introduce a gaming element, such as 'icebreakers' in a learning context;

• An instruction relating to the removal of access to specific profiles on social

.5 networking services, including removing them from search results;

• Notification of at least one other person about the data matched and meaning

generated;

• Notification of at least one other person of the progress being made by the

monitored person in at least one activity;

• An instruction relating to the blocking of a user accessing a specific website or

chatting with at least one other person, such as in relation to a buddy list;

• An instruction relating to the augmentation of the reality of the monitored

person so they are not exposed to inappropriate materials. This may include

the insertion of one or more interface cues, or even the introduction of non

user characters which can present as if they are actual users;

• The recommendation to at least one other person relating to discontinuing the

monitored person's use of a device such as a hoverboard or software such as

web browser, such as because they feel tired, have used the a Internet for a

specific period of time, or otherwise need 'time out';

• An instruction relating to the application of a disincentive to a person

experiencing inappropriate emotions or behaviours, which would include

adjusting a reputation system;

Furthermore, the response may be supported by the translation of jargon, abbreviations, idioms, aphorisms, text-speak or child-speak into that which a least one other

person is able to understand; and/or by the naming of the particular affect present in the

facial, dialogue, prosody, appearance or relationship status. Furthermore, and as previously

stated, the response may be supported by audio, video or text showing the at least one other

person the detected activities of the monitored person.

.0 In other exemplary embodiments, the response may involve a recommendation that at

least one other person contact law enforcement authorities. The response may include a

recommendation to report a given message to the website, program or app being accessed,

and it may also involve the automatic completion of a form to submit to that website,

program or app. The response may include an instruction to block the account of at least one

.5 other person in order to prevent harmful or offensive materials being sent to the monitored

person.

It will be appreciated, therefore, that the present invention is capable of providing a

more complex and discriminatory solution than conventional, software-based "accessware",

that runs through operating systems alone, in order to authorise certain specified content and

.0 ensure privacy.

In another exemplary embodiment, where the monitored person may be a student

engaging in a serious game, whereby they have to simulate a real-world practice, embodiments of the invention might provide immediate feedback on the success or otherwise

of their actions, or even "feedforward", suggesting what they might do better next time. The system may also make the monitored activity more realistic, such as, as a result of the

existence of imperfect information or where a non-deterministic game would provide greater

authenticity.

In some exemplary embodiments, the store of suitable response data may include data

that has been provided by, or created with the assistance of, at least one other user. The

potential triggers identified in the analysed data for generating a response may also include

data that has been provided by, or created with the assistance of, at least one other user.

Either or both sets of data may be updated on an ongoing basis, as more potential threats, for example, become known and identifiable. At least portions of the database of meanings could be generated by means of a crowdsourcing function, and the above-mentioned ongoing updating facility may also be effected by crowdsourcing. An exemplary table of such triggers is illustrated below, which can be cross-referenced against police incident recording codes, such as for automatic referral to the police, analogous to the function one might have if a fire alarm goes off and the fire service is notified automatically as a result.

Harassment Harassment (8L), Harassment is where someone (A) Racially or religiously experiences apprehension in that aggravated harassment they feel like they are going to (8M), Cruelty to suffer a detriment through the Children/Young Persons actions of another person (B) who (11A), Other criminal knows or ought to know they would damage: £20 or under react that way. (85), over £20 (86). Stalking Stalking (8Q), Stalking is where someone (A) is voyeurism (88E) monitored by another person (B) in a way that B knows or ought to know that person would be aware of and cause them apprehension. Grooming and Sexual grooming (88A), Grooming and sexual exploitation sexual Soliciting for the refers to the where a person (A) exploitation purpose of prostitution takes advantage of the sexual (27), Kidnapping (36), naiveties of another person (B) Abuse of children for the sexual or other advantage through Sexual of A and usually to B's Exploitation (71), disadvantage. Abuse of position of trust of a sexual nature (73), Sexual activity etc. with a person with a mental disorder (70), Cruelty to Children/Young Persons (11A), Aiding Aiding suicide (76), Aiding suicide is where a person Suicide Cruelty to (A) encourages another person (B) Children/Young Persons to engage of thoughts of suicide (11A) and often to attempt it. Non- Obscene publications Porn revenge is where a person consensual etc (86), Exposure discloses a private sexual porn (88E), Causing sexual photograph or film if the activity without disclosure is made without the consent (22A), Other consent of an individual who miscellaneous sexual appears in the photograph or offences (88C) film, and that it is made with the intention of causing that individual distress.

The apparatus may include the facility for capturing the actual response by the at least

one other person (e.g. the parent or carer), or indeed the monitored person, depending on what response was triggered from the data matching module. This facility may be provided in the same way, and by means of the same data capture module, as that used to capture the on-line activity and affective data.

Of course, in the case where the response is a recommendation or even an instruction

to, say, a parent or carer, or to the monitored person, that person may not act on it. In this

case, the apparatus may be configured to generate a message intended to persuade them to do

so. Such a message may alternatively be, or accompanied by, the conveying of impulses

through an EEG headband or other means of instruction to remove or control demotivating

cognitive artefacts, as proposed in, for example, the Bishop, J. (2012) referenced above. In

.0 addition, or alternatively, the manner of persuasion may comprise the posting of a

notification on a social networking service, or the disabling of a device or a 'sin binning'

function being employed by the at least one other person. In yet another exemplary

embodiment, the method of persuasion may involve directing the at least one other person to

communicate a message to the monitored person via an avatar such as an animated

.5 pedagogical agent, such as for guidance and mentoring. Still further, the method of

persuasion may involve a warning message to the at least one other person that certain

authorities will be notified.

Although illustrative embodiments of the invention are described in detail herein with

reference to the accompanying drawings, it is to be understood that the invention is not limited to these precise embodiments.

Furthermore, it is contemplated that a particular feature described either individually

or as part of an embodiment can be combined with other individually described features, or

parts of embodiments, even if the other features and embodiments make no mention of the

particular feature. Thus, the invention extends to such specific combinations not already

described.

Still further, it will be apparent to a person skilled in the art from the foregoing

description, that modifications and variations can be made to the described embodiments

without departing from the scope of the invention, as claimed. For example, the monitoring

device may include means for protecting the monitored person's privacy and ensuring local control. Accordingly, the device may include a module configured to perform significant

encryption on the data flow between the monitored person's computing device and the router so as to prevent interception by a third party. A module may alternatively or in addition be provided the change collected information to a more secure version, such that, for example, different registration data may be sent to a website to that which the user has entered. In this case, the registration requirements and details will appear 'normal' to the monitored user, when they log on to the website, but the details actually sent each time are changed, encrypted or otherwise more secure. Still further, the monitoring device may have a function whereby it is able to insert additional unseen or alternative data into packets of data so as to deceive as to its contents by other persons or monitoring technologies. For example, if a potential cyber-stalker requests certain information from the monitored person, even if the monitored person sends genuine such information back, the information received by the

.0 requestor will be false due to a change or addition of data effected by the monitoring device.

This function may also be enabled in the event that the monitored person is determined to be

sending data (or certain types of data) over an unsecured wi-fi connection, such that an

interceptor would be rendered uncertain as to what data had actually been sent.

The term "comprise" and variants of that term such as "comprises" or "comprising" .5 are used herein to denote the inclusion of a stated integer or integers but not to exclude any

other integer or any other integers, unless in the context or usage an exclusive interpretation

of the term is required.

Reference to prior art disclosures in this specification is not an admission that the

disclosures constitute common general knowledge.

.0

Claims (5)

1. A computer-implemented apparatus configured for use within a data exchange path between at least one sending device and at least one receiving device, wherein at least one of said sending device or receiving device comprises a computer device; the apparatus comprising: - a data capture module for capturing data being exchanged between said sending device and said receiving device; - a decoding module for analysing said captured data to identify one or more .0 indicators of a predetermined data content type, wherein the decoding module is configured to identify encrypted or unreadable data within said data captured by said data capture module; and - a data matching module for matching said indicators with a preconfigured database of meanings and generating response data corresponding to one or more .5 meanings determined to match said one or more indicators; - a response generating module configured to generate a response in the event that unreadable or encrypted data is identified; - an output module configured to transmit an alert or message including data representative of a recommended action, wherein the apparatus is further .0 configured to determine if said recommended action is or has been taken.

2. Apparatus according to claim 1, wherein said data captured by said data capture module comprises one or more of: - audio, image and/or video data; - text and attachments from online chats, text messaging and instant messaging conducted by a user and at least one remote third party via said sending or receiving device; - any search queries made by a user on said sending or receiving device; - the contents of emails sent and received via said sending or receiving device; - data representative of programs or apps being accessed by a user on said sending or receiving device; - the username and password used by a user of said sending or receiving device to access a specific website, and data representative of the identity of that website;

- the contact list of a specified user of said sending or receiving device; - data representative of the key strokes or screen selections being made by a user on said sending or receiving device; - data representative of websites being accessed via said sending or receiving device and actions being performed in relation thereto; - data representative of the length of time spent on the internet by a specified user; - data representative of interests or preferences of a specified user of said sending or receiving device; - data representative of the geographic location of a user and/or one or more remote .0 third parties with whom they are communicating via said sending or receiving device; - data representative of commands being performed within a specified piece of software running on said sending or receiving device; - data representative of the intensity of interaction between a user of at least one sending device and a user of at least one receiving device; .5 - data representative of the identity of at least one user of at least one sending device and/or at least one user of at least one receiving device, or, wherein said data captured by said data capture module comprises one or more of: - webcam, microphone and/or heart rate monitor output data in respect of a user of said computing device; .0 - EEG or other neurological data from a user of said computing device; - data representative of the location and/or extent of a user's gaze of said computing device.

3. A computer-implemented method for monitoring a user's on-line activity between at least one sending device and at least one receiving device, wherein at least one of said sending or receiving device comprises a computer device, the method comprising: - capturing, by means of a computer-implemented data capture module, user initiated data being exchanged between said sending and receiving devices; - using a computer-implemented decoding module to analyse said captured data to identify one or more indicators of a predetermined data content type; and matching, using a computer-implemented data matching module, said indicators with a preconfigured database of meanings and generating thereby response data corresponding to one or more meanings determined to match said one or more indicators, wherein said decoding module further analyses said captured data for indicia of encrypted or unreadable data within said data captured by said data capture module, and in the event that unreadable or encrypted data is identified, said decoding module generates response data corresponding to the fact that unreadable or encrypted data has been identified.

4. A method according to claim 3, wherein said data captured by said data capture module comprises one or more of: - audio, image and/or video data; .0 - text and attachments from online chats, text messaging and instant messaging conducted by a user and at least one remote third party via said sending or receiving device; - any search queries made by a user on said sending or receiving device; - the contents of emails sent and received via said sending or receiving device; .5 - data representative of programs or apps being accessed by a user on said sending or receiving device; - the username and password used by a user of said sending or receiving device to access a specific website, and data representative of the identity of that website; - the contact list of a specified user of said sending or receiving device; .0 - data representative of the key strokes or screen selections being made by a user on said sending or receiving device; - data representative of websites being accessed via said sending or receiving device and actions being performed in relation thereto; - data representative of the length of time spent on the internet by a specified user; - data representative of interests or preferences of a specified user of said sending or receiving device; - data representative of the geographic location of a user and/or one or more remote third parties with whom they are communicating via said sending or receiving device; - data representative of commands being performed within a specified piece of software running on said sending or receiving device; - data representative of the intensity of interaction between a user of at least one sending device and a user of at least one receiving device; - data representative of the identity of at least one user of at least one sending device and/or at least one user of at least one receiving device, or wherein said data captured by said data capture module comprises one or more of: - webcam, microphone and/or heart rate monitor output data in respect of a user of said computing device; - EEG or other neurological data from a user of said computing device; - data representative of the location and/or extent of a user of said computing device.

5. A method according to claim 3 or 4, comprising the step of analysing, using said computer-implemented decoding module, captured data to identify the existence .0 therein of a predetermined one or more content types that is/are potentially grossly offensive, indecent, obscene or of a menacing character and/or that which may cause harassment, alarm, distress or apprehension, and/or the method comprising using said computer implemented decoding module to extract from said captured data information about the emotional state(s) of a user of at least one receiving device or a .5 user of at least one sending device and/or using an output module to transmit an alert or message to a remote third party, and/or further comprising using said output module to transmit to a remote third party device, data representative of activity by a user of a sending device or a user of a receiving device that corresponds to said one or more indicators, for display on said remote third party .0 device, and/or wherein said indicators includes data representative of a recommended action and, further comprising determining if said recommended action is or has been taken, and further comprising generating and transmitting a further message or alert in the event that it is determined that said recommended action has not been taken within a predetermined period of time.

2016102476 04 Feb 2016

2016102476 04 Feb 2016