Detection device, detection method, and detection program
A detection device includes processing circuitry configured to acquire user generated content generated in each service in a predetermined period, generate a search query using words appearing in the user generated content for each service, collect the user generated content generated in a plurality of services using the generated search query, calculate a feature amount of the collected user generated content of a predetermined service, perform learning using the feature amount of the user generated content generated by a normal user and a feature amount of content generated by a malicious user, determine whether the user generated content is generated by a malicious user based on a learned model, and access an entrance URL described in the user generated content and output a feature of an attack of the user generated content as threat information when the user generated content is determined to be generated by a malicious user.
1 . A detection device, comprising:
processing circuitry configured to:
obtain user generated texts generated in an online service in a predetermined period;
extract a key phrase from the user generated texts, wherein the key phrase is a phrase representing a similar context that the user generated texts have;
generate a search query using words appearing in the key phrase;
calculate a degree of malignancy of the generated search query;
determine whether the degree of malignancy satisfies a threshold;
in response to a determination that the degree of malignancy satisfies the threshold, select the generated search query as a query for searching user generated texts generated by a malicious user;
collect, using the selected search query, user generated texts generated by the malicious user in another online service;
calculate features of the user generated texts generated by the malicious user;
calculate features of user generated texts generated by normal users in the other online service;
train a model using (i) the features of the user generated texts generated by the normal users and (ii) the features of the user generated texts generated by the malicious user;
determine whether a particular user generated text is generated by the malicious user based on the trained model; and
in response to a determination that the particular user generated text is generated by the malicious user:
access an entrance URL described in the particular user generated text; and
output a feature of an attack of the particular user generated text as threat information.
2 . The detection device according to claim 1 , wherein the processing circuitry is further configured to select a search query that may become malicious for each service.
3 . The detection device according to claim 1 , wherein the features of the user generated texts generated by the malicious user and the features of the user generated texts generated by the normal users include:
a text feature representing a combination of words co-occurring in a plurality of pieces of user generated content, and
a group feature related to similarity of words between the plurality of pieces of user generated content generated in a predetermined period.
4 . The detection device according to claim 1 , wherein the features of the user generated texts generated by the malicious user and the features of the user generated texts generated by the normal users include:
a feature related to Web content of an arrival web site at which a user will arrive, and
features related to a plurality of pieces of user generated content generated in a predetermined period.
5 . A detection method which is executed by a detection device, the detection method comprising:
obtaining user generated texts generated in an online service in a predetermined period;
extracting a key phrase from the user generated texts, wherein the key phrase is a phrase representing a similar context that the user generated texts have;
generating a search query using words appearing in the key phrase;
calculating a degree of malignancy of the generated search query;
determining whether the degree of malignancy satisfies a threshold;
in response to a determination that the degree of malignancy satisfies the threshold, selecting the generated search query as a query for searching user generated texts generated by a malicious user;
collecting, using the selected search query, user generated texts generated by the malicious user in another online service;
calculating features of the user generated texts generated by the malicious user;
calculating features of user generated texts generated by normal users in the other online service;
training a model using (i) the features of the user generated texts generated by the normal users and (ii) the features of the user generated texts generated by the malicious user;
determining whether a particular user generated text is generated by the malicious user based on the trained model; and
in response to a determination that the particular user generated text is generated by the malicious user:
accessing an entrance URL described in the particular user generated text; and
outputting a feature of an attack of the particular user generated text as threat information.
6 . A non-transitory computer-readable recording medium storing therein a detection program that causes a computer to execute a process comprising:
obtaining user generated texts generated in an online service in a predetermined period;
extracting a key phrase from the user generated texts, wherein the key phrase is a phrase representing a similar context that the user generated texts have;
generating a search query using words appearing in the key phrase;
calculating a degree of malignancy of the generated search query;
determining whether the degree of malignancy satisfies a threshold;
in response to a determination that the degree of malignancy satisfies the threshold, selecting the generated search query as a query for searching user generated texts generated by a malicious user;
collecting, using the selected search query, user generated texts generated by the malicious user in another online service;
calculating features of the user generated texts generated by the malicious user;
calculating features of user generated texts generated by normal users in the other online service;
training a model using (i) the features of the user generated texts generated by the normal users and (ii) the features of the user generated texts generated by the malicious user;
determining whether a particular user generated text is generated by the malicious user based on the trained model; and
in response to a determination that the particular user generated text is generated by the malicious user:
accessing an entrance URL described in the particular user generated text; and
outputting a feature of an attack of the particular user generated text as threat information.