Determination device, determination method, and determination program
A determination device includes processing circuitry configured to calculate a characteristic amount of user-generated content generated by a user in a predetermined period, perform learning by using the calculated characteristic amount of the user-generated content generated by a legitimate user and a characteristic amount of content generated by a malicious user, and determine whether the user-generated content is generated by the malicious user using a learned model.
1. A determination device, comprising: processing circuitry configured to: calculate (i) first features of user-generated texts generated by legitimate users in a predetermined period and (ii) second features of user generated texts generated by a malicious user in the predetermined time period, the first and second features including (a) text features which represent characteristics of a combination of words co-occurring in a plurality of user-generated texts and (b) group features which represent a characteristic relating to word similarity between a plurality of user-generated texts generated in the predetermined period; train a model using the calculated first and second; and determine a particular user-generated text is generated by the malicious user using the trained model.
2. The determination device according to claim 1 , wherein the group features include any one or more of a size of a set, a number of users in the set, a number of unique URLs described in the set, an average number of URLs described in the user-generated content in the set, or an average posting time interval in the set.
3. A determination method performed by a determination device, comprising: calculating (i) first features of user-generated texts generated by legitimate users in a predetermined period and (ii) second features of user generated texts generated by a malicious user in the predetermined time period, the first and second features including (a) text features which represent characteristics of a combination of words co-occurring in a plurality of user-generated texts and (b) group features which represent a characteristic relating to word similarity between a plurality of user-generated texts generated in the predetermined period; training a model using the calculated first and second features; and determining a particular user-generated text is generated by the malicious user using the trained model.
4. A non-transitory computer-readable recording medium storing therein a determination program that causes a computer to execute a process comprising: calculate (i) first features of user-generated texts generated by legitimate users in a predetermined period and (ii) second features of user generated texts generated by a malicious user in the predetermined time period, the first and second features including (a) text features which represent characteristics of a combination of words co-occurring in a plurality of user-generated texts and (b) group features which represent a characteristic relating to word similarity between a plurality of user-generated texts generated in the predetermined period; train a model using the calculated first and second features; and determine a particular user-generated text is generated by the malicious user using the trained model.
5. The determination device according to claim 1 , wherein the processing circuitry is further configured to: access a URL described in the user-generated texts; and extract features relating to web content of a website reached via the accessed URL, the features extracted being used in training the model.
6. The determination device according to claim 1 , wherein the processing circuitry is further configured to: generate a search query using words appearing in the user-generated texts; and collect user-generated content from a plurality of services using the search query, the collected user-generated content being used to calculate the first and second features.
7. The determination device according to claim 1 , wherein the processing circuitry is further configured to: output attack features of the particular user-generated text as threat information when the particular user-generated text is determined to be generated by the malicious user.
8. The determination device according to claim 1 , wherein the group features include a characteristic amount representing a size of a set of user-generated texts grouped based on a time threshold value and a similarity threshold value.
9. The determination device according to claim 1 , wherein the group features include a characteristic amount representing a posting time of the plurality of user-generated texts generated in the predetermined period.
10. The determination device according to claim 1 , wherein to calculate the text features, the processing circuitry is further configured to: segment words of a URL and text within the user-generated texts; generate word embeddings for the segmented words; and average the word embeddings to represent the text features.