Granted Patent B2

US 12,536,279 · App. 18/031,624 · Granted Jan 27, 2026

Inventors: Hiroki Nakano (Musashino, JP); Daiki Chiba (Musashino, JP)

Assignee: NTT, Inc.

G06F21/554G06F16/9566H04L63/1483

Abstract

Claims (28)

1 . An extraction device comprising:

processing circuitry configured to:

access an entrance uniform resource locator (URL) described in first user-generated content generated by a user in a plurality of services in a predetermined period to extract a first feature quantity of first the user-generated content;

perform training on a model by using a second feature quantity extracted from second user-generated content generated by a normal user and a third feature quantity of third user-generated content generated by a malicious user; and

determine, in real time, whether or not the first user-generated content has been generated by the malicious user using the model after training,

wherein the first, second, and third feature quantities include a text feature quantity and a group feature quantity, and

the group feature quantity represents a degree of similarity among a group of words in user-generated content.

2 . The extraction device according to claim 1 , wherein the first, second, and third feature include quantities a feature quantity regarding Web content of a reached Web site, and a feature quantity regarding a plurality of pieces of the user-generated content generated in a predetermined period.

3 . The extraction device according to claim 1 ,

wherein the processing circuitry is further configured to output a feature of an attack of the first user-generated content as threat information when the first user-generated content is determined to be generated by the malicious user.

4 . The extraction device according to claim 1 , wherein the text feature quantity represents a combination of words co-occurring in user-generated content.

5 . The extraction device according to claim 1 , wherein at least the first user-generated content generated by the user is streaming content generated in real time.

6 . An extraction method executed by an extraction device, the extraction method comprising:

accessing an entrance uniform resource locator (URL) described in first user-generated content generated by a user in a plurality of services in a predetermined period to extract a first feature quantity of the first user-generated content;

performing training on a model by using a second feature quantity extracted from second user-generated content generated by a normal user and a third feature quantity extracted from third user-generated content generated by a malicious user; and

determining, in real time, whether or not the first user-generated content has been generated by the malicious user using the model after training,

wherein the first, second, and third feature quantities include a text feature quantity and a group feature quantity, and

the group feature quantity represents a degree of similarity among a group of words in user-generated content.

7 . The extraction method according to claim 6 , wherein the text feature quantity represents a combination of words co-occurring in user-generated content.

8 . The extraction method according to claim 6 , wherein at least the first user-generated content generated by the user is streaming content generated in real time.

9 . A non-transitory computer-readable recording medium storing therein an extraction program that causes a computer to execute a process comprising:

accessing an entrance uniform resource locator (URL) described in first user-generated content generated by a user in a plurality of services in a predetermined period to extract a first feature quantity of the first user-generated content;

performing training on a model by using a second feature quantity extracted from second user-generated content generated by a normal user and a third feature quantity extracted from third user-generated content generated by a malicious user; and

determining, in real time, whether or not the first user-generated content has been generated by the malicious user using the model after training,

wherein the first, second, and third feature quantities include a text feature quantity and a group feature quantity, and

the group feature quantity represents a degree of similarity among a group of words in user-generated content.

10 . The non-transitory computer-readable recording medium according to claim 9 , wherein the text feature quantity represents a combination of words co-occurring in user-generated content.

11 . The non-transitory computer-readable recording medium according to claim 9 , wherein at least the first user-generated content generated by the user is streaming content generated in real time.

Assignments (2)

Continuity (1)

References Cited (32)