US 12,592,963 B2Granted

Detection device, detection method, and detection program

AssigneeNTT, Inc.

InventorsHiroki Nakano, Daiki Chiba

Life of this patent

Estimating the term…

Loading patent…

Abstract

A detection device includes processing circuitry configured to acquire user generated content generated in each service in a predetermined period, generate a search query using words appearing in the user generated content for each service, collect the user generated content generated in a plurality of services using the generated search query, calculate a feature amount of the collected user generated content of a predetermined service, perform learning using the feature amount of the user generated content generated by a normal user and a feature amount of content generated by a malicious user, determine whether the user generated content is generated by a malicious user based on a learned model, and access an entrance URL described in the user generated content and output a feature of an attack of the user generated content as threat information when the user generated content is determined to be generated by a malicious user.

Claims6

Dependent claims

A detection device, comprising:

processing circuitry configured to:
obtain user generated texts generated in an online service in a predetermined period;
extract a key phrase from the user generated texts, wherein the key phrase is a phrase representing a similar context that the user generated texts have;
generate a search query using words appearing in the key phrase;
calculate a degree of malignancy of the generated search query;
determine whether the degree of malignancy satisfies a threshold;
in response to a determination that the degree of malignancy satisfies the threshold, select the generated search query as a query for searching user generated texts generated by a malicious user;
collect, using the selected search query, user generated texts generated by the malicious user in another online service;
calculate features of the user generated texts generated by the malicious user;
calculate features of user generated texts generated by normal users in the other online service;
train a model using (i) the features of the user generated texts generated by the normal users and (ii) the features of the user generated texts generated by the malicious user;
determine whether a particular user generated text is generated by the malicious user based on the trained model;
and
in response to a determination that the particular user generated text is generated by the malicious user:
access an entrance URL described in the particular user generated text;
and
output a feature of an attack of the particular user generated text as threat information.

14 more elements

Dependencies are inferred from the claim text.

Facts

Application: 18/031,616Filed 14 Oct 2020
Published: US 2023/0379359 A123 Nov 2023
Granted: 31 Mar 2026
Term ends: Not estimatedThe source records don’t support an estimate.

Classification7 codes

G06F 16/9566
Using information identifiers, e.g. uniform resource locators [URL]: uRL specific, e.g. using aliases, detecting broken or misspelled links
H04L 63/1483
Countermeasures against malicious traffic: service impersonation, e.g. phishing, pharming or web spoofing
G06F 21/51
Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems: at application…
G06F 21/554
Detecting local intrusion or implementing counter-measures: involving event detection and direct action