User-Generated Content Detection for Real-Time Malicious Site Screening
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing detection techniques for malicious sites are insufficient in terms of detection accuracy, speed, and range, particularly in handling social engineering attacks that exploit user-generated content.
Innovation Solution
A detection device that collects and analyzes user-generated content using a combination of collection, determination, and extraction functions to identify malicious content by learning characteristic differences between legitimate and attacker-generated content, and extracts threat information for real-time detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If characteristic amounts are designed based on service-specific features, then detection accuracy for that service improves, but detection range for various attacks becomes insufficient
Solution Approach 1:
The patent implements a multi-stage detection system that combines service-specific detection (first determination unit) with cross-service pattern detection (second determination unit). This allows the system to maintain high accuracy for specific services while also detecting various attack patterns across different services, resolving the contradiction between specialized accuracy and general detection range.
Solution Approach 2:
The detection system is divided into multiple independent determination units, each handling different aspects of malicious content detection. The first determination unit handles service-specific characteristics while the second handles cross-service patterns, allowing each segment to optimize for its specific function while contributing to overall detection capability.
2Measurement precision
If all URLs are accessed for analysis, then detection accuracy improves, but detection speed becomes insufficient
Solution Approach 1:
The system performs partial analysis by first evaluating metadata and characteristic amounts without accessing the full URL content. Only URLs that pass the initial screening undergo deeper analysis, reducing the overall number of full accesses needed while maintaining detection accuracy for malicious content.
Solution Approach 2:
The system performs preliminary detection using metadata and characteristic amounts before accessing URL content. This preliminary action filters out obviously benign URLs, allowing the system to maintain high detection accuracy while significantly improving speed by avoiding full analysis of all URLs.
3Adaptability or versatility
If detection techniques are expanded to cover more services, then detection range improves, but detection accuracy and speed become insufficient
Solution Approach 1:
The second determination unit detects attack patterns that are common across multiple services, enabling the system to maintain high detection accuracy even when expanding to cover more services. This cross-service pattern recognition allows the system to generalize effectively without sacrificing precision.
4Speed
If real-time detection is implemented for user-generated content, then detection speed improves, but detection accuracy becomes insufficient
Solution Approach 1:
The system performs preliminary detection using metadata and characteristic amounts in real-time, providing fast initial results. This preliminary action enables real-time detection speed while maintaining accuracy through subsequent verification stages for suspicious content.
Solution Approach 2:
The system uses feedback from the first determination unit to guide the second determination unit's analysis. This feedback mechanism allows real-time detection by prioritizing resources on suspicious content while maintaining overall detection accuracy through iterative refinement of detection results.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A calculation unit (15d) calculates a characteristic amount of user-generated content generated by a user in a predetermined period. A learning unit (15e) performs learning using the calculated characteristic amount of the user-generated content generated by a legitimate user and a characteristic amount of content generated by a malicious user. A determination unit (15f) determines whether the user-generated content is generated by the malicious user using a learned model.