User-Generated Content Extraction for Real-Time Malicious Site Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing detection technologies for malicious Web sites are limited in scope and lack the speed and accuracy needed to handle large volumes of user-generated content generated in real time, particularly during events, making them ineffective in wide-area detection.
Innovation Solution
A detection device that collects and analyzes user-generated content using search queries generated from key phrases, trains on feature differences between attacker and normal user content, and performs real-time malignancy determination and extraction of threat information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If specialized feature amounts for false live stream site fraud are used, then detection accuracy for specific fraud types is improved, but detection range is limited
Solution Approach 1:
The detection device uses a unified detection mechanism that can handle multiple types of fraudulent content (live stream sites, blog articles, social media posts) through a single system. The system extracts feature amounts from various content types and uses a common detection algorithm, allowing one system to perform multiple detection functions across different platforms and content formats.
Solution Approach 2:
The system dynamically adjusts detection parameters based on the type of content being analyzed. It extracts different feature amounts appropriate for each content type (e.g., URL repetition patterns for social media, article similarity for blogs, site structure for live stream sites) while using a unified detection framework, thereby adapting to different fraud patterns without limiting the detection range.
2Adaptability or versatility
If analysis of large volumes of user-generated content is performed, then detection coverage is improved, but processing speed decreases
Solution Approach 1:
The system extracts only the essential feature amounts from user-generated content that are most indicative of fraud. Instead of analyzing entire articles or posts, it extracts key features such as URL repetition patterns, article similarity metrics, and metadata characteristics. This selective extraction maintains comprehensive detection coverage while significantly reducing processing time.
Solution Approach 2:
The detection process is divided into separate modules: content collection, feature extraction, and detection determination. Each module handles specific tasks independently, allowing parallel processing of multiple content items. The feature extraction module processes content in segments, identifying suspicious patterns without requiring complete analysis of entire content volumes, thereby improving processing speed while maintaining detection effectiveness.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An extraction unit (15g) accesses an entrance URL described in user-generated content generated by a user in a plurality of services in a predetermined period to extract a feature quantity of the user-generated content. The training unit (15e) performs training by using the extracted feature quantity of the user-generated content generated by a normal user and a feature quantity of content generated by a malicious user. A determination unit (15f) determines whether or not the user-generated content has been generated by the malicious user using a trained model.