An extraction apparatus includes processing circuitry configured to receive an input of information about a plurality of web pages including a hypertext markup language (HTML) element that is known to reach a malicious web page through browser operation and an HTML element that is known to reach a benign web page through browser operation, classify the plurality of web pages whose input is received into clusters, extract an HTML element that reaches the malicious web page and an HTML element that reaches the benign web page from a web page of each cluster that is classified to extract a first character string included in HTML elements that are extracted, and extract, as a keyword, a second character string that characterizes the HTML element that reaches the malicious web page from the first character string.