A method and system for identifying abnormal websites

Abstract

This invention relates to the field of internet technology, and in particular to an abnormal website identification method and system. The method compares an initial website with a first cluster center website based on website information to determine the first clustering result, achieving a preliminary classification of the initial website. Then, it determines a second cluster center website by combining the initial website and the seed website corresponding to each seed website cluster set. The change in cluster centers after adding the initial website is measured based on the distance between the first and second cluster center websites, characterizing the clustering effect of the seed website cluster sets. When the distance between the center websites exceeds a first distance threshold, the clustering structure is optimized to obtain a third cluster center website and a target cluster set. This allows the target cluster set to better adapt to the characteristics of the websites, thereby re-clustering the initial website based on the target cluster set, improving the accuracy of the second clustering result, and thus improving the accuracy of abnormal website identification.

Description

Technical Field

[0001] This invention relates to the field of Internet technology, and in particular to a method and system for identifying abnormal websites. Background Technology

[0002] Websites spreading malicious software and containing illegal content pose a serious threat to cybersecurity and user rights. Existing methods for identifying abnormal websites involve clustering them based on known characteristics, then combining this clustering with the similarity between the clusters and the website to be identified to determine anomalies. However, current website clustering typically relies on static strategies, failing to dynamically adjust cluster centers and structures based on website characteristics. This leads to inaccurate clustering results when website traffic or attributes change, as the fixed cluster centers struggle to adapt to new data distributions, thus reducing the accuracy of anomaly identification.

[0003] Therefore, improving the accuracy of identifying abnormal websites has become an urgent problem to be solved. Summary of the Invention

[0004] To address the aforementioned technical problems, the present invention provides a method for identifying abnormal websites, which includes the following steps:

[0005] S1. Based on the website information corresponding to each initial website to be identified within a preset time period and the website information corresponding to the first cluster center website of each seed website cluster set, determine the first clustering result corresponding to each initial website. The first clustering result includes the corresponding assigned seed website cluster set and the seed website cluster set not assigned to the seed website cluster set. The seed website cluster set includes several seed websites used to characterize abnormal websites.

[0006] S2: Based on the first clustering result corresponding to each initial website, obtain all initial websites corresponding to each seed website cluster set.

[0007] S3: For any seed website cluster set, obtain the second cluster center website corresponding to the current seed website cluster set based on all initial websites and all seed websites corresponding to the current seed website cluster set.

[0008] S4. Based on the website information of the first cluster center website and the second cluster center website corresponding to the current seed website cluster set, obtain the distance between the center websites corresponding to the current seed website cluster set.

[0009] S5. If the distance to the central website corresponding to the current seed website cluster set is greater than the preset first distance threshold, then based on the website information corresponding to all seed websites, the first cluster center website, and the second cluster center website corresponding to the current seed website cluster set, the third cluster center website and the target cluster set corresponding to the current seed website cluster set are obtained.

[0010] S6. Based on the website information corresponding to each initial website to be identified and the website information corresponding to each third cluster center website, determine the second clustering result corresponding to each initial website. The second clustering result includes the target cluster set to be assigned and the set not assigned to the target cluster set.

[0011] S7. For any initial website, if the second clustering result corresponding to the current initial website is the corresponding assigned target cluster set, then the current initial website is determined to be an abnormal website.

[0012] The present invention also provides an abnormal website identification system, which includes:

[0013] The first website clustering module is used to determine the first clustering result for each initial website based on the website information corresponding to each initial website to be identified within a preset time period and the website information corresponding to the first cluster center website of each seed website cluster set. The first clustering result includes the corresponding assigned seed website cluster set and the seed website cluster set not assigned to the seed website cluster set. The seed website cluster set includes several seed websites used to characterize abnormal websites.

[0014] The cluster set analysis module is used to obtain all the initial websites corresponding to each seed website cluster set based on the first cluster result corresponding to each initial website.

[0015] The second cluster center acquisition module is used to obtain the second cluster center website corresponding to any seed website cluster set based on all initial websites and all seed websites corresponding to the current seed website cluster set.

[0016] The central website distance acquisition module is used to obtain the central website distance corresponding to the current seed website cluster set based on the website information of the first cluster central website and the website information of the second cluster central website corresponding to the current seed website cluster set.

[0017] The target cluster set acquisition module is used to obtain the third cluster center website and the target cluster set corresponding to the current seed website cluster set if the distance to the center website corresponding to the current seed website cluster set is greater than a preset first distance threshold.

[0018] The second website clustering module is used to determine the second clustering result for each initial website based on the website information corresponding to each initial website to be identified and the website information corresponding to each third clustering center website. The second clustering result includes the corresponding assigned target cluster set and the unassigned target cluster set.

[0019] The abnormal website identification module is used to determine that the current initial website is an abnormal website if the second clustering result of the current initial website is the corresponding assigned target cluster set.

[0020] This invention has at least the following beneficial effects: It compares the initial website with the first cluster center website of the seed website cluster set based on website information to determine the first clustering result, achieving a preliminary classification of the initial website. It then determines the second cluster center website by combining all initial websites and all seed websites corresponding to each seed website cluster set. Based on the distance between the first and second cluster center websites, it measures the change in cluster centers after adding initial websites, thus characterizing the clustering effect of the seed website cluster set. When the distance between the center websites exceeds a preset first distance threshold, it determines the third cluster center website and the target cluster set by calculating reference center features and a fourth relative distance, optimizing the clustering structure. This allows the target cluster set to better adapt to the distribution characteristics of website data, thereby re-clustering the initial website based on the optimized target cluster set, improving the accuracy of the second clustering result and consequently improving the accuracy of identifying abnormal websites. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a flowchart of an abnormal website identification method provided in Embodiment 1 of the present invention;

[0023] Figure 2 This is a schematic diagram of an abnormal website identification system provided in Embodiment 2 of the present invention. Detailed Implementation

[0024] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0025] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It is understood that, where appropriate, the terms used to distinguish similar objects can be interchanged so that the invention can also be implemented in other embodiments besides the illustrated or described embodiments. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to these processes, methods, products, or devices.

[0026] Example 1

[0027] This embodiment provides a method for identifying abnormal websites, such as... Figure 1 As shown, this method for identifying abnormal websites includes the following steps:

[0028] S1. Based on the website information corresponding to each initial website to be identified within a preset time period and the website information corresponding to the first cluster center website of each seed website cluster set, determine the first clustering result corresponding to each initial website. The first clustering result includes the corresponding assigned seed website cluster set and the seed website cluster set not assigned to the seed website cluster set. The seed website cluster set includes several seed websites used to characterize abnormal websites.

[0029] The initial websites to be identified are target objects whose status as anomalous websites has not yet been determined. Website information includes multi-dimensional feature data such as the website's online activity, website type, and regional characteristics. The preset time period is a specific time range pre-set before anomaly website identification. By capturing relevant information from each website within the preset time period, we can understand the relevant characteristics of each website over a certain period, providing data support for subsequent cluster analysis and anomaly website identification. The specific duration of the preset time period can be determined by the implementer based on actual needs and analysis objectives; for example, a day, a week, or a month can be selected as the preset time period.

[0030] Seed websites are known anomalous websites, serving as the basis for identifying anomalous situations in the initial websites. Seed website clusters are initial groupings composed of several seed websites that exhibit high similarity across multiple dimensions, including network activity, website type, and geographic characteristics. The first cluster center website is the representative website of each seed website cluster, determined by calculating the mean or centroid of the features of all seed websites within the cluster, and is used to characterize the typical features of the seed website clusters.

[0031] The first clustering result is a preliminary classification of the initial website based on the similarity between the website information corresponding to the initial website and the website information corresponding to each first cluster center website. A corresponding seed website cluster set indicates that the initial website meets the feature similarity standard with that seed website cluster set and is classified into that seed website cluster set. Not being assigned to a seed website cluster set indicates that the initial website's features differ too much from all existing seed website cluster sets and cannot be classified into any of them.

[0032] In one specific implementation, the preset time period includes several preset time slices, and the website information includes data packet traffic, website address, and time difference. S1 includes the following steps:

[0033] S11. Based on the data packet traffic of each seed website in each preset time slot, obtain the traffic curve corresponding to each seed website. The traffic curve takes the preset time slot as the independent variable and the data packet traffic corresponding to each preset time slot as the dependent variable.

[0034] S12. Based on the traffic curve, website address, and time difference of each seed website, all seed websites are clustered to obtain several seed website cluster sets. The seed website corresponding to the cluster center of each seed website cluster set is determined as the first cluster center website of each seed website cluster set. Here, the time difference is the time difference between the time zone corresponding to the seed website and the target time zone.

[0035] The preset time period is divided into multiple consecutive and non-overlapping preset time slices to form a discrete time series, which makes it easier to measure the time distribution of data packet traffic of the seed website.

[0036] Data packet traffic refers to the number and rate of data packets transmitted by a website within a preset time slice, reflecting the intensity and pattern of the website's network activity. Website address includes domain name, path, and other structural information, used to characterize the website's type, domain, and other features. Time difference is the time difference between the time zone where the website's server is located and the target time zone, used to analyze the geographical characteristics and temporal patterns of the website's services. The target time zone can be set by the implementer according to actual conditions, used to unify all websites to the same time zone.

[0037] The data packet traffic of each seed website within each time slice is statistically analyzed, and a traffic curve is constructed with the preset time slice as the horizontal axis and data packet traffic as the vertical axis. The traffic data corresponding to all seed websites is converted into a traffic curve under a unified dimension, which facilitates subsequent cluster analysis. Furthermore, the traffic curve intuitively reflects the distribution pattern of the traffic of the corresponding seed website over time, serving as the basis for identifying abnormal traffic patterns.

[0038] For each seed website, multi-dimensional feature fusion is performed on the traffic curve, website address, and time difference characteristics. Clustering algorithms such as K-means and DBSCAN are then used to cluster the fused features of the seed websites, forming seed website cluster sets. The center of each seed website cluster set can be obtained by calculating the feature centroids of all members in all sets, and the seed website closest to the centroid is selected as the first cluster center website, used to represent the typical characteristics of the corresponding seed website cluster set.

[0039] The above-mentioned features, which combine data packet traffic, address and time difference characteristics, characterize the features of seed websites under multiple dimensions such as network activity, website type and regional characteristics, and cluster the features after multi-dimensional fusion, thereby improving the clustering accuracy of the seed website cluster set.

[0040] In one specific embodiment, each seed website transmits several data packets to the target receiving end within a preset time period. S11 further includes the following steps:

[0041] S111, based on the time point when each seed website transmits each corresponding data packet to the target receiver in the (k-1)th initial time slice, obtain the time difference value when each seed website transmits two adjacent data packets to the target receiver in the (k-1)th initial time slice, where k is an integer greater than 1 and the initial value is 2, and the time length corresponding to the first initial time slice is a preset length.

[0042] S112, based on all time difference values ​​corresponding to each seed website in the (k-1)th initial time slice, obtain the standard deviation of the time difference values ​​corresponding to all seed websites in the (k-1)th initial time slice.

[0043] S113. Based on the data packet traffic of each seed website in the first to the (k-1)th initial time slices and the time length of the first to the (k-1)th initial time slices, obtain the traffic density of each seed website per unit time in the first to the (k-1)th initial time slices.

[0044] S114. The average value of the traffic density of all seed websites within the unit time period from the 1st to the (k-1th)th initial time slice is determined as the predicted traffic density of all seed websites in the kth initial time slice.

[0045] S115. Based on the duration of the (k-1)th initial time slice, the standard deviation of the time difference values ​​of all seed websites within the (k-1)th initial time slice, the predicted traffic density corresponding to the kth initial time slice, the preset standard traffic density, and the preset adjustment coefficient, the duration of the kth initial time slice is obtained.

[0046] S116, update k=k+1, repeat S111 until the sum of the lengths of all initial time slices is greater than or equal to the preset time period. Determine the first to the second to last initial time slice as the first to the second to last preset time slice, and take the end time of the second to last initial time slice as the start time of the last preset time slice. Take the end time of the preset time period as the end time of the last preset time slice, and update to obtain the last preset time slice.

[0047] Specifically, the arrival time intervals of adjacent data packets for each seed website within the (k-1)th initial time slice are calculated; for example, the time interval between the first and second data packets, and the time interval between the second and third data packets. These time intervals reflect the burstiness and regularity of the data packet traffic corresponding to the seed website. Furthermore, the standard deviation of the time differences for all seed websites within the (k-1)th initial time slice is calculated to reflect the stability of the data packet traffic. Correspondingly, the larger the standard deviation, the worse the stability, requiring shorter time slices to more precisely capture traffic changes; that is, the larger the standard deviation, the shorter the time length of the corresponding time point.

[0048] The average historical traffic density of all seed websites before the k-th initial time slice is used as the predicted traffic density for the k-th initial time slice. Correspondingly, when traffic is dense, a more granular time division is needed as the basis for analysis; that is, the higher the predicted traffic density, the shorter the corresponding time slice.

[0049] The preset standard traffic density represents a baseline traffic density level, used to measure the relative situation of the current actual traffic density, so that adjustments can be made based on the difference between the traffic density and the standard value during the calculation of the time slice length. Specifically, the specific value of the preset standard traffic density can be obtained by the implementer according to the actual situation. For example, it can be directly set by the experience of cybersecurity experts combined with the needs of specific business scenarios, or it can be obtained based on the average or median of traffic density data from multiple seed websites over a historical period.

[0050] The preset adjustment coefficient is used to control the adjustment range of the time slice. Correspondingly, the larger the preset adjustment coefficient, the stronger the influence of standard deviation and flow density on the adjustment of the time slice length, and the greater the range of time slice length variation. The smaller the preset adjustment coefficient, the weaker the influence of standard deviation and flow density on the adjustment of the time slice length, and the smaller the range of time slice length variation.

[0051] The length of the (k-1)th initial time slice is the base value for calculating the length of the kth initial time slice, which is amplified or reduced according to the preset adjustment coefficient, standard deviation, and changes in flow density.

[0052] For example, based on the time length Δt of the (k-1)th initial time slice. k-1 The standard deviation σ of the time difference for all seed websites within the (k-1)th initial time slice; the predicted traffic density ρ for the kth initial time slice; and the preset standard traffic density ρ. m Using the preset adjustment coefficient α, the time length Δt of the k-th initial time slice is obtained. k =Δt k-1 ×(1+α×((2 / (1+e -σ ))-1)×(1-ρ / ρ m )).

[0053] The time length of the kth initial time slice is calculated by a dynamic adjustment function after comprehensively considering the time length of the (k-1)th initial time slice, the standard deviation of the time difference, the predicted flow density, the preset standard flow density, and the preset adjustment coefficient. The interaction of parameters in multiple dimensions jointly determines the dynamic change of the time slice length, which improves the accuracy of the preset time slice segmentation and thus improves the versatility of the abnormal website identification method.

[0054] In one specific embodiment, S12 further includes the following steps:

[0055] S121, For each seed website, perform feature extraction on the traffic curve corresponding to the current seed website to obtain the traffic features corresponding to the current seed website.

[0056] S122, extract features from the website address corresponding to the current seed website to obtain the address features corresponding to the current seed website.

[0057] S123, map the time difference corresponding to the current seed website to a preset value range to obtain the time difference feature corresponding to the current seed website.

[0058] S124: Concatenate the traffic characteristics, address characteristics, and time difference characteristics corresponding to the current seed website to obtain the website characteristics corresponding to the current seed website.

[0059] S125, based on the website characteristics corresponding to each seed website, cluster all seed websites to obtain several seed website cluster sets, and determine the seed website corresponding to the cluster center of each seed website cluster set as the first cluster center website corresponding to each seed website cluster set.

[0060] This process involves feature extraction from the traffic curve corresponding to the current seed website to obtain its traffic characteristics, which characterize the network activity of that website. For example, the mean, variance, skewness, and peak value of the traffic curve can be calculated to describe traffic distribution characteristics. The peak time, peak duration, traffic rise rate, and fall rate can also be summarized to depict traffic fluctuation patterns. Finally, by combining these values, a feature vector corresponding to the traffic curve is obtained as the traffic feature.

[0061] Feature extraction is performed on the website address corresponding to the current seed website to obtain its address features, which characterize the network type of the current seed website. For example, the address structure features can be described based on the domain name length, path depth, and number of parameters corresponding to the website address, while the encoding features can be described by processing the domain name using hash algorithms or one-hot encoding techniques. Finally, by combining the address structure features and the encoding features, the address features corresponding to the website address are obtained.

[0062] The time difference corresponding to the current seed website is mapped to a preset numerical range to obtain the time difference feature of the current seed website, which represents the regional characteristics of the current seed website. For example, the time difference can be normalized and the normalized result can be used as the time difference feature to avoid the clustering effect being affected by large differences in the absolute value of the time difference.

[0063] Traffic features, address features, and time zone features are concatenated sequentially into a high-dimensional vector to comprehensively represent the network activity, network type, and regional characteristics of the current seed website. Based on the similarity between website features, the similarity among seed websites across multiple dimensions—network activity, website type, and regional characteristics—is measured, serving as the basis for clustering seed websites.

[0064] Furthermore, clustering algorithms such as K-means and DBSCAN are used to cluster the fused features of the seed websites, forming seed website cluster sets. Then, by calculating the feature centroids of all members in each seed website cluster set, the seed website closest to the centroid is selected as the corresponding first cluster center website, used to represent the typical features of the corresponding seed website cluster set.

[0065] The above method quantifies the traffic curves, website addresses, and time differences corresponding to seed websites into multi-dimensional features and concatenates them into a high-dimensional vector form of website features. This comprehensively represents the network activity, network type, and regional characteristics of the current seed website, thereby improving the accuracy of clustering seed websites.

[0066] In one specific embodiment, S1 further includes the following steps:

[0067] S101: Based on the data packet traffic of each initial website in each preset time slice, obtain the traffic curve corresponding to each initial website.

[0068] S102: Based on the traffic curve, website address, and time difference of each initial website, obtain the website characteristics corresponding to each initial website.

[0069] S103, based on the website features corresponding to each initial website and the website features corresponding to each first cluster center website, obtain the first relative distance between each initial website and each first cluster center website.

[0070] S104. For any seed website cluster set, based on the website characteristics of each seed website in the current seed website cluster set and the website characteristics of the first cluster center website, obtain the second relative distance between each seed website in the current seed website cluster set and the first cluster center website.

[0071] S105, the maximum value of the second relative distance between all seed websites in the current seed website cluster set and the first cluster center website is determined as the second distance threshold corresponding to the current seed website cluster set.

[0072] S106, for each initial website, if the first relative distance between the current initial website and the first cluster center website in the current seed website cluster set is less than the second distance threshold corresponding to the current seed website cluster set, then the current seed website cluster set is determined as the candidate cluster set corresponding to the current initial website.

[0073] S107. If the number of candidate cluster sets corresponding to the current initial website is greater than 0, then based on the first relative distance between the current initial website and the first cluster center website in each corresponding candidate cluster set, the candidate cluster set corresponding to the smallest first relative distance is determined as the seed website cluster set assigned to the current initial website, and the first clustering result corresponding to the current initial website is determined as the corresponding assigned seed website cluster set.

[0074] S108. If the number of candidate cluster sets corresponding to the current initial website is 0, then the first cluster result corresponding to the current initial website is determined to be an unassigned seed website cluster set.

[0075] The method for obtaining the website features corresponding to each initial website is the same as the method for obtaining the website features corresponding to the seed websites.

[0076] Using distance calculation methods such as Euclidean distance, cosine similarity, or Mahalanobis distance, a first relative distance is calculated between the website features of the initial website and the website features of each first cluster center website. This distance characterizes the similarity between the initial website and each first cluster center website. A second relative distance is also calculated between each seed website and each first cluster center website. This second relative distance characterizes the similarity between each website in the corresponding seed website cluster and its cluster center. The largest second relative distance in the current seed website cluster can then be used as a boundary metric for the seed website cluster. When assigning the initial website to a seed website cluster, this metric compares the first relative distance and the second distance threshold between the initial website and the first cluster center website to determine whether the similarity between the initial website and the corresponding seed website cluster is within an acceptable range.

[0077] Correspondingly, if the first relative distance between the current initial website and the first cluster center website in the current seed website cluster set is less than the second distance threshold corresponding to the current seed website cluster set, it means that the current initial website is within the acceptable range of the current seed website cluster set, and the current seed website cluster set is determined as the candidate cluster set corresponding to the current initial website.

[0078] Furthermore, for each initial website, the nearest candidate cluster set is selected from all the corresponding candidate cluster sets as the seed website cluster set assigned to each initial website.

[0079] As described above, based on the similarity between each website and the cluster center in each seed website cluster set, a second distance threshold is determined for each seed website cluster set. This overcomes the limitations of fixed thresholds when the data distribution is uneven. Furthermore, the second distance threshold is used as the boundary metric basis for the seed website cluster sets, which improves the accuracy of candidate cluster set selection and, consequently, the accuracy of the first clustering result for each initial website.

[0080] S2: Based on the first clustering result corresponding to each initial website, obtain all initial websites corresponding to each seed website cluster set.

[0081] For initial websites that have a corresponding assigned seed website cluster set, they are categorized according to the seed website cluster set to which they belong. For initial websites that are not assigned to a seed website cluster set, they can be categorized separately as unrelated initial websites to avoid interference from the subsequent analysis results of the clustering effect of the seed website cluster set.

[0082] Correspondingly, each seed website cluster can obtain all related initial websites, thus forming a complete cluster set structure.

[0083] S3: For any seed website cluster set, obtain the second cluster center website corresponding to the current seed website cluster set based on all initial websites and all seed websites corresponding to the current seed website cluster set.

[0084] In one specific embodiment, S3 includes the following steps:

[0085] S31. Calculate the centroid vector corresponding to the current seed website cluster set, taking into account the website features of all initial websites and all seed websites corresponding to the current seed website cluster set.

[0086] S32, based on the centroid vector corresponding to the current seed website cluster set, the website features of each initial website and each seed website corresponding to the current seed website cluster set, obtain the third relative distance between the centroid vector corresponding to the current seed website cluster set and each initial website and each seed website.

[0087] S33, determine the initial website or seed website corresponding to the smallest third relative distance as the second cluster center website corresponding to the current seed website cluster set.

[0088] The centroid vector is the average of the website features of all initial websites and all seed websites. It represents the geometric center of the current seed website cluster set and can eliminate individual differences in the set, focusing on the overall features of the current seed website cluster set.

[0089] Using distance calculation methods such as Euclidean distance, cosine similarity, or Mahalanobis distance, the third relative distance between the centroid vector of the current seed website cluster set and each initial website or each seed website is calculated. This distance is used to characterize the similarity between each initial website or each seed website and the overall characteristics of the current seed website cluster set. The initial website or seed website with the smallest third relative distance, that is, the one with the highest similarity to the overall characteristics of the current seed website cluster set, is selected as the second cluster center website corresponding to the current seed website cluster set. In other words, the website that can better represent the overall characteristics of the current seed website cluster set is selected.

[0090] As mentioned above, the second cluster center is closer to the overall characteristics of the seed website cluster set after the initial website was added than the first cluster center, avoiding the clustering bias caused by relying solely on the seed website, and providing a data foundation for analyzing the clustering effect of the seed website cluster set.

[0091] S4. Based on the website information of the first cluster center website and the second cluster center website corresponding to the current seed website cluster set, obtain the distance between the center websites corresponding to the current seed website cluster set.

[0092] The first cluster center website is the center obtained based on the initial seed websites, representing the typical characteristics or average state of the seed website set. The second cluster center website, on the other hand, is the center determined after considering all the initial websites and all seed websites corresponding to the current seed website cluster set, and more comprehensively reflects the characteristics of the cluster set.

[0093] Using distance calculation methods such as Euclidean distance, cosine similarity, or Mahalanobis distance, the distance between the website information of the first cluster center website and the website information of the second cluster center website corresponding to the current seed website cluster set is calculated. This distance is used as the center website distance corresponding to the current seed website cluster set. It can measure the change of cluster centers after adding new initial websites, thereby understanding the degree of feature change of the entire cluster set, such as the movement or change of center features, and thus characterizing the clustering effect of the seed website cluster set.

[0094] Correspondingly, a larger distance between the central websites indicates a significant shift in the cluster centers after the addition of the initial websites, meaning a substantial change in the characteristics of the cluster set. This could be because the newly added initial websites possess significantly different characteristics from the original seed websites, or because the clustering partitioning is not reasonable enough. The clustering effect representing the seed website cluster set is worse, requiring further adjustments. Conversely, a smaller distance between the central websites indicates a relatively stable cluster set, with the newly added initial websites having a smaller impact on the overall cluster characteristics. The clustering results have a certain degree of reliability and stability, representing a better clustering effect representing the seed website cluster set.

[0095] The above describes how, based on the website information of the first and second cluster center websites, the distance between the center websites corresponding to the current seed website cluster set is obtained. This distance is used to measure the change in cluster centers after adding new initial websites, thereby characterizing the clustering effect of the seed website cluster set and providing a data basis for whether to optimize the cluster set in the future.

[0096] S5. If the distance to the central website corresponding to the current seed website cluster set is greater than the preset first distance threshold, then based on the website information corresponding to all seed websites, the first cluster center website, and the second cluster center website corresponding to the current seed website cluster set, the third cluster center website and the target cluster set corresponding to the current seed website cluster set are obtained.

[0097] In one specific embodiment, S5 includes the following steps:

[0098] S51, the average feature of the website features corresponding to the first cluster center website and the second cluster center website of the current seed website cluster set is determined as the reference center feature of the current seed website cluster set.

[0099] S52, based on the website features and reference center features of all seed websites in the current seed website cluster set, obtain the fourth relative distance between each seed website and the reference center feature in the current seed website cluster set.

[0100] S53, the seed website corresponding to the smallest fourth relative distance is determined as the third cluster center website corresponding to the current seed website cluster set.

[0101] S54, based on all the seed websites in the current seed website cluster set, form a target cluster set with the third cluster center website as the cluster center.

[0102] Specifically, the fourth relative distance between each seed site and the reference center feature is calculated using distance calculation methods such as Euclidean distance, cosine similarity, or Mahalanobis distance.

[0103] The reference center feature balances the initial clustering results based on seed websites and the comprehensive clustering results combining the initial websites. Based on the fourth relative distance, the seed website that is closest to the reference center feature is determined as the third cluster center website. This ensures that the target cluster set with the third cluster center website as the cluster center can retain the core information of the seed websites and absorb the trend features of the initial websites. Moreover, the absorption of the initial websites has little impact on the overall clustering features, reducing the instability caused by the initial clustering bias or fluctuations of the initial websites, and ensuring the reliability and stability of the clustering results.

[0104] As mentioned above, when the difference between the first cluster center and the second cluster center is too large, the reference center features are calculated and the closest seed website is selected as the third cluster center to generate a more robust target cluster set. This improves the clustering accuracy of the seed website and subsequent initial websites, thereby enhancing the accuracy of identifying subsequent abnormal websites.

[0105] S6. Based on the website information corresponding to each initial website to be identified and the website information corresponding to each third cluster center website, determine the second clustering result corresponding to each initial website. The second clustering result includes the target cluster set to be assigned and the set not assigned to the target cluster set.

[0106] Similar to determining the first clustering result for each initial website, the similarity between the website information corresponding to the initial website and the website information corresponding to the third clustering center website is measured based on the new target clustering set and the corresponding third clustering center website. This results in obtaining the second clustering result for each initial website, which is then used as the optimized clustering result for the initial websites.

[0107] As described above, clustering the initial websites based on the optimized target cluster set and the third cluster center website improves the accuracy of the second clustering results.

[0108] S7. For any initial website, if the second clustering result corresponding to the current initial website is the corresponding assigned target cluster set, then the current initial website is determined to be an abnormal website.

[0109] In one specific embodiment, the abnormal website identification method further includes the following steps:

[0110] For any initial website, if the second clustering result corresponding to the current initial website is not assigned to the target cluster set, then the current initial website is determined to be a normal website.

[0111] As described above, the initial websites are compared with the first cluster center websites of the seed website cluster sets based on website information to determine the first clustering result, thus achieving a preliminary classification of the initial websites. The second cluster center websites are determined by combining all initial websites and all seed websites corresponding to each seed website cluster set. The change in cluster centers after adding initial websites is measured based on the distance between the first and second cluster center websites, characterizing the clustering effect of the seed website cluster sets. When the distance between the center websites exceeds a preset first distance threshold, the third cluster center website and the target cluster set are determined by calculating reference center features and a fourth relative distance, thus optimizing the clustering structure. This allows the target cluster set to better adapt to the distribution characteristics of the website data, thereby re-clustering the initial websites based on the optimized target cluster set, improving the accuracy of the second clustering result and consequently improving the accuracy of identifying abnormal websites.

[0112] Example 2

[0113] This second embodiment provides an abnormal website identification system, such as Figure 2 As shown, the abnormal website identification system includes:

[0114] The first website clustering module 21 is used to determine the first clustering result corresponding to each initial website based on the website information corresponding to each initial website to be identified within a preset time period and the website information corresponding to the first clustering center website of each seed website cluster set. The first clustering result includes the corresponding assigned seed website cluster set and the seed website cluster set not assigned to the seed website cluster set. The seed website cluster set includes several seed websites used to characterize abnormal websites.

[0115] The cluster set analysis module 22 is used to obtain all the initial websites corresponding to each seed website cluster set based on the first cluster result corresponding to each initial website.

[0116] The second cluster center acquisition module 23 is used to obtain the second cluster center website corresponding to the current seed website cluster set based on all initial websites and all seed websites corresponding to the current seed website cluster set.

[0117] The central website distance acquisition module 24 is used to obtain the central website distance corresponding to the current seed website cluster set based on the website information of the first cluster central website and the website information of the second cluster central website corresponding to the current seed website cluster set.

[0118] The target cluster set acquisition module 25 is used to obtain the third cluster center website and the target cluster set corresponding to the current seed website cluster set if the distance to the center website corresponding to the current seed website cluster set is greater than a preset first distance threshold.

[0119] The second website clustering module 26 is used to determine the second clustering result corresponding to each initial website based on the website information corresponding to each initial website to be identified and the website information corresponding to each third clustering center website. The second clustering result includes the corresponding assigned target cluster set and the unassigned target cluster set.

[0120] The abnormal website identification module 27 is used to determine that the current initial website is an abnormal website if the second clustering result corresponding to the current initial website is the corresponding assigned target cluster set.

[0121] In one specific implementation, the preset time period includes several preset time slices, and the website information includes data packet traffic, website address, and time difference. The first website clustering module 21 includes:

[0122] The first traffic curve acquisition submodule is used to obtain the traffic curve corresponding to each seed website based on the data packet traffic corresponding to each preset time slice. The traffic curve takes the preset time slice as the independent variable and the data packet traffic corresponding to each preset time slice as the dependent variable.

[0123] The first clustering submodule is used to cluster all seed websites based on the traffic curve, website address and time difference of each seed website to obtain several seed website cluster sets. The seed website corresponding to the cluster center of each seed website cluster set is determined as the first cluster center website of each seed website cluster set. Here, the time difference is the time difference between the time zone corresponding to the seed website and the target time zone.

[0124] In one specific implementation, each seed website transmits several data packets to the target receiving end within a preset time period. The first traffic curve acquisition submodule further includes:

[0125] The time difference acquisition unit is used to obtain the time difference value when each seed website transmits the corresponding data packet to the target receiving end in the (k-1)th initial time slice, based on the time point when each seed website transmits each corresponding data packet to the target receiving end in the (k-1)th initial time slice. Here, k is an integer greater than 1, and the initial value is 2. The time length corresponding to the first initial time slice is a preset length.

[0126] The standard deviation acquisition unit is used to obtain the standard deviation of the time difference values ​​of all seed websites in the (k-1)th initial time slice, based on the time difference values ​​of all seed websites in the (k-1)th initial time slice.

[0127] The traffic density acquisition unit is used to obtain the traffic density of each seed website within a unit time within the first to the (k-1)th initial time slices, based on the data packet traffic of each seed website within the first to the (k-1)th initial time slices and the time length of the first to the (k-1)th initial time slices.

[0128] The predicted traffic density acquisition unit is used to determine the average traffic density of all seed websites within the unit time period from the 1st to the (k-1th)th initial time slice as the predicted traffic density of all seed websites in the kth initial time slice.

[0129] The first time length acquisition unit is used to obtain the time length of the k-th initial time slice based on the time length of the (k-1)-th initial time slice, the standard deviation of the time difference values ​​of all seed websites in the (k-1)-th initial time slice, the predicted traffic density in the k-th initial time slice, the preset standard traffic density, and the preset adjustment coefficient.

[0130] The second time length acquisition unit is used to update k=k+1 and repeatedly execute the time difference acquisition unit until the sum of the time lengths of all initial time slices is greater than or equal to the preset time period. The first to the second to last initial time slices are determined as the first to the second to last preset time slices, and the end time of the second to last initial time slice is taken as the start time of the last preset time slice. The end time of the preset time period is taken as the end time of the last preset time slice, and the last preset time slice is updated to obtain the last preset time slice.

[0131] In one specific implementation, the first clustering submodule further includes:

[0132] The traffic feature acquisition unit is used to extract features from the traffic curve corresponding to each seed website and obtain the traffic features corresponding to the current seed website.

[0133] The address feature acquisition unit is used to extract features from the website address corresponding to the current seed website and obtain the address features corresponding to the current seed website.

[0134] The time difference feature acquisition unit is used to map the time difference corresponding to the current seed website to a preset numerical range and acquire the time difference feature corresponding to the current seed website.

[0135] The website feature acquisition unit is used to concatenate the traffic features, address features, and time difference features corresponding to the current seed website to obtain the website features corresponding to the current seed website.

[0136] The first clustering unit is used to cluster all seed websites according to the website characteristics corresponding to each seed website, obtain several seed website cluster sets, and determine the seed website corresponding to the cluster center of each seed website cluster set as the first cluster center website corresponding to each seed website cluster set.

[0137] In one specific embodiment, the first website clustering module 21 further includes:

[0138] The second traffic curve acquisition submodule is used to obtain the traffic curve corresponding to each initial website based on the data packet traffic of each initial website in each preset time slice.

[0139] The website feature acquisition submodule is used to obtain the website features corresponding to each initial website based on the traffic curve, website address, and time difference.

[0140] The first relative distance acquisition submodule is used to obtain the first relative distance between each initial website and each first cluster center website based on the website features corresponding to each initial website and the website features corresponding to each first cluster center website.

[0141] The second relative distance acquisition submodule is used to obtain the second relative distance between each seed website in the current seed website cluster set and the first cluster center website for any seed website cluster set, based on the website characteristics of each seed website in the current seed website cluster set and the website characteristics of the first cluster center website.

[0142] The second distance threshold acquisition submodule is used to determine the maximum value of the second relative distance between all seed websites in the current seed website cluster set and the first cluster center website as the second distance threshold corresponding to the current seed website cluster set.

[0143] The candidate cluster set acquisition submodule is used to determine the current seed website cluster set as the candidate cluster set corresponding to the current initial website if the first relative distance between the current initial website and the first cluster center website in the current seed website cluster set is less than the second distance threshold corresponding to the current seed website cluster set.

[0144] The first result acquisition submodule is used to determine the candidate cluster set corresponding to the smallest first relative distance as the seed website cluster set assigned to the current initial website if the number of candidate cluster sets corresponding to the current initial website is greater than 0, based on the first relative distance between the current initial website and the first cluster center website in each corresponding candidate cluster set, and determine the first cluster result corresponding to the current initial website as the corresponding assigned seed website cluster set.

[0145] The second result acquisition submodule is used to determine that the first clustering result corresponding to the current initial website is not assigned to the seed website clustering set if the number of candidate clustering sets corresponding to the current initial website is 0.

[0146] In one specific embodiment, the second cluster center acquisition module 23 includes:

[0147] The centroid vector acquisition submodule is used to calculate the centroid vector corresponding to the current seed website cluster set based on the website features of all initial websites and all seed websites corresponding to the current seed website cluster set.

[0148] The third relative distance acquisition submodule is used to obtain the third relative distance between the centroid vector of the current seed website cluster set and each initial website and each seed website, based on the centroid vector of the current seed website cluster set and the website features of each initial website and each seed website.

[0149] The second cluster center acquisition submodule is used to determine the initial website or seed website corresponding to the smallest third relative distance as the second cluster center website corresponding to the current seed website cluster set.

[0150] In one specific embodiment, the target cluster set acquisition module 25 includes:

[0151] The reference center feature acquisition submodule is used to determine the average feature of the website features corresponding to the first cluster center website and the second cluster center website of the current seed website cluster set as the reference center feature of the current seed website cluster set.

[0152] The fourth relative distance acquisition submodule is used to obtain the fourth relative distance between each seed website and the reference center feature in the current seed website cluster set, based on the website features and reference center features of all seed websites in the current seed website cluster set.

[0153] The third cluster center acquisition submodule is used to determine the seed website corresponding to the smallest fourth relative distance as the third cluster center website of the current seed website cluster set.

[0154] The target cluster set acquisition submodule is used to form a target cluster set with the third cluster center website as the cluster center based on all seed websites in the current seed website cluster set.

[0155] In one specific embodiment, the abnormal website identification system further includes:

[0156] The normal website identification module is used to determine that the current initial website is a normal website if the second clustering result corresponding to the current initial website is not assigned to the target cluster set.

[0157] It should be noted that the information interaction and execution process between the above modules are based on the same concept as the method embodiments of the present invention. For details on their specific functions and technical effects, please refer to the method embodiments section, which will not be repeated here.

[0158] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A method for identifying abnormal websites, characterized in that, The abnormal website identification method includes the following steps: S1. Based on the website information corresponding to each initial website to be identified within a preset time period and the website information corresponding to the first cluster center website of each seed website cluster set, determine the first clustering result corresponding to each initial website. The first clustering result includes the corresponding assigned seed website cluster set and the seed website cluster set not assigned to the seed website cluster set. The seed website cluster set includes several seed websites used to characterize abnormal websites. S2, based on the first clustering result corresponding to each initial website, obtain all the initial websites corresponding to each seed website cluster set; S3, for any seed website cluster set, obtain the second cluster center website corresponding to the current seed website cluster set based on all initial websites and all seed websites corresponding to the current seed website cluster set; S4. Based on the website information of the first cluster center website and the second cluster center website corresponding to the current seed website cluster set, obtain the distance between the center websites corresponding to the current seed website cluster set. S5, if the distance to the central website corresponding to the current seed website cluster set is greater than a preset first distance threshold, then based on the website information corresponding to all seed websites, the first cluster center website, and the second cluster center website corresponding to the current seed website cluster set, the third cluster center website and the target cluster set corresponding to the current seed website cluster set are obtained. S5 includes the following steps: S51, the average feature of the website features corresponding to the first cluster center website and the second cluster center website corresponding to the current seed website cluster set is determined as the reference center feature corresponding to the current seed website cluster set; S52, based on the website features and reference center features of all seed websites in the current seed website cluster set, obtain the fourth relative distance between each seed website and the reference center feature in the current seed website cluster set; S53, the seed website corresponding to the smallest fourth relative distance is determined as the third cluster center website corresponding to the current seed website cluster set; S54, Based on all the seed websites in the current seed website cluster set, form a target cluster set with the third cluster center website as the cluster center; S6. Based on the website information corresponding to each initial website to be identified and the website information corresponding to each third cluster center website, determine the second clustering result corresponding to each initial website. The second clustering result includes the corresponding assigned target cluster set and the set not assigned to the target cluster set. S7. For any initial website, if the second clustering result corresponding to the current initial website is the corresponding assigned target cluster set, then the current initial website is determined to be an abnormal website.

2. The abnormal website identification method according to claim 1, characterized in that, The preset time period includes several preset time slices, and the website information includes data packet traffic, website address, and time difference. S1 includes the following steps: S11. Based on the data packet traffic of each seed website in each preset time slot, obtain the traffic curve corresponding to each seed website. The traffic curve takes the preset time slot as the independent variable and the data packet traffic corresponding to each preset time slot as the dependent variable. S12. Based on the traffic curve, website address, and time difference of each seed website, all seed websites are clustered to obtain several seed website cluster sets. The seed website corresponding to the cluster center of each seed website cluster set is determined as the first cluster center website of each seed website cluster set. Here, the time difference is the time difference between the time zone corresponding to the seed website and the target time zone.

3. The abnormal website identification method according to claim 2, characterized in that, Each seed website transmits several data packets to the target receiving end within the preset time period. S11 also includes the following steps: S111, based on the time point when each seed website transmits each corresponding data packet to the target receiving end in the (k-1)th initial time slice, obtain the time difference value when each seed website transmits two adjacent data packets to the target receiving end in the (k-1)th initial time slice, where k is an integer greater than 1 and the initial value is 2, and the time length corresponding to the first initial time slice is a preset length. S112, Based on all the time difference values ​​corresponding to each seed website in the (k-1)th initial time slice, obtain the standard deviation of the time difference values ​​corresponding to all seed websites in the (k-1)th initial time slice; S113, based on the data packet traffic of each seed website in the first to the (k-1)th initial time slices and the time length of the first to the (k-1)th initial time slices, obtain the traffic density of each seed website per unit time in the first to the (k-1)th initial time slices; S114, the average value of the traffic density of all seed websites in the unit time within the first to the (k-1)th initial time slice is determined as the predicted traffic density of all seed websites in the kth initial time slice. S115. Based on the time length of the (k-1)th initial time slice, the standard deviation of the time difference values ​​of all seed websites in the (k-1)th initial time slice, the predicted traffic density in the kth initial time slice, the preset standard traffic density, and the preset adjustment coefficient, the time length of the kth initial time slice is obtained. S116, update k=k+1, repeat S111 until the sum of the lengths of all initial time slices is greater than or equal to the preset time period, determine the first to the second to last initial time slice as the first to the second to last preset time slice, take the end time of the second to last initial time slice as the start time of the last preset time slice, take the end time of the preset time period as the end time of the last preset time slice, and update to obtain the last preset time slice.

4. The abnormal website identification method according to claim 3, characterized in that, S12 also includes the following steps: S121, For each seed website, extract features from the traffic curve corresponding to the current seed website to obtain the traffic features corresponding to the current seed website. S122, Extract features from the website address corresponding to the current seed website to obtain the address features corresponding to the current seed website; S123, map the time difference corresponding to the current seed website to a preset value range to obtain the time difference feature corresponding to the current seed website; S124: Concatenate the traffic characteristics, address characteristics, and time difference characteristics corresponding to the current seed website to obtain the website characteristics corresponding to the current seed website; S125, based on the website characteristics corresponding to each seed website, cluster all seed websites to obtain several seed website cluster sets, and determine the seed website corresponding to the cluster center of each seed website cluster set as the first cluster center website corresponding to each seed website cluster set.

5. The abnormal website identification method according to claim 4, characterized in that, S1 also includes the following steps: S101, based on the data packet traffic of each initial website in each preset time slice, obtain the traffic curve corresponding to each initial website; S102, based on the traffic curve, website address and time difference of each initial website, obtain the website characteristics corresponding to each initial website; S103, based on the website features corresponding to each initial website and the website features corresponding to each first cluster center website, obtain the first relative distance between each initial website and each first cluster center website; S104, For any seed website cluster set, based on the website characteristics of each seed website in the current seed website cluster set and the website characteristics of the first cluster center website, obtain the second relative distance between each seed website in the current seed website cluster set and the first cluster center website; S105, the maximum value of the second relative distance between all seed websites in the current seed website cluster set and the first cluster center website is determined as the second distance threshold corresponding to the current seed website cluster set; S106, For each initial website, if the first relative distance between the current initial website and the first cluster center website in the current seed website cluster set is less than the second distance threshold corresponding to the current seed website cluster set, then the current seed website cluster set is determined as the candidate cluster set corresponding to the current initial website. S107, If the number of candidate cluster sets corresponding to the current initial website is greater than 0, then based on the first relative distance between the current initial website and the first cluster center website in each corresponding candidate cluster set, the candidate cluster set corresponding to the smallest first relative distance is determined as the seed website cluster set assigned to the current initial website, and the first clustering result corresponding to the current initial website is determined as the corresponding assigned seed website cluster set. S108. If the number of candidate cluster sets corresponding to the current initial website is 0, then the first cluster result corresponding to the current initial website is determined to be an unassigned seed website cluster set.

6. The abnormal website identification method according to claim 5, characterized in that, S3 includes the following steps: S31. Calculate the centroid vector corresponding to the current seed website cluster set, based on the website features of all initial websites and all seed websites corresponding to the current seed website cluster set. S32, based on the centroid vector corresponding to the current seed website cluster set, the website features of each initial website and each seed website corresponding to the current seed website cluster set, obtain the third relative distance between the centroid vector corresponding to the current seed website cluster set and each initial website and each seed website. S33, determine the initial website or seed website corresponding to the smallest third relative distance as the second cluster center website corresponding to the current seed website cluster set.

7. The abnormal website identification method according to claim 1, characterized in that, The abnormal website identification method also includes the following steps: For any initial website, if the second clustering result corresponding to the current initial website is not assigned to the target cluster set, then the current initial website is determined to be a normal website.

8. An abnormal website identification system, characterized in that, The abnormal website identification system includes: The first website clustering module is used to determine the first clustering result for each initial website based on the website information corresponding to each initial website to be identified within a preset time period and the website information corresponding to the first clustering center website of each seed website cluster set. The first clustering result includes the corresponding assigned seed website cluster set and the seed website cluster set not assigned to the seed website cluster set. The seed website cluster set includes several seed websites used to characterize abnormal websites. The cluster set analysis module is used to obtain all the initial websites corresponding to each seed website cluster set based on the first cluster result corresponding to each initial website. The second cluster center acquisition module is used to obtain the second cluster center website corresponding to the current seed website cluster set based on all initial websites and all seed websites corresponding to the current seed website cluster set for any seed website cluster set. The central website distance acquisition module is used to obtain the central website distance corresponding to the current seed website cluster set based on the website information of the first cluster central website and the website information of the second cluster central website corresponding to the current seed website cluster set. The target cluster set acquisition module is used to, if the distance to the center website corresponding to the current seed website cluster set is greater than a preset first distance threshold, obtain the third cluster center website and the target cluster set corresponding to the current seed website cluster set based on the website information corresponding to all seed websites, the first cluster center website, and the second cluster center website corresponding to the current seed website cluster set. The target cluster set acquisition module includes: The reference center feature acquisition submodule is used to determine the average feature of the website features corresponding to the first cluster center website and the second cluster center website of the current seed website cluster set as the reference center feature of the current seed website cluster set. The fourth relative distance acquisition submodule is used to obtain the fourth relative distance between each seed website and the reference center feature in the current seed website cluster set based on the website features and reference center features of all seed websites in the current seed website cluster set. The third cluster center acquisition submodule is used to determine the seed website corresponding to the smallest fourth relative distance as the third cluster center website corresponding to the current seed website cluster set; The target cluster set acquisition submodule is used to form a target cluster set with the third cluster center website as the cluster center based on all seed websites in the current seed website cluster set; The second website clustering module is used to determine the second clustering result corresponding to each initial website based on the website information corresponding to each initial website to be identified and the website information corresponding to each third clustering center website. The second clustering result includes the corresponding assigned target cluster set and the set not assigned to the target cluster set. The abnormal website identification module is used to determine that the current initial website is an abnormal website if the second clustering result of the current initial website is the corresponding assigned target cluster set.

9. The abnormal website identification system according to claim 8, characterized in that, The preset time period includes several preset time slices, and the website information includes data packet traffic, website address, and time difference. The first website clustering module includes: The first traffic curve acquisition submodule is used to obtain the traffic curve corresponding to each seed website based on the data packet traffic corresponding to each preset time slice. The traffic curve takes the preset time slice as the independent variable and the data packet traffic corresponding to each preset time slice as the dependent variable. The first clustering submodule is used to cluster all seed websites based on the traffic curve, website address and time difference of each seed website to obtain several seed website cluster sets. The seed website corresponding to the cluster center of each seed website cluster set is determined as the first cluster center website of each seed website cluster set. Here, the time difference is the time difference between the time zone corresponding to the seed website and the target time zone.

Images