Phishing Website Clustering for Digital Fingerprinting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Phishing websites created by attackers to steal user credentials are difficult to identify and track, as existing methods often raise suspicion when fake credentials are submitted to multiple sites, and there is a need for a method to group these sites by their common origin to effectively digital fingerprint attackers without alerting them.
Innovation Solution
A computer-implemented method for clustering websites based on their features, using affinity propagation clustering to group similar websites together, generating feature and website similarity scores, and submitting fake credentials to only one representative website to avoid raising suspicion, while identifying and blocking attacker access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If fake credentials are submitted to multiple phishing sites to identify attackers, then attacker detection capability is improved, but attackers may become suspicious and alter their behavior
Solution Approach 1:
The system segments phishing websites into clusters based on their features and similarities. Instead of submitting fake credentials to all phishing sites, it selectively targets representative sites from each cluster, reducing the number of submissions while maintaining detection effectiveness across the entire phishing ecosystem.
Solution Approach 2:
The system creates a digital fingerprint model of attacker behavior by analyzing features of phishing websites. This fingerprint serves as a copy or representation of the attacker's modus operandi, allowing identification of associated sites without needing to interact with every single phishing site.
2Measurement precision
If all phishing websites are analyzed individually to identify attackers, then detection accuracy is improved, but system complexity and resource consumption increase
Solution Approach 1:
The system merges multiple phishing websites into clusters based on their feature similarities. By treating each cluster as a single unit with a representative fingerprint, it reduces the complexity of analyzing every site individually while preserving the ability to detect attacker patterns across the entire group.
Solution Approach 2:
The clustering system creates a universal fingerprinting approach that can identify multiple phishing sites through a single representative site. This multi-functional system can detect entire networks of phishing sites by analyzing just one site per cluster, reducing resource consumption while maintaining comprehensive detection capability.
3Productivity
If clustering is applied to group phishing websites, then resource efficiency is improved, but risk of missing subtle variations between sites increases
Solution Approach 1:
The system applies local quality by allowing each cluster to have its own representative fingerprint based on the specific features of websites within that cluster. This ensures that subtle variations between different phishing sites are captured in their respective cluster representations, maintaining detection completeness while achieving resource efficiency through clustering.
Data Source
AI summary
Websites, having associated features, are clustered by filtering entries that may be legitimate, determining feature similarity scores between the website features, and generating an aggregated similarity matrix containing website similarity scores between the websites. Websites are clustered into clusters or groups, based in part on the aggregated similarity matrix. Each cluster is identified by a cluster identifier and represents a centroid website and other websites at a normalized similarity score from the centroid. It is determined for each website whether the normalized similarity score is less than a threshold, and if so is identified as weakly-similar. Above the threshold, the website is labelled with the cluster identifier. Further clustering and thresholding is performed on the weakly-similar websites into additional clusters.