Phishing Web Resource Clustering Using Visual Contour Similarity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for clustering phishing web resources are labor-intensive and resource-consuming due to the excessive number of suspicious web resources analyzed, leading to inefficiencies in identifying phishing sites.
Innovation Solution
A method and computing device that clusters phishing web resources based on visual content images using contour extraction, filtering, and pairwise comparison of identified contours, with similarity scoring and clustering based on threshold values to reduce unnecessary analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If web resource clusters are formed comprising a selection of web resources for analysis, then the speed of identifying malicious web resources is improved, but the number of suspicious web resources in clusters becomes excessive, leading to excessive labor intensity and resource consumption
Solution Approach 1:
The patent segments web resources into different clusters based on similarity analysis. By dividing the large set of suspicious web resources into smaller, more focused clusters, the system can process each cluster separately with reduced computational overhead. This segmentation allows analysts to concentrate on specific groups of similar resources rather than examining all suspicious resources individually, thereby reducing labor intensity while maintaining identification speed.
Solution Approach 2:
The patent performs preliminary clustering and filtering of web resources before detailed analysis. By pre-organizing web resources into clusters based on initial similarity metrics, the system prepares the data in advance so that subsequent malicious resource identification can be performed more efficiently. This preliminary action reduces the workload during the actual analysis phase by presenting pre-organized, smaller subsets of resources.
2Reliability
If clustering is performed on all suspicious web resources, then comprehensive identification of phishing sites is achieved, but resource consumption and processing time increase significantly
Solution Approach 1:
The patent extracts and removes already identified malicious web resources from the clustering process. By taking out known malicious resources and focusing clustering efforts on suspicious resources of unknown status, the system avoids redundant processing of already-analyzed items. This extraction approach maintains comprehensive identification accuracy by concentrating computational resources on the most uncertain cases while reducing overall processing time.
Solution Approach 2:
The patent applies partial clustering by focusing on subsets of suspicious web resources that meet specific criteria rather than clustering all suspicious resources uniformly. By applying clustering selectively to the most promising or suspicious subsets, the system achieves reliable identification of malicious resources without the excessive processing time that would result from analyzing every single suspicious resource in detail.
3Measurement precision
If visual content image analysis with contour extraction is used, then clustering accuracy is improved, but device complexity and computational requirements increase
Solution Approach 1:
The patent replaces complex mechanical or manual analysis methods with automated computer vision-based contour extraction and image processing. By using algorithmic approaches to automatically extract visual features and contours from web resource screenshots, the system achieves high clustering accuracy without requiring manual intervention. This substitution of automated image processing for manual or simpler mechanical analysis methods improves precision while managing computational complexity through efficient algorithms.
Solution Approach 2:
The patent creates visual content copies (screenshots) of web resources and performs contour extraction on these copies rather than analyzing the original web resources directly. By working with replicated visual representations, the system can apply complex image processing techniques to improve clustering accuracy without affecting the original resources. This copying approach allows for repeated analysis and experimentation with different contour extraction parameters while maintaining the integrity of the source materials.
Data Source
AI summary
A method for clustering phishing web resources based on visual content image, executed on a computer device comprising at least a processor and memory, and the method comprises the following steps: receiving references to a set of phishing web resources; retrieving at least one image of the visual content of each web resource of the set; processing the content of each visual content image associated with one of the set web resources, while contouring the elements on each image of the phishing web resource visual content; filtering the identified contours in each visual content image by removing the identical contours; combining the web resource associated with the compared contours and the cluster based on pairwise comparison of the identified contours and cluster contours, wherein, if the similarity value overrides the threshold value, otherwise, creating a new cluster for the web resource; storing references to web resources associated with corresponding contours of the content from a set of specified clusters in a database.


