Phishing Web Resource Clustering Using Visual Contour Similarity

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing methods for clustering phishing web resources are labor-intensive and resource-consuming due to the excessive number of suspicious web resources analyzed, leading to inefficiencies in identifying phishing sites.

Innovation Solution

A method and computing device that clusters phishing web resources based on visual content images using contour extraction, filtering, and pairwise comparison of identified contours, with similarity scoring and clustering based on threshold values to reduce unnecessary analysis.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Speed

If web resource clusters are formed comprising a selection of web resources for analysis, then the speed of identifying malicious web resources is improved, but the number of suspicious web resources in clusters becomes excessive, leading to excessive labor intensity and resource consumption

Engineering Contradiction:
Improvespeed of identifying malicious web resourcesVSAvoidlabor intensity and resource consumption
Core Design Contradiction:
SpeedVSProductivity

Solution Approach 1:

The patent segments web resources into different clusters based on similarity analysis. By dividing the large set of suspicious web resources into smaller, more focused clusters, the system can process each cluster separately with reduced computational overhead. This segmentation allows analysts to concentrate on specific groups of similar resources rather than examining all suspicious resources individually, thereby reducing labor intensity while maintaining identification speed.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent performs preliminary clustering and filtering of web resources before detailed analysis. By pre-organizing web resources into clusters based on initial similarity metrics, the system prepares the data in advance so that subsequent malicious resource identification can be performed more efficiently. This preliminary action reduces the workload during the actual analysis phase by presenting pre-organized, smaller subsets of resources.

Inventive Principle:
Principle #10Preliminary action

2Reliability

If clustering is performed on all suspicious web resources, then comprehensive identification of phishing sites is achieved, but resource consumption and processing time increase significantly

Engineering Contradiction:
Improvecomprehensive identification accuracyVSAvoidprocessing time
Core Design Contradiction:
ReliabilityVSLoss of time

Solution Approach 1:

The patent extracts and removes already identified malicious web resources from the clustering process. By taking out known malicious resources and focusing clustering efforts on suspicious resources of unknown status, the system avoids redundant processing of already-analyzed items. This extraction approach maintains comprehensive identification accuracy by concentrating computational resources on the most uncertain cases while reducing overall processing time.

Inventive Principle:
Principle #2Taking out (Extraction)

Solution Approach 2:

The patent applies partial clustering by focusing on subsets of suspicious web resources that meet specific criteria rather than clustering all suspicious resources uniformly. By applying clustering selectively to the most promising or suspicious subsets, the system achieves reliable identification of malicious resources without the excessive processing time that would result from analyzing every single suspicious resource in detail.

Inventive Principle:
Principle #16Partial or excessive action

3Measurement precision

If visual content image analysis with contour extraction is used, then clustering accuracy is improved, but device complexity and computational requirements increase

Engineering Contradiction:
Improveclustering accuracyVSAvoidcomputational complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The patent replaces complex mechanical or manual analysis methods with automated computer vision-based contour extraction and image processing. By using algorithmic approaches to automatically extract visual features and contours from web resource screenshots, the system achieves high clustering accuracy without requiring manual intervention. This substitution of automated image processing for manual or simpler mechanical analysis methods improves precision while managing computational complexity through efficient algorithms.

Inventive Principle:
Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The patent creates visual content copies (screenshots) of web resources and performs contour extraction on these copies rather than analyzing the original web resources directly. By working with replicated visual representations, the system can apply complex image processing techniques to improve clustering accuracy without affecting the original resources. This copying approach allows for repeated analysis and experimentation with different contour extraction parameters while maintaining the integrity of the source materials.

Inventive Principle:
Principle #26Copying

Data Source

PatentUS12556576B2Method and device for clustering phishing web resources based on visual content image
Publication Date: 2026.02.17 GRP IB GLOBAL PTE LTD
  • US12556576B2 patent drawing
  • US12556576B2 patent drawing
  • US12556576B2 patent drawing

AI summary

A method for clustering phishing web resources based on visual content image, executed on a computer device comprising at least a processor and memory, and the method comprises the following steps: receiving references to a set of phishing web resources; retrieving at least one image of the visual content of each web resource of the set; processing the content of each visual content image associated with one of the set web resources, while contouring the elements on each image of the phishing web resource visual content; filtering the identified contours in each visual content image by removing the identical contours; combining the web resource associated with the compared contours and the cluster based on pairwise comparison of the identified contours and cluster contours, wherein, if the similarity value overrides the threshold value, otherwise, creating a new cluster for the web resource; storing references to web resources associated with corresponding contours of the content from a set of specified clusters in a database.