Website Structural Feature Clustering for Suspicious Entity Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing transaction processing systems struggle to detect and prevent malicious activities from copycat websites that mimic legitimate entities, leading to resource wastage and potential financial loss due to fraudulent transactions.
Innovation Solution
A neural network trained on structural features of websites, combined with clustering techniques, is used to identify suspicious websites in real-time by embedding website features into a latent space and predicting their suspiciousness based on cluster assignments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional transaction processing systems are used to detect malicious activities, then the system structure remains simple, but the detection accuracy and ability to identify copycat websites deteriorates
Solution Approach 1:
The patent introduces an intermediary detection system that acts as a mediator between users and transaction processing systems. This intermediary analyzes website structural features (HTML, CSS, JavaScript) and behavioral patterns to identify copycat websites before transactions occur, thereby improving detection accuracy without requiring changes to the core transaction processing system architecture
Solution Approach 2:
The system performs preliminary analysis of website structural features and behavioral patterns before transactions are initiated. By pre-identifying suspicious websites through feature extraction and comparison against known legitimate sites, the system prevents fraudulent transactions rather than detecting them after occurrence, thus improving detection accuracy
2Speed
If real-time detection of suspicious websites is implemented, then the speed of detecting fraudulent activities improves, but the computational resources and processing time required increases
Solution Approach 1:
The system extracts only the most critical structural features (HTML tags, CSS classes, JavaScript libraries) and behavioral patterns from websites for analysis, rather than processing all website content. This selective extraction enables real-time detection by reducing the volume of data that requires computational processing while maintaining detection accuracy
Solution Approach 2:
The system transforms website features into standardized parameter representations (feature vectors) that can be quickly compared against known patterns. By changing the representation parameters of website structural features into compact numerical formats, the system enables fast real-time comparison and classification with reduced computational overhead
3Measurement precision
If comprehensive analysis of website features is performed to improve detection accuracy, then the precision of identifying suspicious entities improves, but the processing time and system complexity increases
Solution Approach 1:
The detection system segments website analysis into distinct modular components: structural feature extraction (HTML, CSS, JavaScript), behavioral pattern analysis, and comparison against known legitimate sites. This segmentation allows parallel processing of different feature types, improving identification precision while reducing overall processing time through concurrent execution
Data Source
AI summary
Techniques are disclosed relating to automatically determining whether an entity is malicious. In some embodiments, a server computer system generates a feature vector for an unknown website, where generating the feature vector includes preprocessing a plurality of structural features of the unknown website. In some embodiments, the system inputs the feature vector for the unknown website into a trained neural network. In some embodiments, the system applies a clustering algorithm to a signature vector for the unknown website and signature vectors for respective ones of a plurality of known websites output by the trained neural network. In some embodiments, the system determines, based on results of the clustering algorithm indicating similarities between signature vectors for the unknown website and one or more of the signature vectors for the plurality of known websites, whether the unknown website is suspicious. Determining whether the entity is suspicious may advantageously prevent malicious (fraudulent) activity.