RU2778460C1 - Method and apparatus for clustering phishing web resources based on an image of the visual content - Google Patents

Abstract

FIELD: computing technology.

SUBSTANCE: proposed is a method for clustering phishing web resources based on an image of the visual content, implemented on a computer containing at least a processor and a memory, and including the stages of: receiving indications of multiple phishing web resources; extract an image of the visual content of each of said multiple web resources; processing the contents of each image of visual content linked with one of the multiple web resources, wherein the contours of elements are selected on each image of the visual content of the phishing web resource; the identified contours are filtered in each image of the visual content by removing identical contours; based on a pairwise comparison of the identified contours and contours of clusters, combining a web resource linked with the compared contours with the cluster; saving the indications of the web resources linked with the corresponding contours of the content from said multiple clusters in a database.

EFFECT: increase in the accuracy of clustering phishing web resources.

19 cl, 7 dwg

Description

FIELD OF TECHNOLOGY

[0001] This technical solution relates to the field of computer technology, in particular to the field of information security, namely to a method and a computing device for clustering phishing web resources based on the image of visual content, with the aim of further attribution of phishing websites, mirrors, blocked and/or prohibited websites.

BACKGROUND OF THE INVENTION

[0002] One of the most widespread types of malicious web resources is phishing sites. Their main goal is to obtain sensitive user data in order to commit fraudulent activities.

[0003] The principle of operation of phishing sites is to copy or imitate existing services of any brands, for example, banks, payment systems, e-mail, social networks, trademarks, in order to voluntarily receive confidential data from the user (login, password, mail, full name , ID document number, payment card details, etc.).

[0004] As an example, but not limited to, this may be a fake remote banking (RBS) site, on which the user is encouraged by various psychological tricks to enter registration data and / or provide additional confidential information. After that, the information received is used by fraudsters to steal the user's funds or other illegal actions.

[0005] It is worth noting that imitation of real services can also be carried out for the purpose of making money on advertising, displaying false or prohibited information, and also in the case of a mirror of an official resource in order to illegally distribute copyrighted or prohibited content. All of the described actions may harm the reputation of the owners of the original web resources or provide illegal access to inappropriate content.

[0006] Fitting distribution technologies allow you to create many sites of the same type using so-called phishing kits, which complicates their timely detection and blocking.

[0007] Phishing Kit is an archive file containing the scripts necessary to create and operate a phishing site. Such a tool allows attackers without deep programming skills to quickly deploy hundreds of phishing pages, often using them as "mirrors" of each other. If one such site is blocked, the fraudster activates another, if this one is blocked, the next one, and so on. Thus, a phishing kit allows attackers to quickly resume the operation of malicious resources, ensuring their own invulnerability. This explains the interest in them from cybersecurity specialists. Detection of phishing kits allows not only to find hundreds and even thousands of phishing pages, but more importantly, it can serve as a starting point for investigations in order to identify their authors and bring them to justice.

[0008] It is worth noting that in order to attract buyers, developers of phishing kits use well-known brands with a large audience in them, which in theory should make it easier for future owners of such kits to implement fraudulent schemes. In 2020, the most frequently used brands in phishing kits were Amazon, Google, Instagram, Office 365, and PayPal, while Exploit, OGUsers, and Crimenetwork were featured in the top 3 online marketplaces for trading phishing kits.

[0009] In the simplest case, the identification of phishing web resources is based on a comparison of the URL with databases of compromised URLs. More complex methods can be based on the analysis of the structural elements of the page.

[0010] From US patent No. 8856937 (publ. 07.10.2014) a method and system for detecting malicious web resources is known. This known method involves creating and updating a database of web resources containing legitimate web resources, suspicious web resources, and malicious web resources. Classification of web resources is based on comparison of screenshots of web resources with legitimate and phishing web resources contained in the database.

[0011] Patent CN 101826105 B (published 02/05/2019) describes a method for detecting phishing pages based on matching web page elements, namely, calculating the optimal matching of graphs to search for matching pairs of functions among different web page signatures. The method is also characterized by determining intrinsic weights of text features, image features by determining relative weights among text similarity, and images when computing web page similarity using log regression analysis.

[0012] To expedite the process of identifying malicious web resources, which can be done using, for example, the systems and methods disclosed in the prior art documents above, web resource clusters can be formed containing a sample of web resources that further analyzed to identify among them, for example, web resources involved in phishing.

[0013] US 10200381 B2 (published Feb. 5, 2019) and US 8381292 B1 (published Feb. 19, 2013) disclose methods for protecting a brand from phishing based on comparing the profiles of a potentially phishing resource with the basic (desired) templates of brand web pages.

[0014] One of the drawbacks of known devices and methods for clustering web resources, for example, disclosed in the source US 2015/0067839 (publ. 03/05/2015), is an excessive amount of analyzed suspicious web resources contained in the resulting clusters, which in in turn, causes excessive labor and / or resource intensity of checking all these suspicious web resources in the resulting clusters to identify among them web resources that are copies of the original web resources or contain at least some elements of the content of the original web resource, with the provision of their subsequent analysis for involvement in phishing activities.

[0015] Preparing target clusters of web resources, where the web resources are highly likely to be copies of the original web resource and involved in, for example, phishing activities, is an important aspect to improve the speed and accuracy of detecting malicious web resources. Many well-known technical solutions are aimed at the most accurate preparation of target clusters of web resources, however, as noted above, these well-known technical solutions have a number of disadvantages and require improvement.

[0016] Also known in the prior art is the solution RU 2676247 C1 (publ. 12/26/2018), which is chosen as a prototype, solving the problem of automated filtering of an array of suspicious web resources to identify essentially all phishing web resources that duplicate at least part content from a specific original web resource, thanks to the ability to create a database containing only suspected phishing web resources, each of which can then be automatically and / or manually analyzed for involvement in malicious phishing activities. Automated filtering of the entire array of identified suspicious web resources, in turn, can significantly reduce the computing resources of a computer device and its memory resources necessary to identify the involvement of the analyzed web resources in the commission of malicious actions related to phishing, due to the fact that not the entire array is analyzed suspicious web resources, but only a limited set of web resources associated with the original web resource and highly likely to be related to phishing due to duplication of the content of the original web resource, which is legitimate.

[0017] However, this solution is aimed at clustering based on elements extracted from the page during collection, in contrast to this solution, in which elements are extracted from the image of a web resource, which improves the accuracy of the approach, since different phishing pages, using different brands can be the same script (JavaScript), or the same icon, or the same signatures in the HTML code. The advantage is that what is being parsed is already-rendered content, i.e. content obtained after the browser takes steps to convert HTML, CSS, and JavaScript into a visual image, rather than code data. This approach leads to a decrease in the frequency of false positives.

[0018] Thus, in the future, it is necessary to improve devices and methods for clustering web resources, in particular for preparing such clusters of web resources that would reduce the complexity and / or resource intensity of their subsequent check for involvement, for example, in phishing, by using advanced computer vision technologies coupled with an advanced clustering algorithm.

[0019] Therefore, the present technical solution is designed to overcome at least one of the above disadvantages of known devices and methods for clustering the content of phishing web resources.

SUMMARY OF THE INVENTION

[0020] The technical problem to which the claimed solution is directed is the creation of a method and a computing device for clustering phishing web resources based on an image of visual content. Additional embodiments of the present invention are presented in dependent claims.

[0021] The technical result is to increase the accuracy of clustering phishing web resources based on the image of visual content.

[0022] The claimed result is achieved by implementing a method for clustering phishing web resources based on an image of visual content, executed on a computer device containing at least a processor and memory, the method comprising the steps of:

get directions to a lot of phishing web resources;

extracting at least one visual content image of each of the plurality of web resources;

processing the content of each visual content image associated with one of the plurality of web resources, wherein

highlight the contours of the elements on each image of the visual content of the phishing web resource;

filtering the identified contours on each image of the visual content by removing the same contours;

based on a pairwise comparison of the identified contours and contours of the clusters, the web resource associated with the compared contours is combined with the cluster,

moreover, if the similarity value overcomes the threshold value,

otherwise, create a new cluster for the web resource;

storing pointers to web resources associated with respective content paths from the plurality of said clusters in a database.

[0023] In a particular embodiment of the described method, the set of web resources includes at least two web resources.

[0024] In a particular embodiment of the described method, to obtain indications of a plurality of web resources, a network scan is preliminarily performed.

[0025] In a particular embodiment of the described method, pointers to a plurality of web resources are obtained at least in part from an external source over a data network.

[0026] In a particular embodiment of the described method, pointers to a plurality of web resources are obtained from a pre-formed database of web resources.

[0027] In a particular embodiment of the described method, at least the following contours of the elements contained in the visual content image are distinguished: logos, letter outlines, individual words, pictures, forms.

[0028] In a particular embodiment of the described method, at least the following methods are used to extract contours: a Canny edge detector and a contour search algorithm.

[0029] In a particular embodiment of the described method, when processing the content of each received image of visual content, small, oblique and elongated contours are additionally removed.

[0030] In a particular embodiment of the described method, the detected contours are filtered on each visual content image by removing identical contours, and

if the compared contours differ in height and / or width by more than two pixels, then they are considered different

[0031] In a particular embodiment of the described method, the detected contours are filtered on each visual content image by removing identical contours, and

if the compared contours differ in height and/or width by two pixels or less, then

contours superimposed on each other, and

calculate the pixel-by-pixel difference of images,

moreover, for the obtained difference image, a similarity score is calculated in the range from 0, where the images are the same, to 100 - the images are completely opposite,

moreover, the similarity score (P) is calculated as the arithmetic mean of the pixel values, that is, the sum of the pixel values divided by the number of pixels in the image, moreover, calculated for the values taken from all three RGB channels:

where Ri, Gi, Bi - the value of the i-th pixel in the channels R, G and B, respectively, and N - the total number of image pixels,

moreover, the contours whose similarity score does not exceed 7 are deleted.

[0032] In a particular embodiment of the described method, in addition, for each contour identified in the visual content image, invariant visual hash functions are calculated

[0033] In a particular embodiment of the described method, if, when compared with cluster images, less than three similar contours are found on the image of the visual content of the phishing web resource, then a message is displayed that it is not informative, and in this case, a new image of visual content is not added to the cluster, but if there are less than two images in the cluster, then the cluster is deleted;

if the comparison reveals from three to five similar contours, then to add an image of the visual content of a phishing web resource to a certain cluster, all the contours of the cluster must match;

if during the comparison five to ten similar contours are found, then to add an image of the visual content of a phishing web resource to a certain cluster, half of the contours must match the contours of the cluster,

if the comparison reveals from ten to fifteen similar contours, then to add an image of the visual content of a phishing web resource to a certain cluster, a quarter of the cluster contours must match,

if the comparison reveals more than fifteen similar contours, then to add an image of the visual content of a phishing web resource to a certain cluster, at least a fifth of the cluster contours must match.

[0034] In a particular embodiment of the described method, when the image of the visual content of a phishing web resource is assigned to several clusters, it is added to the cluster with the largest number of contour matches.

[0035] In a particular embodiment of the described method, after clustering each of the plurality of visual content images of phishing web resources, clusters containing less than three images are removed.

[0036] In a particular embodiment of the described method, images that were contained in remote clusters are entered into a special list and are temporarily considered garbage.

[0037] In a particular embodiment of the described method, additionally, based on each image of visual content contained in the list, an adjacency matrix is created, in which the number of matching contours is located at the intersection, to identify a list of pairs of similar contours in size.

[0038] In a particular embodiment of the described method, in addition to determining the association of at least two images of visual content of web resources in the adjacency matrix, the value is changed to 0 if the number of contours matching in size is less than a specified threshold, or to 1 if the number of contour matches more than the threshold.

[0039] In a particular embodiment of the described method, strongly connected graph components are calculated, in which there are more than two images, and a new cluster is created for each of the identified components.

[0040] The claimed result is also achieved by implementing a computing device for clustering phishing content, containing a memory for storing machine-readable instructions and at least one computing processor capable of executing machine-readable instructions to ensure the implementation of the phishing content clustering method.

DESCRIPTION OF THE DRAWINGS

[0041] The implementation of the invention will be described hereinafter in accordance with the accompanying drawings, which are presented to explain the essence of the invention and in no way limit the scope of the invention. The following drawings are attached to the application:

[0042] FIG. 1 illustrates a simplified schematic representation of one of the non-limiting implementations of the system for implementing the present technical solution.

[0043] FIG. 2 illustrates one non-limiting implementation of representing information about web page resources in a resource database.

[0044] FIG. 3 illustrates a flowchart according to an aspect of the present method for clustering phishing web resources based on a visual content image.

[0045] FIG. 4 illustrates a non-limiting example of a first web resource.

[0046] FIG. 5 illustrates a non-limiting example of a second web resource.

[0047] FIG. 6 illustrates a non-limiting example of a third web resource.

[0048] FIG. 7 illustrates a simplified schematic representation of one of the non-limiting implementations of a computing device for implementing the present technical solution.

DETAILED DESCRIPTION OF THE INVENTION

[0049] In the following detailed description of the invention, numerous implementation details are provided to provide a clear understanding of the present invention. However, one skilled in the art will appreciate how the present invention can be used, both with and without these implementation details. In other instances, well-known methods, procedures, and components have not been described in detail so as not to unnecessarily obscure the features of the present invention.

[0050] In addition, from the foregoing it will be clear that the invention is not limited to the above implementation. Numerous possible modifications, changes, variations and substitutions that retain the spirit and form of the present invention will be apparent to those skilled in the subject area.

[0051] Note that in the context of the present description, unless specifically indicated otherwise, the term "content element" or "content" refers to any data that can be represented (visually, in audio format or otherwise) that can contain a web resource. Thus, a content element for the purposes of this technical solution may be, in particular, a font, a menu element, a web resource template, a form to fill out, written text, an image, a part of an image, graphics, animation, video, music, voice recording, and so on. further, as well as any combination of them. In particular, any other resources that can be transferred via the http/https protocols are also content.

[0052] Additionally, this description discloses the term image of the visual content of a web resource, which is understood as a screenshot (screenshot - "screenshot"), that is, an image received by a computing device and showing exactly what the user sees on the screen of a monitor or other visual output devices.

[0053] Contours (boxes) - selected on the image of visual content, that is, on the screenshot, rectangular elements, for example, buttons, input fields, company logos, title inscriptions, etc.

[0054] Clusters are groups of visual content images (screenshots) formed on the basis of the coincidence of unique contours (boxes) identified on them for a specific phishing set. Each cluster is also associated with, for example, stored in a database with an indication of a specific cluster, a set of links (indications) to phishing pages corresponding to images of visual content, and having much in common with each other (for example, aimed at one specific company or similar to each other by landing page).

[0055] As used herein, unless expressly stated otherwise, a "pointer" or "pointer" to an information element may be the information element itself or a pointer, referral, link, or other indirect means to allow the recipient of the indication to locate a network, memory, database or other computer-readable medium from which the information element can be retrieved. For example, a web resource locator may include a web resource file or set of files, or it may be a generic resource locator (eg, a URL such as www.webpage.com) that identifies a web resource with respect to a particular web. (in particular, the Internet), or it may by some other means convey to the recipient an indication of a network folder, memory address, table in a database, or other place where a web resource or its individual content elements can be accessed. As will be appreciated by those skilled in the art, the degree of precision required for such an indication depends on the degree of prior understanding of how the information exchanged between the pointer's recipient and sender is to be interpreted. For example, if it is known prior to the transmission of data between the sender and receiver that the information element pointer takes the form of a URL universal resource locator, passing the pointer, a link to that web resource, is all that is necessary to efficiently convey the web resource to the recipient, even though that the information element itself (for example, a web resource or a separate element of its content) was not transferred between the sender and recipient of the indication.

[0056] In the context of the present description, unless specifically indicated otherwise, the words "first", "second", "third", etc. are used as adjectives solely to distinguish the nouns they refer to from each other, and not for the purpose of describing any particular relationship between those nouns. Thus, for example, it should be kept in mind that the use of the terms "first web resource" and "third web resource" does not imply any order, categorization, chronology, hierarchy, or ranking (for example) of web resources in a set web resources, as well as their use (in itself) does not imply that some "second web resource" must necessarily exist in this or that situation. Hereinafter, as indicated herein in other contexts, the mention of the "first" element and the "second" element does not exclude the possibility that these are the same actual real element. Thus, for example, in some cases, the "first" server and the "second" server may be the same software and/or hardware, and in other cases they may be different software and/or hardware.

[0057] Additional and/or alternative features, aspects, and advantages of embodiments of the present technical solution will become apparent from the following description, the accompanying drawings, and the appended claims.

[0058] In FIG. 1 is a simplified schematic representation of one of the non-limiting implementations of a phishing content clustering system 100 for implementing the present technical solution.

[0059] In some non-limiting embodiments of the present technical solution, the system 100 providing the implementation of the method may include a data network 110, at least one computing device 120 for determining malicious web resources, and a database 130.

[0060] System 100 may also include at least one search server 140 having access to a web resource database 130.

[0061] In yet another non-limiting embodiment of the present invention, system 100 may additionally include active network equipment (not shown) and a client device (not shown).

[0062] The data network 110 may be, for example, the Internet or any other computer network.

[0063] Computing device 120 may be a conventional computer server. In an exemplary embodiment of the present technical solution, device 120 may be a Dell™ PowerEdge™ server, or may be any other suitable hardware and/or application software and/or system software, or a combination thereof.

[0064] Possible embodiments of computing device 120 are well known. Thus, it is sufficient to note that device 120 includes, among other things, a network data interface (eg, modem, network card, and the like) for two-way communication over a data network (not shown); and a processor 121 coupled to the network data interface, the processor 121 being configured to execute various algorithms, including those described below. To this end, the processor 121 may have access to computer-readable instructions stored on a computer-readable medium (not shown), the execution of which causes the processor 121 to execute the various procedures described hereinafter.

[0065] In some embodiments of the present technical solution, the computing device 120 includes at least one database 122 that is configured to store at least a portion of references to content elements, content elements, groups of content elements, and an indication of a web site. resources associated with the corresponding content element or group of content elements. Thus, by way of example, a web resource that has all of the content elements in a content element group is associated with that content element group.

[0066] It is worth noting that database 122 may be implemented as part of computing device 120 or otherwise be available to computing device 120.

[0067] An embodiment of system 100 is exemplary in which computing device 120 includes a computer-readable medium (not shown) on which computer-readable instructions and/or a database 122 may be previously stored. Alternatively or additionally, device 120 may have access to computer-readable instructions. and/or database 122 located on other equipment. How exactly the access of the processor 121 of the computing device 120 to machine-readable instructions and the database 122 is implemented is not a limiting condition of the present technical solution.

[0068] The processor 121 is configured to obtain indications of a plurality of web resources. For example, as a non-limiting example, getting directions to multiple web resources can be getting a list of Uniform Resource Locators (URLs). Additionally, it is worth noting that the sources of indications to many web resources may be different.

[0069] An embodiment of the present technical solution is possible, in which the processor 121 is configured to receive indications of a plurality of web resources at least in part from an external source over the data network 110. For example, the external source may be a search server 140 having access to a web resource database 130 and/or a malicious web resource collection server (not shown), etc. Moreover, the computing device 120 may have access to a database of web resources 130 over a data network 110. Alternatively or additionally, an external source may be a web resource that includes indications on a variety of web resources (for example, a verified database of phishing web resources, like Google Safe Browsing (GSB), OpenPhish (OP) It is worth noting that exactly how and by what principle the indications to web resources are grouped on an external source, in particular, in the web resource database 130 is not a limiting condition.

[0070] Embodiments of search server 140 are well known. Thus, it is sufficient to note that the search server 140 includes, among other things, a network communication interface (eg, modem, network card, and the like) for two-way communication over the data network 110; and a processor (not shown) coupled to a network communications interface, the processor being configured to search for web resources on the communications network 110 and store them in a database 130. To this end, the search server processor may have access to appropriate machine-readable instructions. stored on a computer-readable medium (not shown).

[0071] Thus, the process of populating and maintaining a database of web resources 130 is generally known as data mining (or crawling, from the English "crawling"), and the search server 140 is configured to browse various web resources available over the network 110 data transmission, and store them in the web resource database 130 according to one or more predefined parameters. By way of example, and not limitation, the search server 140 may scan the data network 110 and store all new and updated web resources and thus collect the complete web resource base of the data network 130, and/or collect web resources, for example, including certain keywords in one or more languages. Since malicious web resources (in particular, phishing websites) usually try to imitate the websites of banks, payment systems and e-mail services, the keywords can be, for example, but not limited to: “bank”, “credit”, “card” , etc. The search can also be performed by domain names, and/or other parameters. The found and selected indications of web resources are stored in the database of web resources 130, after which they can be received by the processor of the computing device 120 over the data network 110 from the search server 140.

[0072] In addition, the search server 140 is configured to explore at least a portion of the content elements of each web resource of the plurality of web resources. The content elements of a web resource may be content element files and/or hash sums of content element files (eg, hash sums computed by the sha256 algorithm). The content element file format is not particularly limited in any way, and will depend on the type of the particular content element. For example, for the case where the content element is an image, the file can be represented in particular in one of the following formats: "jpg", "jpeg", "png", "bmp", "gif", etc. For in the case where the content element is text, the file may be represented in particular in one of the following formats: "txt", "doc", "html", etc. For the case where the content element is a font, the file may be represented, in particular, in one of the following formats: "woff", "ttf, "eot", "svg", etc. For the case where the content element is a script, the file may be represented in particular in one of the following formats: "asp", "aspx", "php", "jsp", "cgi", etc. For the case where the content element is an animation or a video, the file may be represented in particular in one of the following formats: "flv", "swf, "avi", "mp4", "mov", etc. For in the case where the content element is a cascading style sheet, the file may be represented, in particular, in the format "ess" The specified list of possible content elements and the formats in which they can be presented is not a limiting condition of the present technical solution.

[0073] The retrieval of elements, as well as the creation of images of visual content (screenshots) of found web resources, can be performed by the search server processor 140 using specially written scripts and / or scripts for browsers.

[0074] In addition, it is worth noting that in another non-limiting embodiment of the present technology, the described function for creating images of visual content can be performed by computing device 120.

[0075] In one of the private embodiments of the present technology, an image of visual content (screenshot) can be obtained by using the Selenium WebDriver web browser automation tool using the <.save_screenshot(filename)> or <.get_screenshot_as_file(filename)> method and stored in database 122.

[0076] Alternatively, an embodiment of the present technical solution is possible, in which the processor 121 of the computing device 120 is configured to obtain an indication of a plurality of web resources directly from a pre-generated web resource database 130. Moreover, the pre-generated web resource database 130 may be available to computing device 120 over the network.

[0077] An embodiment of the present technical solution is possible, in which the processor 121 is configured to scan the network 110 for indications of a plurality of web resources, and thus the computing device 120 can perform the functions of the search server 140 described above. For example, the network scan can be performed by IP addresses of web resources, domain names, keywords and other parameters.

[0078] The processor 121 of the computing device 120 is configured to process the received items as well as the visual content images of the web resources to cluster phishing content and group them based on certain similarity thresholds.

[0079] With reference to FIG. 2 shows an illustrative example of a database 122 containing data about content element paths (122a) and web resources (122b) associated with respective content element paths.

[0080] In the example database 122 shown, there is a cluster of associated web resources 300, 400, 500, based on the identified element boxes 302, 303, 306, 307, 308, 311, 312, 313.

[0081] It is worth noting that the quantity and quality of filling the database 122 is not limited in any way, the examples of content element boxes and their associated web resources are only for the purposes of providing an understanding of the present technical solution and are not limiting. Obviously, populating the database 122 can be much more complex.

[0082] Next, with reference to FIG. 3, the claimed method for clustering phishing web resources based on a visual content image will be discussed in more detail, which is performed in accordance with non-limiting embodiments of the present technical solution (200).

[0083] Method 200 may be performed on computing device 120, and more specifically, its processor 121, in accordance with a non-limiting embodiment of system 100 shown in FIG. 1. Also with reference to, FIG. 4, Fig. 5 and FIG. 6 we consider an illustrative example of the implementation of the method.

[0084] In FIG. 4 shows an example of a virtual content image for a web resource 300, including a plurality of outlines 301-314. At the same time, the contours 302-306 are a button element for redirecting from this resource to any third-party resource, the contours of elements 301, 307-311 are brand logos, the contours 312-313 are signs, and 314 is a selected rectangular area containing the rest of the elements.

[0085] In FIG. 5 shows an example of a virtual content image of a second web resource 400 including a plurality of content elements. However, some content element outlines, namely 302-314, are also present in the first web resource 300 and are described above. Additionally, the web resource 400 has elements 401, 402, 403.

[0086] In FIG. 6 shows an example of a third web resource 500, including content elements 301,302, 303, 306, 307, 308, 311,312, 313, 501. Content elements 302, 303, 306, 307, 308, 311, 312, 313, which are also present in the first and second web resource, as well as 301 associated only with the first web resource, have been described above. The 501 content element is a line that contains buttons to navigate to third-party web resources.

[0087] In the context of the present technical solution, the number and types of various content elements are not a limiting condition. The web resources in FIG. 4 FIG. 5 and FIG. 6 are presented only as illustrative examples, it is obvious that the present technical solution can also be applied to any other web resources that have more or less content elements, and the types of content elements and the content itself may or may not be repeated within the same same web resource. Some of the content elements present on the presented illustrative examples of web resources are not numbered.

[0088] FIG. 3 contains flows according to an aspect of the present method (200) for clustering phishing web resources based on a visual content image, which will be discussed in more detail below.

STEP 210 GET INDICATED TO MANY PHISHING WEB RESOURCES

[0089] Accordingly, method 200 begins at step 210, where computing device 120 receives indications of at least one web resource containing phishing content.

[0090] References to a plurality of web resources can be both the web resources themselves, and, for example, links to web resources, URLs available over a data network 110 or other network (not shown), computing device 120.

[0091] In view of a non-limiting illustrative example, the computing device 120 at step 210 receives indications of a set of three web resources 300, 400 and 500 from an external source - a search server 140 from a web resource database 130. It is worth noting that the web resources 300, 400, and 500 were previously found by the search server 140 and stored in the web resource database 130. Also, indications of a plurality of web resources could be obtained at least in part from the pre-generated web resource database 130, and a further embodiment is possible method 200, in which the computing device 120 can obtain indications of a plurality of web resources directly from the web resource database 130.

[0092] Additionally, an embodiment of method 200 is possible in which computing device 120 scans data network 110 to obtain indications of a plurality of web resources. Scanning data network 110 may be performed by computing device 120 in a manner similar to search server 140 as described above or otherwise, with the help of available software that can search for the given parameters on the network.

[0093] An embodiment of the method 200 is possible, in which, at step 210, a plurality of web resources are obtained from at least two different sources. For example, the web resources 300 and 500 are referenced from the search server 140 from the web resource database 130, and the web resource 400 is obtained from another external source (not shown, for example, from a special external database of phishing web resources) by data networks 110.

[0094] It is also possible an additional embodiment of the method 200, in which the received URL indication leads to a folder with files (for example, js, ess, image, etc.), and does not correspond to the usual display of web pages, then the system 100 over the network 110 connects to an external service (not shown), for example, to 'scan-open-dir', which performs an examination of all folders found at the specified address, and also returns the result back to the system 100, which, using specially written parsers, processes this information and distributes its in the database 122.

[0095] Method 200 then proceeds to step 220.

STEP 220 EXTRACT AT LEAST ONE IMAGE OF VISUAL CONTENT OF EACH OF THE PLUS WEB RESOURCES.

[0096] Step 220 - retrieve at least one image of the visual content of each of the plurality of web resources.

[0097] In non-limiting embodiments of the present invention, an image of the visual content may be made by the search server 140 and stored in the database 130, or made by the processor 121 of the computing device 120 and stored in the database 122 by any well-known method.

[0098] In particular, for an illustrative example, such methods include the use of virtual browsers (eg, Selenium). An extension is installed in the virtual browser settings, the cache is cleared, a transition to a web resource is performed, after which images of the visual content of the content of this web resource are automatically saved in the specified location. In addition, any available software can be used for the same purposes, a script written in any programming language and capable of being interpreted by the system to obtain the desired image of visual content.

[0099] Next, after the step of extracting the visual content image, the method proceeds to step 230.

STEP 230 PROCESS THE CONTENT OF EACH EXTRACTED VISUAL CONTENT IMAGE ASSOCIATED WITH ONE OF THE Plenty of WEB RESOURCES.

[0100] At this stage, the content of each extracted image of visual content associated with one of the plurality of web resources is processed.

[0101] This step, in the preferred embodiment of the technology described herein, includes at least the following sub-steps:

highlighting the contours of elements on each image of the visual content of the phishing web resource;

filtering the detected contours on each visual content image by removing identical contours.

[0102] At this stage, the contours of at least the following elements of the content of the visual content image are selected: logos, letter outlines, individual words, pictures, shapes. This can be done with a Canny edge detector and an edge search algorithm.

[0103] It is worth noting that the contours in the image of visual content are those curves in the image along which there is a sharp change in brightness, color or other image parameters. Therefore, the goals of converting an image into a set of curves are: highlighting the essential characteristics of the image and reducing the amount of information for subsequent analysis.

[0104] Accordingly, at least the following steps are performed in the process of contour extraction using the Canny edge detector:

remove noise and unnecessary details from the image of visual content by applying a Gaussian filter, calculate the first derivatives (magnitudes and directions) of the pixel intensity function in the horizontal and vertical directions by applying the Sobel operator,

select pixels that potentially belong to the edge using the non-maximum suppression procedure, and the pixels that correspond to the vectors of derivatives in directions, which are local maxima, are considered potential candidates for belonging to the edge;

and double pruning is performed, i.e. "strong" and "weak" edges are distinguished, where pixels whose intensity exceeds the maximum threshold are considered pixels belonging to "strong" edges. It is assumed that pixels with intensity within the interval from the minimum to the maximum threshold value belong to "weak" edges. Pixels whose intensity is less than the minimum threshold are discarded and excluded from further consideration. The resulting edges contain pixels of all "strong" edges and those pixels of "weak" edges whose neighborhood contains at least one pixel of "strong" edges.

[0105] It is worth noting that further, an algorithm for detecting edges on the image of visual content is additionally applied. In this technical solution, the use of a specific algorithm for detecting edges in an image is not a limiting point, so any known method can be used. As an example, but not limited to, such methods include: the Kirsch operator, the Robins operator, the Marr-Hildreth and Harris algorithms, as well as its modifications: Shea-Thomas, Harris-Laplace, etc.

[0106] After selecting the contours, additional cleaning (removal) of small, inclined and highly elongated contours is performed. It is worth noting, by way of example, but not limitation, that paths that are smaller than 350 pixels can be considered small, and those that are less than 10 pixels wide or height are considered strongly elongated. Sloped contours are those whose borders are not parallel to the sides of the visual content image.

[0107] The cleaning criteria can be pre-defined by an expert or automatically generated based on statistical data on the use of content elements in a variety of web resources. For example, if the number of web resources associated with a given content element exceeds a predetermined threshold, it may be considered a standard content element. The threshold value can be set manually by the operator, or selected using various automated algorithms, including those based on machine learning.

[0108] In the preferred embodiment of the present technology, processor 121 of computing device 120 performs a pairwise comparison of similar contours, wherein:

if the compared contours differ in height and/or width by more than 2 pixels, then they are considered different;

if the compared contours differ in height and/or width by 2 pixels or less, then the contours are superimposed on each other and the pixel-by-pixel difference of contour images is calculated, and for the resulting image, a similarity score is calculated in the range from 0, when the images are the same, to 100, when the images completely different

in this case, the contours, the similarity score of which does not exceed 7, are removed.

[0109] As described above, the similarity score (P) is calculated as the arithmetic mean of the pixel values (1), that is, the sum of the pixel values divided by the number of image pixels, and calculated for the values taken from all three RGB channels:

where Ri, Gi, Bi - the value of the i-ro pixel in the R, G and B channels, respectively, and N - the total number of pixels in the image.

[0110] It is worth noting that in one embodiment of the present technology, scale-invariant visual hash functions are used for each contour identified in a visual content image. Scale-invariant hashing is useful when, for example, the same visual content is displayed at different scales on different device hardware and operating systems. These hash functions themselves can be any well-known.

[0111] In one alternative implementation, it is possible to use a method for removing similar contours, in which:

if the compared contours differ in height or width by more than 2 pixels, then they are considered different;

if one of the contours is greater than the other, then 9 possible locations of the smaller contour are sequentially compared in the larger one, the difference between the contours superimposed on each other is calculated, the similarity estimate (1) is calculated for the difference, and at the same time, the contours are removed, the difference of which does not exceed the established threshold.

[0112] It is worth noting that when performing an alternative implementation of the present technology, less than 9 locations of one contour in another contour can be obtained, depending on the difference in one of the coordinates.

delta относительно левого верхнего угла. Такие же действия могут быть выполнены и в случае, когда контуры различаются по высоте.[0113] In an alternative implementation of the present technical solution, in the case when one of the contours is larger than the other, the difference in width is taken as delta (delta), and at least one location is searched to obtain a pixel-by-pixel difference of images with offsets: 0,

delta is relative to the top left corner. The same actions can be performed in the case when the contours differ in height.

delta относительно левого верхнего угла и далее сравнивают их так, что первый контур лежит внутри другого. Соответственно, максимальная разница по высоте/ширине может быть 2 пикселя, поэтому рассматривают смещения, например, в 0, 1 и 2 пикселя, при этом контур, который больше по ширине/высоте обрезают по соответствующему размеру меньшего контура, то есть если разница между контурами была 2 пикселя по ширине, то большой контур обрезают тремя способами: справа 2 пикселя; слева и справа по 1 пикселю; и слева 2 пикселя. Далее при сравнении полученных контуров вычисляется оценка похожести (1), и если контуры похожи, один из них удаляется. Причем в данном случае если в любом из 9 наложений оценка окажется меньше порога, то контуры считают похожими.[0114] In an illustrative embodiment of the present technical solution, in the case when the first contour is larger in width and the second in height, the contours are aligned in width using at least the following offset options: 0,

delta relative to the upper left corner and then compare them so that the first contour lies inside the other. Accordingly, the maximum difference in height/width can be 2 pixels, therefore, offsets are considered, for example, in 0, 1 and 2 pixels, while the contour, which is larger in width/height, is cut to the corresponding size of the smaller contour, that is, if the difference between the contours was 2 pixels wide, then the large outline is cut in three ways: on the right 2 pixels; left and right 1 pixel each; and 2 pixels to the left. Further, when comparing the obtained contours, the similarity score (1) is calculated, and if the contours are similar, one of them is removed. Moreover, in this case, if in any of the 9 overlays the estimate is less than the threshold, then the contours are considered similar.

[0115] Next, the method proceeds to step 240.

The step 240 in pairs compares the identified contours and contours of clusters, and in response to the fact that the assessment of similarity overcame the threshold value, the image of the visual content containing compared contours with a cluster is combined, and in the opposite case, a new cluster is created for this image of visual content.

[0116] At step 240, a pairwise comparison of the detected contours and contours belonging to the clusters is performed, and if the similarity score (1) exceeds a threshold value, a visual content image is added to the cluster; if the score does not exceed the threshold, then a new cluster is created for the given visual content image.

[0117] In non-limiting embodiments of the present technology, clusters are formed groups of images associated with web resources based on the similarity of identified unique contours (boxes).

[0118] In non-limiting versions, the cluster structure is at least a collection of: directly images of visual content, correlated with a pointer to it, as well as detected contours in the image, while additionally for each contour in the cluster, the time of its last match and the number of subsequent mismatches are stored when adding a new image to the cluster.

[0119] As an illustrative example, as previously stated, after the first visual content image 300 is added to the cluster, all paths selected on it become cluster paths. Further, when the visual content image 400 is added, the contours 302, 303, ...314 coincide with the contours identified in the image 300 and the time of their coincidence is set in accordance with them. The contour 301 is assigned the number 1, which indicates that this contour did not match when a new image was added to the cluster once, and the contours 401, 402, 403 are added to the cluster contours. Further, when visual content image 500 is added to this cluster, contours 301, 302, 303, 306, 307, 308, 311, 312, 313 are assigned a new time of their coincidence, and for contours 304, 305, 309, 310, 314, 401, 402, 403 mismatch counter incremented; moreover, contour 501 is added to the contours of the cluster.

[0120] In accordance with the present technical solution, after a pairwise sequential comparison of images of visual content in the case of overcoming the threshold value, the contour is added to the cluster, while in the described case, all new contours are added corresponding to the image of visual content associated with the cluster in the database 122. Match in this case, it is considered that the similarity score P (1) exceeds a predetermined threshold value.

[0121] By way of example, but not limitation, with reference to FIG. 3, 4, 5, method 200 starts by processing the first image of the visual content shown in FIG. 3, further, as mentioned above, the specified image is processed, revealing contours on it. After that, the identified contours are compared in pairs with the contours of the clusters (at the moment described, there are no cluster contours in the database 122 and their counter is set to 0) and a new cluster is created containing the visual content image shown in Fig. 3, since the similarity score P (1) in none of the cases exceeds the similarity threshold. At the same time, the created cluster contains an image of visual content, a pointer to it, as well as all the contours identified in the image, namely 301, 302…312. The method then proceeds to clustering the second visual content image shown in FIG. 4. It should be noted that this visual content image has the same contours with the cluster formed earlier based on the processing of the first visual content image (302…313). The number of matching contours of the web resource 400 and the contours of the cluster created on the basis of the visual content image of the web resource 300 exceeds the allowed threshold, which means that the image of the web resource 400 is added to the cluster, while the contours 401, 402 are detected only for the web resource 400 are added to the cluster outlines.

[0122] An embodiment of the present technical solution is possible, in which the processor 121 is configured to process each contour in multi-threaded mode, namely, to find in the database 122 all contours, the difference in size with which does not exceed a given number of pixels, for example, two pixels in width and / or height, and form many similar contours from them.

[0123] Accordingly, in embodiments of the described technology, at least two tables are formed in the database 122, wherein the first table includes information on the number of images in which each of the contours detected in the visual content images was detected, each of available clusters, and the second table is about the total number of circuits included in each cluster. Based on the information contained in the generated tables, clusters are eliminated (removed) in which the total number of matching contours is less than 85% of the number of visual content image contours associated with it. In this case, if after the screening procedure more than fifteen clusters remain for further verification, then fifteen clusters with the largest number of matches are selected from them.

[0124] Below will be exemplary versions of the above tables, namely table 1, which includes information about the belonging of each of the identified contours to each of the clusters, and table 2, containing information about the total number of contours in each cluster. It should be further noted that the specific data in Tables 1 and 2 is provided for illustrative purposes only, instead of these data there may be any other numerical values obtained by performing the method 200, including tables may contain other numbers of rows and columns.

[0125] In an embodiment of the present technical solution, further in a multi-threaded mode, the contours of each cluster stored in the database 122 and the contours of the analyzed visual content image are further compared, while combining the matched contours and highlighting all clusters in which there were matched contours in accordance with table 1.

[0126] In addition, at this stage, in order to add the visual content image to the cluster, a multi-threaded comparison of each of the contours detected in the image with each of the contours present in different clusters is performed.

[0127] In possible embodiments of the present method, the threshold calculation for adding a visual content image to a cluster (or combining multiple clusters) occurs as follows:

find (min), the minimum number of contours in the combined objects, that is, the smallest of two numbers: the number corresponding to the number of contours in the visual content image and the number corresponding to the number of contours in the given cluster,

if min≤2, then the computing device 120 may display a warning about the lack of informativeness of the image, and in this case, a new image of visual content is not added to the cluster;

2<min<5, then to add an image of visual content to a certain cluster, it is necessary to match all the contours in the image and the contours in the cluster;

5≤min≤10, then to add an image of visual content to a certain cluster, at least 50% of the min contours in the image and the contours in the cluster must match,

10<min≤15, then to add an image of visual content to a certain cluster, at least 25% of the min contours in the image and the contours in the cluster must match,

min>15, then to add a visual content image to a certain cluster, at least 20% of the min contours in the image and the contours in the cluster must match.

[0128] [0128] It is worth noting that the cluster is created only from visual content images in which at least three contours are identified.

[0129] In embodiments of the present solution, it is possible to assign an image of visual content to several clusters, while adding it to the cluster with the largest number of contour matches. In addition, in this variant, a check is made for the possibility of combining the identified clusters.

[0130] It is worth noting that in the possible embodiments of the present technical solution, the stages of combining clusters are similar to the steps of adding an image of the visual content of a web resource to a cluster, with one difference, that the contours of two clusters are compared in pairs and, if the threshold is overcome, the clusters are combined. Accordingly, all contours of the first cluster are compared with all contours of the second, and for each contour there can be only one match, that is, if the contour of the first cluster coincides with the contour of the second cluster, then these contours are not considered in further comparisons.

[0131] Method 200 proceeds to step 250.

STEP 250 STORING INDICATIONS TO WEB RESOURCES, WHICH VISUAL CONTENT IMAGES TURNED BELONGING TO THE SAME CLUSTER, IN THE DATABASE.

[0132] Further, indications of web resources are stored in the database 122 of the computing device 120 in the course of the above analysis, the visual content images of which, in the course of the above analysis, turned out to belong to the same cluster. In other words, at this stage, information about which web -resources belong to the same subset of supposedly phishing web resources.

[0133] In an additional embodiment, the clusters detected and stored in the database can then be transmitted to external devices (not shown in the drawings) for the purpose of further attribution of phishing web resources, web mirrors, blocked or banned websites.

[0134] It is worth noting that in an additional embodiment of the present technology, after clustering all visual content images, clusters are removed that contain less than a specified number of images, for example, less than three visual content images for better understanding. Such images are entered into a special list stored in the database 122 and temporarily considered "garbage", non-informative.

[0135] Further, at least once in a certain period of time set in the system 100, a list of 1 to N of all remaining "garbage" images of visual content and their corresponding contours is obtained to filter out uninformative images of web resources.

[0136] After filtering for the remaining images of visual content in the list from 1 to N, an additional matrix is created in the database, in which both the rows and columns represent the remaining "garbage" images from 1 to N, and at the intersection of the rows and columns, the number of contours coinciding for them is indicated. The generated adjacency matrix is used to identify by the device 120 a list of unique pairs of similarly sized contours associated with the images.

[0137] Table 3 shows a non-limiting example of constructing an additional matrix, an example of which is presented in table 3. It is also worth noting that the specific data in table 3 is provided solely for the purpose of illustration, instead of these data, any other numerical values \u200b\u200bobtained when performing method 200, including the matrix may contain other numbers of rows and columns.

[0138] In a non-limiting embodiment of the present technology, after the device 120 detects a list of similar-sized contours in several streams, the contours contained in the list are compared and only the most similar pairs of contours are left. At the same time, information about the intersection of the contours is entered into a matrix stored in the database 122 for those images of visual content to which these contours relate.

[0139] At the same time, for each unique pair of images contained in the list, for example, with reference to table 3, for image 1 and image 2, the contours are superimposed on each other to identify the number of similar pairs of contours and, if in a certain pair of contours, the contours are similar to each other, then in the initially created matrix, where everything is filled with 0, the number in the corresponding cell is increased by 1. In this example, as can be seen from Table 3, 19 similar pairs of contours were found for this pair of images.

[0140] Next, to confirm the association of pairs of web resources based on pairs of their images of visual content, the matrix is checked line by line, while converting it into an adjacency matrix. In the event that the number of contours that matched for each pair of images exceeds a predetermined threshold, one is put in the corresponding cell of the matrix. If the number of matching contours is less than the specified threshold, zero is put in the corresponding cell. A non-limiting example of the transformed adjacency matrix shown earlier in Table 3, and processed in this manner at a threshold value of 10, is shown in Table 4.

[0141] In non-limiting embodiments of the present technology, the strongly connected components of the adjacency matrix are then computed. In fact, at this step, a maximally connected subgraph is built, in which any vertex is reachable from any other vertex of the graph. Actually, methods for calculating strongly connected components of an adjacency matrix are widely known in graph theory; however, any of these methods can be used to implement the present technology.

[0142] In a non-limiting embodiment of the present technology, Tarjan's algorithm with modifications of Nuutila or Tarjan's non-recursive algorithm is used to determine strongly coupled components.

[0143] Each such constructed subgraph forms a new cluster of visual content images. Additionally, it is worth noting that the cluster built from the "garbage" images of visual content is added to the clusters built earlier as equivalent. At the same time, visual content images that remained in the list of "garbage" images remain there until they enter one of the new clusters made up of "garbage" images.

[0144] In FIG. 7 below will be a general diagram of a computing device (700) that provides the data processing necessary to implement the claimed solution.

[0145] In general, the device (700) includes components such as: one or more processors (701), at least one memory (702), a data storage medium (703), input/output interfaces (704), means B /B (705), networking tools (706).

[0146] The processor (701) of the device performs the basic computing operations necessary for the operation of the device (700) or the functionality of one or more of its components. The processor (701) executes the necessary machine-readable instructions contained in the main memory (702).

[0147] The memory (702) is typically in the form of RAM and contains the necessary software logic to provide the required functionality.

[0148] The data storage means (703) may be in the form of HDD, SSD disks, raid array, network storage, flash memory, optical storage media (CD, DVD, MD, Blue-Ray disks), etc.

[0149] Interfaces (704) are standard means for connecting and working with the server side, for example, USB, RS232, RJ45, LPT, COM, HDMI, PS/2, Lightning, Fire Wire, etc. The choice of interfaces (704) depends on the specific implementation of the device (700), which may be a personal computer, mainframe, server cluster, thin client, smartphone, laptop, and the like.

[0150] The data I/O means (705) can be a keyboard, joystick, display (touchscreen), projector, touchpad, mouse, trackball, light pen, speakers, microphone, and the like.

[0151] Means of networking (706) are selected from devices that provide reception and transmission of data over the network, for example, an Ethernet card, WLAN / Wi-Fi module, Bluetooth module, BLE module, NFC module, IrDa, RFID module, GSM modem etc. With the help of tools (705) provides the organization of data exchange over a wired or wireless data transmission channel, such as WAN, PAN, LAN (LAN), Intranet, Internet, WLAN, WMAN or GSM.

[0152] The components of the device (700) are interfaced through a common data bus (710).

[0153] In these application materials, a preferred disclosure of the implementation of the claimed technical solution was presented, which should not be used as limiting other, private embodiments of its implementation, which do not go beyond the requested scope of legal protection and are obvious to specialists in the relevant field of technology.

[0154] The claimed method of clustering phishing content provides an increase in the accuracy of clustering a set of web resources into groups, which then allows an expert to quickly check each of the saved groups and identify groups of phishing sites, for example, created using phishing kits, identify mirrors and copies of blocked and detected previously malicious web resources, determine the authors of the phishing set or the owner/s of the phishing web resource. This significantly reduces the load on the expert in the process of identifying malicious web resources.

[0155] Modifications and improvements to the above described embodiments of the present technical solution will be clear to specialists in this field of technology. The foregoing description is provided by way of example only and is not intended to be limiting in any way. Thus, the scope of the present technical solution is limited only by the scope of the appended claims.

Claims (41)

1. A method for clustering phishing web resources based on a visual content image, executed on a computer device containing at least a processor and memory, the method comprising the steps of: get directions to a lot of phishing web resources; extracting at least one visual content image of each of the plurality of web resources; processing the content of each visual content image associated with one of the plurality of web resources, wherein highlight the contours of the elements on each image of the visual content of the phishing web resource; filtering the identified contours on each image of the visual content by removing the same contours; based on a pairwise comparison of the identified contours and contours of the clusters, the web resource associated with the compared contours is combined with the cluster, moreover, if the similarity value overcomes the threshold value, then the image of visual content containing the compared contours is combined with a cluster, otherwise, create a new cluster for the web resource; storing pointers to web resources associated with respective content paths from the plurality of said clusters in a database. 2. The method of claim 1, wherein the plurality of web resources includes at least two web resources. 3. The method according to claim. 1, in which, in order to obtain indications of a plurality of web resources, a network scan is preliminarily performed. 4. The method of claim 1, wherein the multiple web resources are referenced at least in part from an external source over a data network. 5. The method of claim 1, wherein the multiple web resources are referenced from a pre-built web resource database. 6. The method according to claim 1, in which at least the following contours of the elements contained in the visual content image are distinguished: logos, letter outlines, individual words, pictures, forms. 7. The method of claim. 1, in which at least the following methods are used to extract the contours: a Canny edge detector and a contour search algorithm. 8. The method according to claim 1, in which, when processing the content of each received image of visual content, small, inclined and elongated contours are additionally removed. 9. The method according to claim 1, in which the detected contours are filtered on each visual content image by removing identical contours, and if the compared contours differ in height and/or width by more than two pixels, then they are considered different. 10. The method according to claim 1, in which the detected contours are filtered on each visual content image by removing identical contours, and if the compared contours differ in height and/or width by two pixels or less, then the contours are superimposed on each other and the pixel-by-pixel difference of the images is calculated, moreover, for the obtained difference image, a similarity score is calculated in the range from 0, where the images are the same, to 100 - the images are completely opposite, moreover, the similarity score (P) is calculated as the arithmetic mean of the pixel values, that is, the sum of the pixel values divided by the number of pixels in the image, moreover, calculated for the values taken from all three RGB channels:

where Ri, Gi, Bi are the values of the i-th pixel in the channels R, G and B, respectively, and N is the total number of pixels in the image, moreover, the contours, the similarity score of which does not exceed 7, are removed. 11. The method of claim 1, further comprising calculating invariant visual hash functions for each edge detected in the visual content image. 12. The method according to claim 1, in which if, when compared with cluster images, less than three similar contours are found on the image of the visual content of the phishing web resource, then a message is displayed about the lack of information, and in this case, a new image of visual content is not added to the cluster, but if there are less than two images in the cluster, then the cluster is deleted; if the comparison reveals from three to five similar contours, then to add an image of the visual content of a phishing web resource to a certain cluster, all the contours of the cluster must match; if the comparison reveals from five to ten similar contours, then to add an image of the visual content of a phishing web resource to a certain cluster, half of the contours must match the cluster contours, if the comparison reveals from ten to fifteen similar contours, then to add an image of the visual content of a phishing web resource to a certain cluster, a quarter of the cluster contours must match, if the comparison reveals more than fifteen similar contours, then to add an image of the visual content of a phishing web resource to a certain cluster, at least a fifth of the cluster contours must match. 13. The method according to claim 1, in which, when the image of the visual content of the phishing web resource is assigned to several clusters, it is added to the cluster with the largest number of contour matches. 14. The method of claim 1, further comprising, after clustering each of the plurality of visual content images of the phishing web resources, clusters containing less than three images are removed. 15. The method according to claim 14, wherein additionally, images that were contained in remote clusters are added to a special list and temporarily considered junk. 16. The method of claim 15, further comprising, based on each image of the visual content contained in the list, an adjacency matrix is created, in which the number of matching contours is located at the intersection, to identify a list of pairs of similar contours in size. 17. The method according to claim 16, in which, in addition to determining the association of at least two images of visual content of web resources in the adjacency matrix, the value is changed to 0 if the number of matching contours is less than a predetermined threshold, or to 1 if the number of matching contours more than the threshold. 18. The method according to claim 17, in which strongly connected graph components are calculated, in which there are more than two images, and a new cluster is created for each of the identified components. 19. Computing device for clustering phishing content, containing a memory for storing computer-readable instructions and at least one computing processor configured to execute computer-readable instructions to ensure the implementation of the phishing content clustering method according to any one of paragraphs. 1-18.

Images