Detecting suspicious entities

Abstract

Techniques are disclosed relating to automatically determining whether an entity is malicious. In some embodiments, a server computer system generates a feature vector for an unknown website, where generating the feature vector includes preprocessing a plurality of structural features of the unknown website. In some embodiments, the system inputs the feature vector for the unknown website into a trained neural network. In some embodiments, the system applies a clustering algorithm to a signature vector for the unknown website and signature vectors for respective ones of a plurality of known websites output by the trained neural network. In some embodiments, the system determines, based on results of the clustering algorithm indicating similarities between signature vectors for the unknown website and one or more of the signature vectors for the plurality of known websites, whether the unknown website is suspicious. Determining whether the entity is suspicious may advantageously prevent malicious (fraudulent) activity.