Detecting suspicious entities

A non-transitory computer-readable medium having instructions stored thereon that are executable by a server computer system to perform operations comprising:

• generating a feature vector for an unclassified entity;
• inputting the feature vector for the unclassified entity into a neural network;
• applying a clustering algorithm to a signature vector for the unclassified entity and signature vectors for respective ones of a plurality of classified entities output by the neural network;
• and
• assigning a classification from a plurality of classifications to the unclassified entity, wherein the assigning is performed based on results of the clustering algorithm indicating similarities between the signature vector for the unclassified entity and one or more of the signature vectors for the plurality of classified entities.

A system, comprising:

• at least one processor;
• and
• a memory having instructions stored thereon that are executable by the at least one processor to cause the system to:
• generate a feature vector for an unclassified website, wherein generating the feature vector includes preprocessing a plurality of features of the unclassified website;
• input the feature vector for the unclassified website into a machine learning model;
• apply a clustering algorithm to a signature vector for the unclassified website and signature vectors for respective ones of a plurality of classified websites output by the machine learning model;
• and
• input a set of features for a cluster in which the unclassified website is included into a machine learning classifier, wherein the machine learning classifier determines similarities between signature vectors for the unclassified website and one or more of the signature vectors for the plurality of classified websites;
• and
• assign a classification output by the machine learning classifier to the unclassified website.