# US 12,726,490 B2 · Website classification > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,726,490 B2 - Document ID: US12726490B2 - Status: Granted - Kind: B2 - Application number: 18/579,316 - Filed: 2022-12-16 - Published: 2024-10-03 - Granted: 2026-09-01 - Earliest claimed: 2021-12-21 - Assignees: Commonwealth Scientific and Industrial Research Organisation - Applicants: Commonwealth Scientific and Industrial Organisation - Inventors: Shuo Wang; Mahathir Almashor; Alsharif Abuadbba; Raj Gaire; Seyit Camtepe; Surya Nepal - Web page: https://patentgrep.com/patent/US12726490B2 ## CPC - G06F 16/951: Indexing; Web crawling techniques - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 16/958: Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)} - H04L 63/168: {above the transport layer} - G06F 2221/2119: Authenticating web pages, e.g. with suspicious links - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract This disclosure relates to classifying websites. A processor calculates importance values between a test website and multiple neighbour websites that are connected by way of one or more hyperlinks between that neighbour website and the test website. The processor then selects one or more of the multiple neighbour websites, based on the importance value. For each website in the selected one or more of the multiple neighbour websites and the test website, the processor determines content features for the website, and evaluates a trained machine learning model for the website, based on the content features to calculate multiple output values for the website. The processor then aggregates corresponding output values for each of the test website and the selected one or more of the multiple neighbour websites to calculate a classification value that classifies the test website. ## Claims ### Claim 1 A method for classifying a test website, the method comprising: for each of multiple neighbour websites, calculating an importance value between the test website and one of the multiple neighbour websites, each of the multiple neighbour websites being connected to the test website by way of one or more hyperlinks; building a graph of nodes and directed edges, a node representing a website and a directed edge representing a hyperlink between websites; for each node in the graph, calculating a classification value and classifying the node based on the classification value, wherein at least one node is a website on a whitelist, corresponding to a predetermined classification value; selecting one or more of the multiple neighbour websites on the graph, based on the importance value corresponding to the one or more of the multiple neighbour websites; for each website in the selected one or more of the multiple neighbour websites and the test website; determining content features for the website; and evaluating a trained machine learning model for the website, based on the content features to calculate multiple output values for the website, wherein the trained machine learning model is trained by calculating a classification value for each node on the graph and minimising a cost between the classification value and node labels obtained from a whitelist and/or blacklist and aggregating corresponding output values from a pre-trained machine learning model for each of the test website and the selected one or more of the multiple neighbour websites to calculate the classification value for each node on the graph; and aggregating corresponding output values for each of the test website and the selected one or more of the multiple neighbour websites to calculate a classification value that classifies the test website. ### Claim 2 (depends on 1) The method of claim 1, wherein aggregating the corresponding output values is based on a relationship between the test website and selected one of more of the multiple neighbour websites. ### Claim 3 (depends on 1) The method of claim 1, wherein selecting one or more of the multiple neighbour websites comprises selecting one or more neighbour websites with importance values over an importance threshold. ### Claim 4 (depends on 1) The method of claim 1, wherein calculating the importance values between the test website and one of the multiple neighbour websites comprises propagating a parameter related to the importance value between the test website and the multiple neighbour websites to calculate, for each of the multiple neighbour websites, the importance value based on the parameter. ### Claim 5 (depends on 4) The method of claim 4, wherein calculating the importance value comprises updating the importance value by adding the parameter multiplied by a weight factor. ### Claim 6 (depends on 4) The method of claim 4, wherein the method further comprises initialising the parameter based on whether the test website links to a malicious website and initialising the parameter comprises dividing the parameter of a first website among websites that link to the first website. ### Claim 7 (depends on 4) The method of claim 4, wherein the parameter is based on a number of the neighbour websites that link to a malicious website. ### Claim 8 (depends on 4) The method of claim 4, wherein propagating the parameter comprises selecting one of the multiple neighbour websites based on the parameter calculated for that one of the multiple neighbour websites and propagating the parameter from the selected one of the multiple neighbour websites and the method comprises setting the parameter of the selected one of the multiple neighbour websites to a predefined value after propagating the parameter, to indicate that the selected one of the multiple neighbour websites has been processed. ### Claim 9 (depends on 4) The method of claim 4, wherein the method further comprises terminating the propagating in response to the parameter for the multiple neighbour websites being below a termination threshold and performing random walks from a starting website, selected from the test website and the multiple neighbour websites, based on the parameter after terminating the propagating, to update the importance value of the starting website. ### Claim 10 (depends on 1) The method of claim 1, wherein the classification value is a probability of the test website being malicious or compromised in a cyber-attack. ### Claim 11 (depends on 1) The method of claim 1, wherein the multiple output values for each website in the selected one or more of the multiple neighbour websites and the test website is a representation of embedded features. ### Claim 12 (depends on 1) The method of claim 1, wherein each of the test website and the selected one or more of the multiple neighbour websites comprises a primary domain. ### Claim 13 (depends on 1) The method of claim 1, wherein the method further comprises, after classifying each node in the graph, pruning the nodes of the graph according to their classification. ### Claim 14 (depends on 1) The method of claim 1, wherein aggregating the corresponding output values comprises calculating a weighted sum of the corresponding output values and converting the output values into a probability distribution. ### Claim 15 (depends on 1) The method of claim 1, wherein determining features related to content comprises determining a frequency of words used in the content from a dictionary of words, generating a numeric feature vector for each website in the selected one or more of the multiple neighbour websites and the test website and using the numeric feature vector as an input to the trained machine learning model. ### Claim 16 (depends on 1) The method of claim 1, wherein the trained machine learning model comprises a neural network with exactly two output values. ### Claim 17 (depends on 1) A non-transitory computer readable medium with software code stored thereon that, when executed by a computer, causes the computer to perform the method of claim 1. ### Claim 18 A computer system for classifying a test website, the computer system comprising: a processor configured to: for each multiple neighbour websites, calculate an importance value between the test website and one of the multiple neighbour websites, each of the multiple neighbour websites being connected to the test website by way of one or more hyperlinks; build a graph of nodes and directed edges, a node representing a website and a directed edge representing a hyperlink between websites; for each node in the graph, calculate a classification value and classifying the node based on the classification value, wherein at least one node is a website on a whitelist, corresponding to a predetermined classification value; select one or more of the multiple neighbour websites on the graph, based on the importance value corresponding to the one or more of the multiple neighbour websites; for each website in the selected one or more of the multiple neighbour websites and the test website: determine content features for the website, and evaluating a trained machine learning model for the website, based on the content features to calculate multiple output values for the website, wherein the trained machine learning model is trained by calculating a classification value for each node on the graph and minimising a cost between the classification value and node labels obtained from a whitelist and/or blacklist and aggregating corresponding output values from a pre-trained machine learning model for each of the test website and the selected one or more of the multiple neighbour websites to calculate the classification value for each node on the graph; and aggregate corresponding output values for each of the test website and the selected one or more of the multiple neighbour websites to calculate a classification value that classifies the test website.