# Double-Constrained Consensus Clustering with Application to Online Anti-Counterfeiting
## 5 Experimenting with Counterfeit Web Shops  
### Description of Experimental Scenario  
Counterfeiting occurs in several channels of online sales, including marketplaces and social media. One widespread illegal activity consists of selling unauthorized goods on specialized fake websites, luring customers with cheap, inferior versions of brand-name products. To increase visibility, such websites are often optimized to appear among the results returned by web search engines in response to a query containing the brand name. Also, for reasons of scale and economy, multiple fake websites are often managed by a single criminal entity. The research on automating web anti-counterfeiting efforts thus has a twofold aim: (i) to detect fake web shops, especially among web search results, and (ii) to identify the affiliate marketing programs behind fake web shops. The latter problem is conceptually different from the former because it is addressed by clustering techniques, as opposed to classification techniques, and relies on different types of learning features. While classification features are common characteristics of illicit web shops that are generally not shared by legitimate web shops (e.g., large discounts, a lack of contact information, and the use of untraceable payment methods), clustering features need to model the process by which multiple counterfeit websites are created and managed by the same entity. The assumption is that web shops belonging to the same network share similarities in terms of their structure, content, and network, since making truly unique versions of each site does not scale well. However, web shops under the same criminal entity may render very differently, especially if they sell entirely different products, while there may be seemingly similar web shops that are actually unrelated, posing a challenge to clustering algorithms. While the ability to automatically distinguish between fake and genuine web shops has been well studied (e.g., [45, 46]) and continues to be actively investigated ([47, 48, 49]), the subsequent task of recognizing affiliate programs among the detected fake web shops has been less researched up until now, although it allows enforcement at scale and brings long-lasting results. One notable exception is [25], where the authors used a conventional clustering algorithm together with a few clustering features, mainly extracted from the HTML and the URLs of the websites. However, they reported limited success. Single or combined clustering algorithms have also been recently applied to finding networks of malicious websites in several other domains, leveraging similar or novel clustering features (e.g., [26, 27, 28, 29, 30, 31]). Our work expands on previous research by integrating constraints and multiple clustering algorithms in the process of grouping fraudulent websites into connected networks and by showing how such constraints can be partly acquired automatically. One practical difficulty of clustering fraudulent websites is that there are no available datasets with associated feature matrices and, therefore, base partitions must be constructed from raw data. In addition, the features of interest are heterogeneous and must be treated individually. Assuming the use of distance-based clustering algorithms (although other choices would be possible, such as density-based or spectral algorithms), this task can be addressed through a three-step pipeline consisting of feature selection, the construction of a similarity matrix, and the application of several clustering algorithms (or multiple variants of the same clustering algorithm, or the same variant with multiple features). For the last step, we use multiple algorithms and multiple features, thus extending the experimental setting commonly adopted in previous studies. In this way, we are able to consider a wider range of variables when measuring the performance of double-constrained consensus clustering for web anti-counterfeiting efforts.