# Double-Constrained Consensus Clustering with Application to Online Anti-Counterfeiting
## 2 Related Works
### Clustering Fraudulent Websites  
Although counterfeit web shops are perhaps the best-known category of fraudulent websites, there have been very few works on clustering them. The approach proposed in [25] relied on two types of features: HTML features, encoded as a bag-of-words in which each word is a tag-attribute-value triplet, and network features, extracted from the address and name server records of web shops. The authors then used the k-means algorithm with these features on a large dataset containing 44 affiliate programs. They reported that the resulting partitions were useful for identifying the largest affiliate programs but exhibited a high error rate for the other programs because large programs tended to absorb the smaller ones. Their somewhat disappointing results highlighted the difficulty of this task, although they may have been influenced by the characteristics of the specific clustering algorithm used, given that k-means has trouble clustering data when the clusters are of varying sizes.  
In our paper, we use a more comprehensive set of features and, more importantly, a much more sophisticated clustering algorithm--semi-supervised ensemble clustering--with the additional desirable property that the background knowledge in this domain can be acquired automatically. We believe that this is a step toward the timely and accurate identification of large-scale counterfeit networks, which is key to effective enforcement efforts yet still largely unsolved. Furthermore, in contrast to previous works, we study the behavior of algorithms and features when intersected, rather than experimenting with a specific clustering method on a whole fixed set of features, and we also ensure that the results are replicable by sharing the ground-truth dataset.  
The use of clustering techniques to analyze the content and infrastructure of fraudulent websites has been recently investigated to combat other malicious online activities carried out across a variety of website categories. A few examples are as follows: acquisition of cryptocurrency funds from unsuspecting investors with the false promise of gaining more cryptocurrency or accessing a service [26], sale and delivery of fictitious pets through scam websites [27], monetization of parked domain names through hosting ads [28], distribution of exploit kits through malicious websites [29], fake escrow services and high-yield investment programs [30], video piracy [31], and phishing websites [32]. Analogous to anti-counterfeiting, studies in these fields report that a limited number of entities are running multiple instances of similar scams. All these studies were conducted using a particular clustering algorithm on a whole (domain-specific) set of features. One partial exception is [30], where a hierarchical agglomerative clustering algorithm was run on all possible combinations of individual features. However, this approach requires labeled training data to select the top-performing combination. Previous works on clustering fraudulent websites did not explore the use of consensus clustering or constrained clustering, let alone constrained consensus clustering. Since the automatic acquisition of constraints seems possible even in the above-mentioned domains, the application of CCC to other types of fraudulent websites is an avenue for future research.