## 2 Background and Related Work
### Related Work
#### 2.2.1 Detection of Illegal Websites
In the realm of supervised methods, a remarkable characteristic is their impressive accuracy, often surpassing 95% in recognition rates. Certain pioneering approaches have even demonstrated exceptional achievements, exceeding 99% accuracy. An exemplary case is depicted in reference [19], where the highest recognition accuracy of 99.31% was accomplished using a self-labeled dataset comprising 800 gambling websites and 800 normal websites. However, it is crucial to acknowledge that models trained on small-scale datasets may encounter challenges in terms of robustness, thereby resulting in a disparity between experimental and real-world performance. Scaling up labeled samples can present formidable obstacles, demanding substantial human and financial resources. Unsupervised methods for illegal website detection do not rely on labeled datasets for training. Instead, they classify websites by discovering patterns and structures within the data. The clustering-based method is a common unsupervised learning method, which classifies data into different clusters. This method first extracts various features from the website, such as page titles, keywords, descriptions, HTML tags, etc. Then, it uses the clustering algorithm to divide the data into multiple clusters; each cluster represents a type of website. The commonly used clustering algorithms include k-means, DBSCAN, hierarchical clustering, etc. K-means is a classical clustering algorithm, which divides data into K clusters, and the center of each cluster is the average value of all data points in the cluster. DBSCAN is a density-based clustering algorithm that clusters high-density data points into one category. Hierarchical clustering is a clustering algorithm based on a tree structure. It divides the data into a series of hierarchical structures, each of which represents a type of website. [PERSON] et al. [20] used a Fast Unfolding algorithm to cluster websites and extract URL features of illegal websites, and judged whether they were illegal websites by detecting the URL features of unknown websites. [PERSON] et al. [21] used a density clustering algorithm to cluster dark web sites, phishing sites, and normal websites, which proved the effectiveness of clustering on the classification of dark web sites and phishingsites. [PERSON] et al. [22] proposed a gambling website detection method based on the PAM probabilistic topic model. By giving different weights to the structured information of the website, it is analyzed whether it has a high probability of tending to the 'gambling' topic for classification. In summary, the detection of illicit websites is an important problem that can be addressed using supervised and unsupervised learning methods. Supervised methods [19] generally outperform unsupervised methods [22] in terms of recognition accuracy, with unsupervised methods often struggling to exceed 90% accuracy. However, supervised methods heavily rely on annotated training data, which is a labor-intensive task. Insufficient annotated samples can lead to a decline in model robustness. On the other hand, unsupervised learning methods do not require annotated data and can scale up the sample size without significant limitations, enabling the handling of unknown types of illicit websites. In this study, we focus on the analysis of massive network asset data from web mapping platforms. It is challenging to effectively annotate such large-scale datasets to represent the overall data characteristics. Therefore, we have chosen to employ unsupervised methods for the analysis of the extensive web mapping data, to uncover potential illicit websites.