Methods and apparatus to identify structural similarity between webpages

1 . An apparatus to identify webpage structure similarity, the apparatus comprising:

at least one interface circuit;

machine readable instructions; and

at least one programmable circuit to at least one of instantiate or execute the machine readable instructions to:

remove content data corresponding to a first webpage, the first webpage to include hypertext markup language (HTML) tags after the removal of the content data;

normalize data within the HTML tags;

after normalizing, create a linear data structure that organizes the HTML tags based on an order in which the HTML tags appear in the first webpage;

create tiles from the linear data structure by grouping together one or more HTML tags that are sequentially adjacent to one another within the linear data structure;

compute a first output of a hashing algorithm using the tiles; and

compare the first output to a second output of the hashing algorithm to generate a similarity value, the second output corresponding to a second webpage, the similarity value representing a structural similarity between the first webpage and the second webpage.

2 . The apparatus of claim 1 , wherein the at least one programmable circuit is to classify the first webpage as clean based on a classification of the second webpage, and the similarity value exceeding a similarity threshold, wherein the second webpage represents a clean webpage.

3 . The apparatus of claim 1 , wherein to normalize data within the HTML tags, the at least one programmable circuit is configured to replace a portion of one of the HTML tags with a placeholder token.

4 . The apparatus of claim 3 , wherein the portion of the HTML tag replaced by the placeholder token is unique to the first webpage.

5 . The apparatus of claim 1 , wherein, before removing the content data, the at least one interface circuit is to obtain an HTML file that represents the first webpage.

6 . The apparatus of claim 1 , wherein the at least one programmable circuit is to form groups of one or more sequentially adjacent HTML tags within the linear data structure based on types and orders of HTML tags within the first webpage.

7 . The apparatus of claim 1 , wherein the first output of the hashing algorithm is based on an amount of the content data removed from the first webpage.

8 . The apparatus of claim 1 , wherein the at least one programmable circuit is to classify the first webpage as malicious based on a classification of the second webpage, and the similarity value exceeding a similarity threshold, wherein the second webpage represents a malicious webpage.

9 . The apparatus of claim 1 , wherein the at least one programmable circuit includes one or more of:

at least one of a central processor unit, a graphics processor unit, or a digital signal processor, the at least one of the central processor unit, the graphics processor unit, or the digital signal processor having control circuitry to control data movement within the at least one programmable circuit, arithmetic and logic circuitry to perform one or more first operations corresponding to machine-readable data, and one or more registers to store a result of the one or more first operations, the machine-readable data in the apparatus;

a Field Programmable Gate Array (FPGA), the FPGA including logic gate circuitry, a plurality of configurable interconnections, and storage circuitry, the logic gate circuitry and the plurality of the configurable interconnections to perform one or more second operations, the storage circuitry to store a result of the one or more second operations; or

Application Specific Integrated Circuitry (ASIC) including logic gate circuitry to perform one or more third operations.

10 . A non-transitory machine readable storage medium comprising instructions that, when executed by at least one programmable circuit, cause the at least one programmable circuit to at least:

remove content corresponding to a first webpage, the first webpage to include hypertext markup language (HTML) tags after the removal of the content data;

normalize data within the HTML tags;

after normalizing, create a linear data structure that organizes the HTML tags based on an order in which the HTML tags appear in the first webpage;

create tiles from the linear data structure by grouping together one or more HTML tags that are sequentially adjacent to one another within the linear data structure;

compute a first output of a hashing algorithm using the tiles; and

compare the first output to a second output of the hashing algorithm to generate a similarity value, the second output corresponding to a second webpage, the similarity value representing a structural similarity between the first webpage and the second webpage.

11 . The non-transitory machine readable storage medium of claim 10 , wherein the at least one programmable circuit is to classify the first webpage as clean based on a classification of the second webpage, and the similarity value exceeding a similarity threshold, wherein the second webpage represents a clean webpage.

12 . The non-transitory machine readable storage medium of claim 10 , wherein to normalize data within the HTML tags, the at least one programmable circuit is to replace a portion of one of the HTML tags with a placeholder token.

13 . The non-transitory machine readable storage medium of claim 12 , wherein the portion of the HTML tag replaced by the placeholder token is unique to the first webpage.

14 . The non-transitory machine readable storage medium of claim 10 , wherein, before removing the content data, the at least one programmable circuit is to obtain an HTML file that represents the first webpage.

15 . The non-transitory machine readable storage medium of claim 10 , wherein the at least one programmable circuit is to form groups of one or more sequentially adjacent HTML tags within the linear data structure based on types and orders of HTML tags within the first webpage.

16 . The non-transitory machine readable storage medium of claim 10 , wherein the first output of the hashing algorithm is based on an amount of the content data removed from the first webpage.

17 . The non-transitory machine readable storage medium of claim 10 , wherein the at least one programmable circuit is to classify the first webpage as malicious based on a classification of the second webpage, and the similarity value exceeding a similarity threshold, wherein the second webpage represents a malicious webpage.

18 . A method comprising:

removing, with at least one programmable circuit, content data corresponding to a first webpage, the first webpage to include hypertext markup language (HTML) tags after the removal of the content data;

normalizing, with the at least one programmable circuit, data within the HTML tags;

after the normalizing, creating a linear data structure that organizes the HTML tags based on an order in which the HTML tags appear in the first webpage;

creating, with the at least one programmable circuit, tiles from the linear data structure by grouping together one or more HTML tags that are sequentially adjacent to one another within the linear data structure;

computing, with the at least one programmable circuit, a first output of a hashing algorithm using the tiles; and

comparing, with the at least one programmable circuit, the first output to a second output of the hashing algorithm to generate a similarity value, the second output corresponding to a second webpage, the similarity value representing a structural similarity between the first webpage and the second webpage.

19 . The method of claim 18 , wherein normalizing data within the HTML tags include replacing, with the at least one programmable circuit, a portion of one of the HTML tags with a placeholder token.

20 . The method of claim 19 , wherein the portion of the HTML tag replaced by the placeholder token is unique to the first webpage.