Detecting homographs of domain names
AssigneeInfoblox Inc.
InventorFemi Olumofin
Life of this patent
Estimating the term…
Abstract
Various techniques for detecting homographs of domain names are disclosed. In some embodiments, a system, process, and/or computer program product for detecting homographs of domain names includes receiving a DNS data stream, wherein the DNS data stream includes a DNS query and a DNS response for resolution of the DNS query; applying a homograph detector for each domain in the DNS data stream; and detecting a homograph of a domain name in the DNS data stream using the homograph detector.
Claims15
A system, comprising:
- a processor configured to:
- receive a DNS data stream, wherein the DNS data stream includes a DNS query and a DNS response for resolution of the DNS query;
- apply a homograph detector for a domain in the DNS data stream, comprising to:
- decode the domain to Unicode;
- map each character of the Unicode to an ASCII character using an ASCII to Unicode map, wherein the ASCII to Unicode map is generated using a convolutional neural network and trained using training data;
- and
- perform one or more of the following:
- A) perform a lookup on a target list;
- and
- identify matches based on the lookup;
- B) apply similarity score metrics;
- and
- identify nearby/close matches based on threshold similarity scores;
- and/or
- C) implement a k-nearest neighbor;
- and
- identify matches based on k-NN threshold distance results;
- and
- detect a homograph of a domain name in the DNS data stream using the homograph detector;
- and
- a memory coupled to the processor and configured to provide the processor with instructions.
A method, comprising:
- receiving a DNS data stream, wherein the DNS data stream includes a DNS query and a DNS response for resolution of the DNS query;
- applying a homograph detector for a domain in the DNS data stream, comprising:
- decoding the domain to Unicode;
- mapping each character of the Unicode to an ASCII character using an ASCII to Unicode map, wherein the ASCII to Unicode map is generated using a convolutional neural network and trained using training data;
- and
- performing one or more of the following:
- A) performing a lookup on a target list;
- and
- identifying matches based on the lookup;
- B) applying similarity score metrics;
- and
- identifying nearby/close matches based on threshold similarity scores;
- and/or
- C) implementing a k-nearest neighbor;
- and
- identifying matches based on k-NN threshold distance results;
- and
- detecting a homograph of a domain name in the DNS data stream using the homograph detector.
A computer program product, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:
- receiving a DNS data stream, wherein the DNS data stream includes a DNS query and a DNS response for resolution of the DNS query;
- applying a homograph detector for a domain in the DNS data stream, comprising:
- decoding the domain to Unicode;
- mapping each character of the Unicode to an ASCII character using an ASCII to Unicode map, wherein the ASCII to Unicode map is generated using a convolutional neural network and trained using training data;
- and
- performing one or more of the following:
- A) performing a lookup on a target list;
- and
- identifying matches based on the lookup;
- B) applying similarity score metrics;
- and
- identifying nearby/close matches based on threshold similarity scores;
- and/or
- C) implementing a k-nearest neighbor;
- and
- identifying matches based on k-NN threshold distance results;
- and
- detecting a homograph of a domain name in the DNS data stream using the homograph detector.
Dependencies are inferred from the claim text.