# US 11,909,722 B2 · Detecting homographs of domain names

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,909,722 B2
- Document ID: US11909722B2
- Status: Granted
- Kind: B2
- Application number: 17/827,150
- Filed: 2022-05-27
- Published: 2022-09-08
- Granted: 2024-02-20
- Earliest claimed: 2019-01-15
- Assignees: Infoblox Inc.
- Applicants: Infoblox Inc.
- Inventors: Femi Olumofin
- Web page: https://patentgrep.com/patent/US11909722B2

## CPC

- H04L 63/0263: {Rule management}
- G06F 40/30: Semantic analysis
- G06N 3/04: Architecture, e.g. interconnection topology
- G06N 3/045: Combinations of networks
- G06N 3/0464: Convolutional networks [CNN, ConvNet]
- G06N 3/08: Learning methods
- G06N 3/09: Supervised learning
- H04L 61/4511: using domain name system [DNS]
- H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL}
- H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)}
- G06N 3/084: Backpropagation, e.g. using gradient descent
- H04L 2101/30: Types of network names
- H04L 2101/33: containing protocol addresses or telephone numbers
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

Various techniques for detecting homographs of domain names are disclosed. In some embodiments, a system, process, and/or computer program product for detecting homographs of domain names includes receiving a DNS data stream, wherein the DNS data stream includes a DNS query and a DNS response for resolution of the DNS query; applying a homograph detector for each domain in the DNS data stream; and detecting a homograph of a domain name in the DNS data stream using the homograph detector.

## Claims

### Claim 1

A system, comprising:
a processor configured to:
generate training and test data sets for images of characters for domain names;
train a homograph classifier using the training and test data sets to recognize Unicode characters that are visually similar to one or more ASCII characters, wherein a convolutional neural network (CNN) architecture is used to train the homograph classifier, wherein the CNN architecture learns a filter to detect a pattern for a prediction, and wherein a presence of the pattern or a lack of the pattern is used by the CNN architecture to make the prediction; and
execute the homograph classifier over a set of Unicode characters to generate an ASCII to Unicode map; and
a memory coupled to the processor and configured to provide the processor with instructions.

### Claim 2 (depends on 1)

The system recited in claim 1, wherein the processor is further configured to update the homograph classifier to obtain an updated ASCII to Unicode map.

### Claim 3 (depends on 1)

The system recited in claim 1, wherein the processor is further configured to update the homograph classifier to obtain an updated ASCII to Unicode map, and wherein the updated ASCII to Unicode map includes a new Unicode character.

### Claim 4 (depends on 1)

The system recited in claim 1, wherein the processor is further configured to deploy the homograph classifier to provide an inline homograph detection model for automatically detecting homographs of domain names on a DNS data stream.

### Claim 5 (depends on 1)

The system recited in claim 1, wherein the homograph classifier is executed over the set of Unicode characters to map an ASCII character to each Unicode character in the set of Unicode characters based on visual similarity to obtain the ASCII to Unicode map.

### Claim 6

A method, comprising:
generating, using a processor, training and test data sets for images of characters for domain names;
training, using the processor, a homograph classifier using the training and test data sets to recognize Unicode characters that are visually similar to one or more ASCII characters, wherein a convolutional neural network (CNN) architecture is used to train the homograph classifier, wherein the CNN architecture learns a filter to detect a pattern for a prediction, and wherein a presence of the pattern or a lack of the pattern is used by the CNN architecture to make the prediction; and
executing, using the processor, the homograph classifier over a set of Unicode characters to generate an ASCII to Unicode map.

### Claim 7 (depends on 6)

The method of claim 6, further comprising:
updating the homograph classifier to obtain an updated ASCII to Unicode map.

### Claim 8 (depends on 6)

The method of claim 6, further comprising:
updating the homograph classifier to obtain an updated ASCII to Unicode map, wherein the updated ASCII to Unicode map includes a new Unicode character.

### Claim 9 (depends on 6)

The method of claim 6, further comprising:
deploying the homograph classifier to provide an inline homograph detection model for automatically detecting homographs of domain names on a DNS data stream.

### Claim 10 (depends on 6)

The method of claim 6, wherein the homograph classifier is executed over the set of Unicode characters to map an ASCII character to each Unicode character in the set of Unicode characters based on visual similarity to obtain the ASCII to Unicode map.

### Claim 11

A computer program product, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:
generating training and test data sets for images of characters for domain names;
training a homograph classifier using the training and test data sets to recognize Unicode characters that are visually similar to one or more ASCII characters, wherein a convolutional neural network (CNN) architecture is used to train the homograph classifier, wherein the CNN architecture learns a filter to detect a pattern for a prediction, and wherein a presence of the pattern or a lack of the pattern is used by the CNN architecture to make the prediction; and
executing the homograph classifier over a set of Unicode characters to generate an ASCII to Unicode map.

### Claim 12 (depends on 11)

The computer program product recited in claim 11, further comprising computer instructions for:
updating the homograph classifier to obtain an updated ASCII to Unicode map.

### Claim 13 (depends on 11)

The computer program product recited in claim 11, further comprising computer instructions for:
updating the homograph classifier to obtain an updated ASCII to Unicode map, wherein the updated ASCII to Unicode map includes a new Unicode character.

### Claim 14 (depends on 11)

The computer program product recited in claim 11, further comprising computer instructions for:
deploying the homograph classifier to provide an inline homograph detection model for automatically detecting homographs of domain names on a DNS data stream.

### Claim 15 (depends on 11)

The computer program product recited in claim 11, wherein the homograph classifier is executed over the set of Unicode characters to map an ASCII character to each Unicode character in the set of Unicode characters based on visual similarity to obtain the ASCII to Unicode map.