System and method for detecting phishing-domains in a set of Domain Name System (DNS) records

A method for detecting phishing domains in a set of Domain Name System (DNS) records using a homoglyph phishing domain detection module comprising a trained homoglyph encoder EH and a reference database DH, a typo-squatting phishing domain detection module comprising a trained typo-squatting encoder ES and a reference database DS, a general phishing domain detection module comprising a trained transformer based neural network and an alert module, the method comprising:

• receiving, using the homoglyph phishing domain detection module, string images, IHT_N, that have been rendered from homoglyph domains,
• wherein the homoglyph domains comprise domains that each comprise puny code;
• encode, using the trained homoglyph encoder EH, each of the string images, IHT_N, into their associated encodings, eHT_N;
• classifying, using the homoglyph phishing domain detection module, each homoglyph domain as a homoglyph phishing domain when an Euclidean distance between an associated encoding, eHT_N, and any encoding in the reference database DH is below a predetermined threshold;
• receiving, using the typo-squatting phishing domain detection module, Swype-like images, IST_N, of domains that have been rendered from the set of DNS records;
• encoding, using the trained typo-squatting encoder ES of the typo-squatting phishing domain detection module, each of the Swype-like images, IST_N, into their associated encodings, eST_N;
• classifying, using the typo-squatting phishing domain detection module, each domain used to generate a set of Swype-like images, IST_N, as a typo-squatting phishing domain when an Euclidean distance between an associated encoding, eST_N, and any encoding in the reference database DS is below a predetermined threshold;
• receiving, using the general phishing domain detection module, domains identified from the set of DNS records to have strings that at least partially match strings in a phishing reference list K;
• generating, using the trained transformer based neural network of the general phishing domain detection module, a probability score for each of the identified domains;
• resolving, using the general phishing domain detection module, Internet Protocol (IP) addresses for each identified domain that has a probability score that exceeds a predetermined probability threshold;
• for each of the resolved IP addresses, using the general phishing domain detection module to:
• obtain all external domains associated with the resolved IP address, wherein the external domains refer to all domains within the set of DNS records that resolved to the resolved IP address;
• generate, using the transformer based neural network, a probability score for each of the obtained external domains;
• classify each obtained external domain that has a probability score that exceeds the predetermined probability threshold as a general phishing domain;
• and
• producing, using the alert module, alerts for the phishing domains detected within the set of DNS records based on the homoglyph phishing domains from the homoglyph phishing domain detection module, the typo-squatting phishing domains from the typo-squatting phishing domain detection module and the general phishing domains from the general phishing domain detection module.