Malicious domain name detection

Abstract

A computer-implemented method, computer system and computer program are provided for detecting malicious domain names from a set of candidate domain names based on a set of reference domain names. The method uses natural language processing to generate vector representations of the domain names, each vector representation representing a respective domain name in the set of candidate domain names and the set of reference domain names. The method clusters the vector representations to generate clusters of domain names, the domain names within each cluster being similar to each other. The method analyses the clusters of domain names to identify at least one cluster comprising at least one domain name belonging to the set of candidate domain names and at least one main name belonging to the set of reference domain names. The method provides an indication of one or more of the domain names in the set of candidate domain names included in the identified clusters as being malicious domain names.

Dependencies are inferred from the claim text.