Tokenization of domain names for domain name impersonation detection using matching

A device comprising a memory device and a processor that processes a domain name system (DNS) name string to obtain a plurality of candidate tokens to detect impersonation, the memory device with instructions stored thereon that, when executed by the processor, causes the processor to:

• (a) receive the DNS name string from a DNS sensor array;
• (b) process the DNS name string to generate a processed DNS name string;
• (c) parse the processed DNS name string based on a delimiting character to generate a plurality of labels;
• (d) determine a total count of labels of the plurality of labels generated from the parsing in (c);
• for each integer value between one and the total count of labels determined in (d):
• (e) obtain a subset of labels from the plurality of labels, the subset of labels consisting of a number of labels equal to the integer value, and
• (f) concatenate the labels from the subset of labels obtained in (e) according to the order the labels appear in the processed DNS name string when read sequentially to generate a candidate token, wherein the candidate token is added to the plurality of candidate tokens, and
• (g) for each of the plurality of candidate tokens, analyze the candidate token to determine if the candidate token matches a subscriber string from a plurality of subscriber strings.

A non-transitory computer-readable medium having instructions stored thereon that, when executed by at least one computing device, causes the at least one computing device to perform a method for determining when at least one of a plurality of candidate tokens from a Domain Name System (DNS) name string is impersonating at least one of a plurality of subscriber strings, the method comprising:

• (a) receiving the DNS name string from a DNS sensor array;
• (b) processing the DNS name string to generate a processed DNS name string;
• (c) parsing the processed DNS name string based on a delimiting character to generate a plurality of labels;
• (d) determining a total count of labels of the plurality of labels generated from the parsing in (c);
• for each integer value between one and the total count of labels determined in (d):
• (e) obtaining a subset of labels from the plurality of labels, the subset of labels consisting of a number of labels equal to the integer value, and
• (f) concatenating the labels from the subset of labels obtained in (e) according to the order the labels appear in the processed DNS name string when read sequentially to generate a candidate token, wherein the candidate token is added to the plurality of candidate tokens, and
• (g) for each of the plurality of candidate tokens, analyzing the candidate token to determine if the candidate token matches a subscriber string from the plurality of subscriber strings.