SYSTEM AND METHODS FOR DETECTING PHISHING DOMAINS IN A DOMAIN NAME SYSTEM (DNS) RECORD COLLECTION

Abstract

This document describes a system and method for detecting phishing domains, used by cyber attackers to conduct phishing attacks, in a set of Domain Name System (DNS) records, the system comprising a homoglyph phishing domain detection module, a typo-squatting phishing domain detection module, a generic phishing domain detection module and an alerting module. These modules are configured to collaboratively detect and identify phishing domains from a set of DNS records using a combination of homoglyph, typo-squatting and generic phishing techniques. Then, an alerting module is used to correlate various alerts from various phishing detection modules to discover phishing campaigns occurring in DNS network data.

Description

Description SYSTEM AND METHODS FOR DETECTING PHISHING DOMAINS IN A DOMAIN NAME SYSTEM (DNS) RECORD SET Invention Engineering Field The present invention relates to a system and method for detecting phishing domains, which are used by cyber attackers to conduct phishing attacks, through the use of Domain Name System (DNS) records. The system comprises a homoglyph phishing domain detection module, a typo phishing domain detection module, a generic phishing domain detection module, and an alert module. These modules are configured to collaboratively detect and identify phishing domains occurring within a given set of DNS records using a combination of homoglyph, typo phishing domain, and generic phishing domain techniques. Background of the Invention In general, there are three main types of phishing domains that are commonly used to carry out phishing attacks; Homoglyph phishing domains that exploit visual similarities, typo phishing domains that exploit typos, and other common phishing domains such as win-free-iPhone[.]com that exploit human desires. It is important to note that phishing attacks consist of attacks where the attacker attempts to (1) gather knowledge about the victim through credential harvesting or (2) gain initial access by tricking people into downloading and executing a malicious payload. Typo-squatting phishing domains are a common type of phishing attack involving alphabetical permutations of the same Latin character. Specifically, typo-squatting phishing domains involve domain registrations that exploit typos that unsuspecting users might make when entering the desired domain. For example, in 2006, a typo-squatting variant of google[.]com, “goggle[.]com,” was abused by malicious parties, and even more recently, a typo-squatting variant of youtube[.]com, “yuube[.]com,” was used to host malware. To counter such types of attacks, the current approach accepted by those in the industry is to calculate the edit distance between strings. For example, equation (1) below shows two sample domains that are 1 Levenshtein edit Distance (LD) away from the real domain name”, i.e. facebook.com”. In this known method, it is important to note that a lower LD value indicates a domain that is very similar to the real domain”, thus increasing the likelihood of a phishing attempt. ld(“facebook.com”; “face4book.com”) = 1 .........Equation (1) ld(“facebook.com”; “faceb0ok.com”) = 1 However, this method fails to take keyboard distance into account but only considers heuristics. For example, in Equation (1), faceb0ok.com” is more likely to be a typo variant of facebook.com” because o” and 0” are very close together while p” and c” are very far apart on the keyboard. Despite this stark difference, the LD algorithm classifies the two domains as having the same Levenshtein edit Distance (LD) of facebook.com. Despite this, LD is still the basis of many modern spell checking systems, making it suitable for detecting typo phishing domains, which exploit typos / spelling errors. Recently, experts in this field have noticed the importance of taking keyboard spacing into account and are increasingly finding new ways to account for it and produce better spell-checking algorithms. One expert in this field proposed a simple way to compare two domain strings by returning the sum of the spacing between corresponding characters in them. If one string is longer than the other, the remaining characters are calculated to have a value equal to the maximum spacing. While this takes keyboard spacing into account, it fails to account for transposition of adjacent characters. Additionally, the Levenshtein edit Distance (LD) method described above fails when the attacker uses a homoglyph attack (which is a subset of similar attacks), which uses characters that do not belong to the Latin character group. For example, the domains facebook.com and facebooZ.com while both being one (1) LD of facebook.com, they have different visual characteristics. Additionally, since most modern browsers support the display of Internationalized Domain Names (IDNs), domain names consisting of numbers and other special characters can be registered. These IDNs are usually converted to their Latin character equivalents in the form of small codes. While very useful in facilitating domain names from various languages, this opens up the possibility of cyberattacks, in particular, homoglyph type domain attacks. The homoglyph attack vector comes into play when there is a mixture of characters that look like their Latin counterparts.As shown in Table 1 below, it is not easy to distinguish homoglyph type domains from the original domains. Original Replaced Punycode Visualized facebook . com a ke a xn—fcebook- hwa. com facebook . com google.com l ke l xn—googenta. com google.com imda. gov . sgi ke 1 xn—mda- iua.gov.sg 1mda. gov . sg Table 1 As homoglyph phishing attacks have increased, many techniques have been proposed by experts in the field to detect them. One approach proposed by experts in the field is to study the similarity between single characters and to evaluate the similarity of their pairs based on the mean squared error. This study was later refined by having humans evaluate the similarity of these character pairs. The main drawback of this is that the sequence of words is not taken into account because the similarity comparison is performed at the character level. Furthermore, in this approach, it is assumed that the combination of homoglyphs can affect the confoundability of homoglyph strings. This approach does not have a large enough training dataset, so there is a need for human labelers to be used to refine the research. In another approach, an expert in the field demonstrated that a Siamese Convolutional Neural Network (CNN) is capable of detecting and classifying homoglyph attacks. This approach uses a dataset containing pairs of real and fake domains that can be rendered in the Arial font. While very useful for training machine learning (ML) algorithms, the main drawback of this approach is that it is inherently biased towards the Arial font. This means that small codes that can be rendered by other fonts are not taken into account in this approach. Deep learning models trained on such a dataset will be biased towards the Arial font. Furthermore, creating a large dataset curated for many fonts would be very tedious and possibly inefficient, as it would again be biased towards certain fonts. Besides homoglyphic and typo-type domains, there are also phishing domains that exploit basic human desires. These domains are the most difficult to identify and detect, and thus, to date, there is no widely accepted approach to address them. Techniques proposed by experts in the field to identify such malicious domains use other features such as domain lifetime (i.e., how long a domain is queried before people stop querying it), the number of IP addresses, etc. to determine if a domain is malicious. However, results have shown that such models usually end up capturing malware domains and other domains related to the later stages of the attack framework, particularly C2 communications, DNS exfiltration, etc.and in fact, it cannot detect any phishing domains, which indicates that this technique is more suitable for detecting malware and malicious domains but not phishing domains, which usually occur during the early stages of a cyberattack. For the above reasons, those skilled in the art continue to strive to produce systems and methods capable of detecting phishing domains from a set of DNS records that may consist of homoglyph phishing domains, typo phishing domains, and / or generic phishing domains. Brief Description of the Invention The above and other problems are solved and progress in the art is made by the system and method provided by embodiments according to the present invention. A first advantage of the embodiment of the system and method according to the present invention is that the present invention is capable of detecting and resisting early stage phishing attacks based solely on received network traffic data such as DNS records thereby preventing the protected system from being compromised by later early stage phishing attacks such as data exfiltration or credential harvesting. A second advantage of the embodiments of the systems and methods according to the invention is that in addition to detecting said domains, the invention is capable of enriching alerts related to the identification of said domains so that other organizations that are also subject to said phishing domain attacks can be warned. A third advantage of the embodiment of the system and method according to the present invention is that the present invention can use three types of phishing domain detection techniques to identify phishing domains. A fourth advancement of the embodiments of the systems and methods in accordance with the present invention is that the present invention utilizes a Generative Adversarial Neural Network (GAN), trained using a unique loss function, to generate a virtually infinite variety of glyphs, not limited to any particular typeface, to train a separate homoglyph encoder to assist in detecting and identifying homoglyph phishing domains. A fifth advantage of the embodiment of the system and method according to the present invention is that by converting the string comparison problem into an image recognition problem, batch processing can be performed allowing more strings to be processed rapidly thereby allowing large-scale network traffic data to be processed. A sixth advantage of the embodiments of the systems and methods according to the present invention is that keyboard distance is taken into account by default when converting typo phishing domain detection into an image recognition problem, via the Swype image renderer. A seventh advantage of embodiments of the systems and methods according to the present invention is that a Bidirectional Encoder Representations from Transformers (BERT) neural network is used to use natural language understanding to determine whether a domain is a possible common phishing domain. An eighth advantage of the embodiment of the system and method according to the present invention is that the resolved domain IPs marked as common phishing domains may also be used as an additional feature for correlation to determine whether the domain should be classified as a common phishing domain or not, to significantly reduce the False Positive rate of common phishing domain detection. A ninth advantage of the embodiment of the system and method according to the present invention is that a time and frequency analysis is performed for each IP that is a victim of phishing to determine whether the attack has progressed to the next stage. The above advantages are provided by embodiments of a method according to the invention which operates in the following manner. According to a first aspect of the present invention, a system for detecting phishing domains in a set of Domain Name System (DNS) records is disclosed, the system comprising: a homoglyph phishing domain detection module comprising a trained homoglyph encoder EH and a DH reference database, the module being configured to: receive string images, IHT_N, that have been rendered from homoglyph domains, wherein the homoglyph domains comprise domains each comprising a small code; encode, using the trained homoglyph encoder EH, each of the string images IHT_N into a corresponding encoding eHT_N; classify each homoglyph domain as a homoglyph phishing domain when the Euclidean distance between the corresponding encoding eHT_N and any encoding in the DH reference database is below a predetermined threshold;a typo-phishing domain detection module comprising a typo-encoder ES and a DS reference database, the module configured to: receive Swype-like images, IST_N, of domains that have been rendered from a DNS record set; encode, using the typo-encoder ES, each Swype-like image, IST_N into its corresponding encoding eST_N; classify each domain used to generate the Swype-like image set, IST_N, as a typo-phishing domain when the Euclidean distance between its corresponding encoding eST_N and any encoding in the DS reference database is below a predetermined threshold; a general phishing domain detection module comprising a trained transformer-based neural network, the module configured to: receive domains identified from a DNS record set to have strings that at least partially match strings in a phishing reference list K;generating, using a trained transformer-based neural network, a probability score for each identified domain; resolving an Internet Protocol (IP) address for each identified domain that has a probability score that exceeds a predetermined probability threshold; for each resolved IP address, obtaining all external domains associated with the resolved IP address, wherein external domains refer to all domains in a set of DNS records that resolve to the resolved IP address; generating, using a transformer-based neural network, a probability score for each obtained external domain; classifying each obtained external domain that has a probability score that exceeds a predetermined probability threshold as a common phishing domain;and an alert module configured to generate alerts for phishing domains detected in the DNS record set based on homoglyphic phishing domains from the homoglyphic phishing domain detection module, typo-typed phishing domains from the typo-typed phishing domain detection module and general phishing domains from the general phishing domain detection module.; With regard to the first aspect of the invention, the alert module comprises a blacklist and a rule-based filtering module configured to filter benign domain names from identified phishing domains. With regard to a first aspect of the present invention, the alert module further comprises: a behavioral analytics module configured to: obtain from the blacklist and rule-based filtering module unfiltered phishing domains; obtain IP addresses that query at least one unfiltered phishing domain; for each IP address that queries at least one unfiltered phishing domain, generate a count-based vector based on the number of queries to each unfiltered phishing domain made by the IP address; apply L2 normalization to each count-based vector; apply hierarchical clustering to the IP addresses and associated count-based vectors to identify count-based vectors that have similar characteristics; and classify the IP addresses associated with the identified count-based vectors as IP addresses subject to the same phishing attack campaign. With regard to a first aspect of the present invention, the alert module further comprises: a behavioral analytics module configured to: obtain from the blacklist and rule-based filtering module unfiltered phishing domains; obtain IP addresses that query at least one unfiltered phishing domain; for each IP address that queries at least one unfiltered phishing domain, generate a count-based vector based on the number of queries to each unfiltered phishing domain generated by the IP address; apply L2 normalization to each count-based vector; apply Locality Sensitive Hashing (LSH) to the IP address and associated count-based vectors to identify count-based vectors that have similar characteristics; and classify the IP addresses associated with the identified count-based vectors as IP addresses targeted by a phishing attack campaign. With regard to the first aspect of the present invention, the behavioral analytics module further comprises a dimensionality reduction procedure such as TSNE or UMAP prior to hierarchical clustering or LSH. With regard to a first aspect of the invention, the alert module further comprises: a behavioral analytics module further configured to: obtain from the blacklist and rule-based filtering module unfiltered phishing domains; obtain IP addresses that query at least one unfiltered phishing domain; for each IP address that queries at least one unfiltered phishing domain, collect a sorted list of timestamps when a query to the at least one unfiltered phishing domain is made; calculate a relative time using the sorted timestamps, wherein each calculated relative time is an elapsed time with respect to the first timestamp;relative time bins calculated into the desired sampling frequency and count the number of entries in each bin to obtain an event time series, wherein the event time series is defined as the number of queries made to at least one unfiltered phishing domain; apply a Hanning filter to the event time series and perform a frequency analysis on the filtered event time series to determine the presence of periodicity and its associated frequency.; With regard to the first aspect of the present invention, the homoglyph encoder EH is trained by minimizing a triplet loss training function, Ltripiet with respect to the parameters of the homoglyph encoder EH, and the Ltripiet function, is defined as, -min(max(||E(A) - EiPy2- ||F(4) - E(W)| |2+ M, 0.0) c where the Positive v of the Ltripiet function is provided with a set of rendered images from a set of frequently visited popular Internet domains, the Anchor input of the Ltripiet function is provided with a set of outputs from a trained Phish-Generative Adversarial Network (Phish-GAN) each corresponding to a glyphed version of the current set's positive input, the Negative input of the Ltripiet function is provided with a set of domain string images sampled from a set of frequently visited popular Internet domains that are considered by the encoder Eh to be similar to the current set's anchor input but do not include actual positive samples for that set, and where E(P) is defined as the Positive encoded output, E(A) is defined as the Anchor encoded output, E(N) is defined as the Negative encoded output and M is the margin. With regard to the first aspect of the present invention, the EH homoglyph encoder is trained by minimizing a Normalized Temperature-scaled Cross Entropy (NT-Xent) loss function. LNT-xent, is defined as, ^NT-Zeni = min — 7*+ An=l where the Positive input of the LNT-xent function is provided with a set of rendered images from a set of frequently visited popular Internet domains, the Anchor input of the LnT-xent function is provided with a set of outputs from a trained Phish-Generative Adversarial Network (PhishGAN) each corresponding to a glyphed version of the current set's positive input, the Negative input of the LnT-xent function is provided with a set of domain string image sets from a set of frequently visited popular Internet domains that the EH encoder deems similar to the current set's anchor input but excluding actual positive samples for that set, and where sar is a cosine similarity measure between the anchor encoding and the positive samples and is a cosine similarity measure between the anchor encoding and the negative samples. With regard to the first aspect of the invention, a trained Phish-GAN comprises: a trained generator, G, configured to receive images x rendered from a training data set, y, and randomly generated noise, z, to generate a glyphed version, G(x,z) of each received image; in the trained scriminator, D, is configured to: accept a glyphed version, G(x,z) of a trained generator G, and an image x; and classify images x and G(x,z) into fake or real images via a discriminator function D(), where the generator G is trained using a dot product loss function, Ldot defined as: Ldot = flat([G(x,z))y flat(x) where flatQ is defined as a flat function that reshapes the image tensor into a vector to compute the dot product, and where the trained Phish-GAN consists of a generator objective function G* and a discriminator objective function D* defined as, G* = minG(log(D(») + log(l - D(G(x, z)}) + Ldot) D* = m / ijip / log (D(x~)) + log^l —ρ^(χ,ζ)^) With regard to the first aspect of the present invention, the typo-encoder Es is trained by minimizing the Normalized Temperature-scaled Cross Entropy (NTXent) loss function. LNT-xent, defined as, Lw-Zent = min - log where the Positive input of the LNT-xent function is provided with a set of rendered Swype-like images from a set of frequently visited popular Internet domains, the Anchor input of the LwT-xent function is provided with a set of Swype-like images from generated typo-phishing domains targeting the corresponding set's positive input, the Negative input of the LnT-xent function is provided with a set of rendered Swype-like domain images from a set of frequently visited popular Internet domains that the Es encoder deems similar to the current set's anchor input but does not include any actual positive samples for that set, and where sar is a cosine similarity measure between the anchor encoding and the positive samples and is a cosine similarity measure between the anchor encoding and the negative samples. With regard to a first aspect of the present invention, a typo encoder Es is trained by minimizing a Triplet loss function Ltripiet, defined as, = min(niax(|IYY - ||E(L) - E(W)| |2+ M, 0.0) c wherein the Positive input of the Ltripiet function is provided with a set of rendered Swype-like images from a set of frequently visited popular Internet domains, the Anchor input of the Ltripiet function is provided with a set of Swype-like images from generated typo-like phishing domains targeting the corresponding set's positive input, the Negative input of the Ltripiet function is provided with a set of Swype-like domain image sets from a set of frequently visited popular Internet domains that the encoder Es deems similar to the current set's anchor input but does not include actual positive samples for that set, and wherein E(P) is defined as the encoded output Positive, E(A) is defined as the Anchor encoded output, E(N) is defined as the Negative encoded output and M is the margin. With regard to the first aspect of the present invention, wherein the transformer-based neural network is trained using a binary cross-entropy loss function. With regard to a first aspect of the invention, wherein generating a probability score for each identified domain using a general phishing domain detection module comprises a general phishing domain detection module configured to: perform sub-word tokenization on each identified domain, and generate, using a trained transformer-based neural network, a probability score based on the sub-word tokens. With regard to a first aspect of the invention, wherein the common phishing domain detection module is further configured to: for each resolved IP address, obtain all external domains, wherein the external domains comprise domains resolved to the IP address, generate, using a trained transformer-based neural network, a probability score for each external domain based on sub-word tokens; and classify all external domains whose probability scores exceed a predetermined threshold as common phishing domains when it is determined that the percentage of the obtained external domains classified as common phishing domains exceeds the percentage threshold. With regard to a first aspect of the present invention, classifying each homoglyphic domain as a homoglyphic phishing domain by a homoglyphic phishing domain detection module comprises a homoglyphic phishing domain detection module that is otherwise configured to: classify each homoglyphic domain as a homoglyphic phishing domain when the cosine similarity between the associated encoding eHT_N and any encoding in the reference database Dh is above a predetermined threshold;classification of each domain used to generate a set of Swype-like images, Ist_n, by a typo-phishing domain detection module comprising a typo-phishing domain detection module configured to: classify each domain used to generate a set of Swype-like images, Ist_n, as a typo-phishing domain when the cosine similarity measure between the associated encoding Bst n and any encoding in the reference database Ds is above a predetermined threshold.; With regard to a first aspect of the present invention, a homoglyphic phishing domain detection module is further configured to: receive string images, Ιητ_ν3ιι, that have been rendered from all queried domains; encode, using a trained homoglyphic encoder Eh, each string image IHT_Nall into its corresponding encoding eHT Nall; classify each queried domain as a similar phishing domain when a similarity measure between the corresponding encoding eHT n and any encoding in a reference database Dh passes a predetermined threshold. According to a second aspect of the present invention, a method for detecting phishing domains in a Domain Name System (DNS) record set using a homoglyph phishing domain detection module comprising a trained homoglyph encoder EH and a reference database Dh, the typo phishing domain detection module comprising a trained typo encoder Es and a reference database Ds, a general phishing domain detection module comprising a trained transformer-based neural network and an alert module is disclosed, the method comprising: receiving, using the homoglyph phishing domain detection module, string images, Iht_n, that have been rendered from homoglyph domains, wherein the homoglyph domains comprise domains each comprising punycodes; encoding, using the trained homoglyph encoder f Eh, each of the string images Iht_n into their encodings Bht n;classifying, using the homoglyph phishing domain detection module, each homoglyph domain as a homoglyph phishing domain when the Euclidean distance between its corresponding encoding Bht n and any encoding in the reference database Dh is below a predetermined threshold value; receiving, using the typo-phishing domain detection module the Swype-like images, Ist_n, of the rendered domains from the DNS record set; encoding, using the trained typo-phishing encoder Es of the typo-phishing domain detection module, each of the Swype-like images, Ist_n into their encodings Bst n;classifying, using a typo-phishing domain detection module, each domain used to generate a set of Swype-like images, Ist_n, as typo-phishing when the Euclidean distance between the corresponding encoding Bst n and any encoding in the reference database Ds is below a predetermined threshold value; receiving, using a general phishing domain detection module, domains identified from the set of DNS records to have strings that at least partially match strings in the phishing reference list K; generating, using a transformer-based neural network trained from the general phishing domain detection module, a probability score for each of the identified domains;resolving, using a general phishing domain detection module, Internet Protocol (IP) addresses for each identified domain that has a probability score exceeding a predetermined probability threshold value; for each of the resolved IP addresses, using the general phishing domain detection module to: obtain all external domains associated with the resolved IP address, wherein external domain refers to all domains in a set of DNS records in the set of DNS records; generating, using a transformer-based neural network, a probability score for each of the obtained external domains; classifying each of the obtained external domains that has a probability score exceeding a predetermined probability threshold value as a general phishing domain;and generating, using the alert module, alerts for the detected phi shing domains i in the DNS record set based on the homoglyph phi shing domains from the detection module i homogl if phishing domains, the mistyped phishing domains from the detection module i the mistyped phi shing domains k and the common phishing domains from the common phishing domain detection module; With regard to a second aspect of the present invention, alerts generated using the alert module comprise: filtering, using a blacklist and rule-based filtering module, benign domain names from identified phishing domains. With regard to a second aspect of the present invention, alerts generated using the alert module comprise: obtaining, using the behavioral analytics module, from the blacklist and rule-based filtering module, unfiltered phishing domains; obtaining, using the behavioral analytics module, IP addresses that query at least one of the unfiltered phishing domains; for each IP address that queries at least one of the unfiltered phishing domains, using the behavioral analytics module to: generate a count-based vector based on the number of queries for each unfiltered phishing domain generated by the IP address; apply L2 normalization to each count-based vector;applying, using a behavioral analytics module, Hierarchical clustering to IP addresses and their count-based vectors to identify count-based vectors that share similar characteristics; and classifying, using a behavioral analytics module, IP addresses associated with the identified count-based vectors as IP addresses experiencing the same phishing attack campaign.; With regard to a second aspect of the present invention, alerts generated using the alert module comprise: obtaining, using the behavioral analytics module, from the blacklist- and rule-based filtering module unfiltered phishing domains; obtaining, using the behavioral analytics module, IP addresses that query at least one of the unfiltered phishing domains; for each IP address that queries at least one of the unfiltered phishing domains, using the behavioral analytics module to: generate a count-based vector based on the number of queries for each unfiltered phishing domain generated by the IP address; applying L2 normalization to each count-based vector;applying, using a behavioral analytics module, Locality Sensitive Hashing (LSH) to the IP addresses and their count-based vectors to identify count-based vectors that share similar characteristics; and classifying, using a behavioral analytics module, the IP addresses associated with the identified count-based vectors as IP addresses subject to a phishing attack campaign.; Short Description of Image The above problems and other problems are solved by the characteristics and advantages of a system and method according to the present invention which are described in detail and shown in the following figures. Figure 1 illustrates a block diagram of a module that may be used to implement a method and / or system for detecting phishing domains in a set of Domain Name System (DNS) records in accordance with embodiments of the present invention; Figure 2 illustrates a block diagram of the modules used to implement another embodiment of a method and / or system for detecting phishing domains in a Domain Name System (DNS) record set in accordance with embodiments of the present invention; Figure 3 illustrates a block diagram representing a processing system providing embodiments in accordance with embodiments of the present invention; Figure 4 is a process flow for training Phish-GAN and homoglyph encoder in accordance with embodiments of the present invention; Figure 5 illustrates a sample output from the Phish-GAN Discriminator when a fake image and a real image are fed to the Discriminator; Figure 6 illustrates the training process flow of a homoglyph encoder in accordance with embodiments of the present invention; Figure 7 illustrates the process flow carried out by the homoglyph domain phi shing detection module in accordance with embodiments of the present invention; Figure 8 illustrates the encoding produced by a trained homoglyph encoder as projected onto a low-dimensional visualization plane in accordance with embodiments of the present invention; Figure 9 illustrates images rendered by Swype of domain names in accordance with embodiments of the present invention; Figure 10 illustrates a training process flow of a typo-proof encoder in accordance with embodiments of the present invention; Figure 11 illustrates the process flow performed by a typo-phishing domain detection module in accordance with embodiments of the present invention; Figure 12 illustrates domain clusters and their typo variants encoded by a typo encoder trained and projected onto a low-dimensional visualization plane in accordance with embodiments of the present invention; Figure 13 illustrates a transformer-based neural network model used by a general phishing domain detection module to identify common phishing domains that may be in accordance with embodiments of the present invention; Figure 14 illustrates the process flow for identifying common phishing domains using keyword lists, transformer-based neural networks and resolved IP addresses; Figure 15 illustrates a sample count-based vector for IP addresses; Figure 16 illustrates a sample plot of the number of events detected over a given time period; Figure 17 illustrates the use of the Hamming filter on the plot illustrated in Figure 16 ; Figure 18 illustrates a sample set of organizations targeted by the same malicious domain; and Figure 19 illustrates a sample plot showing the periodicity of phishing attacks. 4 Complete Description of the Invention The present invention relates to systems and methods for detecting phishing domains, used by cyber attackers to conduct phishing attacks, through the use of Domain Name System (DNS) records. The system comprises a homoglyph phishing domain detection module, a typo phishing domain detection module, a generic phishing domain detection module and an alert module. These modules are configured to collaboratively detect and identify phishing domains from a set of DNS records using a combination of homoglyph , typo , and generic phishing domain techniques. In particular, these modules are configured to use Generative Adversarial Neural Networks (GANs), image recognition algorithms, transformer neural networks and / or behavior-based analysis techniques to identify and detect phishing domains and possible phishing campaigns from a set of DNS records. The present invention will now be described in detail with reference to several embodiments thereof as illustrated in the accompanying drawings. In the following description, many special features are set forth to provide a thorough understanding of embodiments of the present invention. However, it will be apparent to those skilled in the art, that embodiments may be realized without some or all of the special features. Such embodiments shall also be within the scope of the present invention. Furthermore, certain process steps and / or structures hereinafter may not be described in detail and the reader is referred to the appropriate citations so as not to unnecessarily obscure the present invention. Furthermore, those skilled in the art will recognize that many of the functional units in this description have been labeled as modules throughout the specification. Those skilled in the art will also recognize that a module may be implemented as a circuit, logic chip, or any discrete component. Furthermore, those skilled in the art will also recognize that a module may be implemented in software that can then be executed by various processors. In embodiments of the present invention, a module may also comprise computer instructions or executable code that can instruct a computer processor to carry out a sequence of events based on the instructions received. The choice of implementation of a module is left to those skilled in the art as a design choice and does not limit the scope of the present invention in any way. Figure 1 illustrates a block diagram of the modules used to implement a method and / or system for detecting phishing domains in a Domain Name System (DNS) record set in accordance with embodiments of the present invention. Generally, as illustrated in the Figure, the DNS record set ( 103 ) is provided to a string image renderer ( 105 ) , a Swype image renderer ( 115 ) and a Domain filter ( 120 ) . The string images from the string image renderer ( 1 05 ) are then given to the homoglyph detection module ( 125 ). The module ( 125 ) then proceeds to identify possible homoglyph phishing domains from the images. These 6 received strings and identified homoglyph phishing domains are then given to the alert module (140). Simultaneously, the Swype image from the Swype image renderer (115) is provided to the typo phishing domain detection module (130). The module (130) then proceeds to identify typo phishing domains from the received string images and these typo phishing domains are then provided to the alert module (140). At the same time, strings that do not at least partially match strings in the phishing reference list are filtered out in the Domain filter (120). These strings are passed to the general phishing detection module (135). The module (135) then proceeds to identify general phishing domains using the remaining strings and these general phishing domains are then passed to the alert module (140). The alert module (140) then uses the received homoglyphic phishing domains, mistyped phishing domains and generic phishing domains to identify additional anomalous behavior and the possibility of similar phishing campaigns affecting multiple IP addresses. A phishing campaign is essentially an attack campaign conducted by a particular cyber attacker. The alert module (140) correlates the outputs of the modules (120, 130 and 135) to identify similar phishing behavior affecting multiple IP addresses in the DNS records to identify IP addresses experiencing the same phishing campaign, indicating the likelihood of them being targeted by the same threat actor. Before the system illustrated in Figure 1 is used to detect phishing domains in a DNS record set, each module contained therein must undergo a setup phase. In an embodiment of the present invention, a checklist L of commonly used domains, popular domains, and all such similar domains is first generated. A string image renderer 105 is then used to render string images for each of the domains in the checklist L. A trained homoglyph encoder Eh, provided within the homoglyph detection module 125, is then configured to generate encodings for each of the rendered string images. These encodings generated by the trained homoglyph encoder EH are then stored in a DH reference database.In embodiments of the present invention , the DH reference database is stored in the homoglyphic phishing domain detection module ( 125 ) or is stored in an external server communicatively connected to the module ( 125 ) . During the setup phase, a checklist L is also provided to the Swype image renderer ( 115) . The Swype image renderer ( 115 ) then renders Swype-like images for each domain in the checklist L. A trained typo encoder Es, provided in the typo detection module ( 130 ), is then configured to generate encodings for each of the rendered Swype-like images. These encodings generated by the encoder Es are then stored in a reference database Ds. In embodiments of the present invention, the reference database Ds is stored in the typo detection module ( 130 ) or is stored in an external server communicatively connected to the module ( 130 ). Additionally, during this setup phase, a list of keywords frequently used in phishing and clickbait is obtained from external databases and records, for example the PhishTank database, and used to populate the phishing reference list K. Once the setup phase is complete, the system illustrated in Figure 1 can then be used to detect phishing domains in the DNS record set (103). The string image renderer ( 1 0 5 ) is first configured to render homoglyph domains into a set of string images, Iht_n, wherein the homoglyph domains comprise domains having a punycode present in their domain string, indicating the presence of at least one glyph in their domain string (i.e., a non-Latin character). These homoglyph domains comprise domain names of a DNS record set ( 103 ) each of which has a sub-domain / domain name prefixed with xn--” indicating the presence of a punycode, implying the presence of a homoglyph. In other embodiments of the present invention, the string image renderer ( 105 ) is additionally configured to render all domain names in the DNS record set ( 105 ) into a set of string images, Iht_n so that similar domains exploiting visual similarity in the Latin family, without the presence of homoglyphs, are also detected and classified accordingly.Examples of such similar domains include replacing w” with vv”, replacing I” with 1”, and so on. A homoglyph phishing detection module (125), equipped with a trained homoglyph encoder Eh and a reference database Dh, is then configured to receive a collection of string images, Iht_n, from a string image renderer (105). The trained homoglyph encoder Eh, proceeds to encode each of the string images Iht n into their encodings Bht n. These encodings eHT n are then compared with the encodings contained in the reference database Dh. If it is found that the Euclidean distance between the corresponding encoding eHT n and any encoding in the reference database Dh is below a predetermined threshold value, the module 125 will then classify the corresponding encoding eHT n as a homoglyphic phishing domain. In other embodiments of the present invention, other similarity measures other than Euclidean distance may also be used. Examples include, cosine similarity, L1 similarity, etc. In another embodiment of the present invention, the homoglyph phi shing domain detection module ( 12 5) is further configured to receive another set of string images, IHT_Nall, that have been rendered from all queried domains from the string image renderer (105). The trained homoglyph encoder Eh, proceeds to encode each of the string images IHT_Nall into their encodings eHT_Nall. These encodings eHT Nall are then compared with the encodings contained in the reference database Dh. Each queried domain is then classified as a similarity phi shing domain when a similarity measure, i.e., Euclidean distance and / or Cosine similarity, between the corresponding encoding eHT Nall and any encoding in the reference database DH passes a predetermined threshold value. Concurrently, the Swype image renderer (115) is configured to render domain names from the DNS record set (103) into a set of Swype-like images, Ist_n. The typo detection module (130), equipped with a trained typo encoder Esand a reference database Dsis then configured to receive a set of Swype-like images, Ist_n, from the Swype image renderer (115). The trained typo encoder Es, proceeds to encode each of the Swype-like images Ist_n into their encodings esT_N. These encodings esT_N are then compared to the encodings contained in the reference database Ds.If it is found that the Euclidean distance between the associated encoding Bst n and any encoding in the reference database Ds is below a predetermined threshold value; or in other embodiments, if there is a cosine similarity between the associated encoding eST N and any encoding in the reference database Ds that exceeds a required match threshold value, the module 130 will then classify the associated encoding esT n as typo phishing. In a further embodiment of the present invention, a weighted Damerau Leveshtein Distance algorithm that considers keyboard distance through heuristics may be used to provide further validation of typo phishing domains identified by the module 130. In addition to simultaneous detection of homoglyphic and typo-related phishing domains, the Domain filter (120) is configured to filter out domain names from the DNS record set (103) that do not contain at least one keyword or phrase from the phishing reference list K. As a result, the remaining domain names will all have strings that at least partially match strings in the phishing reference list K. These remaining domain names are then passed to a trained transformer-based neural network, provided within the general phishing domain detection module ( 135 ), so that a probability score is generated for each of the remaining domain names. In other words, for each provided domain name, the trained transformer-based neural network will classify the probability that the domain is a general phishing domain based on its string features. For each domain name that has a probability score exceeding a pre-defined probability threshold, the Internet Protocol (IP) address for the domain name will then be resolved. All resolved IP addresses are then stored in the suspicious resolved IP address pool {p}.For each IP address contained in the set {p}, module 135 then obtains all the corresponding domain names that resolve to an IP address from the set of DNS records 103, without considering whether these domain names contain any of the keywords contained in the phishing reference list K. Each of the domain names is then run through a transformer neural network trained to classify whether the domain name comprises a common phishing domain or not. In other words, for each of the resolved IP addresses, module 135 will obtain all the domain names in the set of DNS records 103 that are associated with the resolved IP address (referred to as external domains); and then to generate again, using a transformer-based neural network, a probability score for each of the retrieved external domains.External domains having a probability score exceeding a predetermined probability threshold are then classified as common phishing domains. In a further embodiment of the present invention, external domains having a probability score exceeding a predetermined probability threshold are only classified as common phishing domains when it is determined that at least a certain percentage of the external domains resolving to a particular IP address have been deemed to be common phishing domains. For example, 50% or more of all domains resolving to a particular IP address (i.e., external domains resolving to a particular IP address) have been flagged as possible phishing domains before the external domains exceeding a predetermined probability threshold are classified as common phishing domains.This serves as an additional check to reduce the False Positive rate. The rationale behind this check is that attackers tend to reuse their infrastructure, especially when attempting phishing attacks, so they can expand their reach without significant additional costs. The alert module (140) is then configured to provide further analysis of the outputs of the various phishing detection modules (125, 130 and 135) by identifying anomalous phishing behavior and phishing campaigns that may be conducted by a sophisticated threat actor attempting to phish on multiple IPs / organizations. The module (140) takes as input all identified phishing domains and their victims from a set of DNS records based on homoglyphic phishing domains received from the homoglyphic phishing domain detection module (125), typo-typed phishing domains received from the typo-typed phishing domain detection module (130) and generic phishing domains from the generic phishing domain detection module (135). The module ( 1 4 0 ) consists of a blacklist and rule-based filtering module ( 205 ) and a behavioral analytics module ( 210 ).The filtering module 205 may be configured to further filter benign domain names that were inadvertently retrieved from the DNS record set 103 by the phishing detection modules 125, 130 and 135. For example, any domain name ending in .gov.sg or com.sg may be removed from the possible phishing domains identified by the modules 125, 130 and 135 as domain names ending in these country-specific Top Level Domains (TLDs) must be officially registered. Therefore, the probability of phishing websites being hosted on these TLDs is very low. The behavioral analytics module 210 is then configured to determine, based on the remaining phishing domains, if the phishing attack campaigns are being conducted by malicious parties and whether the phishing domains exhibit any anomalous temporal behavior. Each of the modules described above will be discussed in detail in the following sections. In accordance with embodiments of the present invention, a representative block diagram of the components of the processing system (300) provided in each module illustrated in Figures 1 or 2 for implementing embodiments in accordance with embodiments of the present invention is illustrated in Figure 3. One skilled in the art will recognize that the exact configuration of each processing system provided in these modules is different and the exact configuration of the processing system (300) may vary and Figure 3 is provided as an example only. In embodiments of the present invention, each module comprises a controller (301) and a user interface (302). The user interface (302) is structured to allow manual interaction between the user and each of these modules as needed and for this purpose includes input / output components necessary for the user to enter instructions to provide updates to each of these modules. One skilled in the art will recognize that the user interface components (302) may vary from one embodiment to another but include one or more displays (340), a keyboard (335) and a trackpad (336). The controller (301) communicates data with the user interface (302) via a bus (315) and includes memory (320), a processor (305) mounted on a circuit board that processes instructions and data to implement the methods of this embodiment, an operating system (306), an input / output (I / O) interface (330) for communication with the user interface (302) and a communication interface, in this embodiment in the form of a network card (350). The network card (350) may, for example, be used to send data from these modules over a wired or wireless network to another processing device or to receive data over a wired or wireless network. Wireless networks that may be used by the network card (350) include, but are not limited to, Wireless-Fidelity (Wi-Fi), Bluetooth, Near Field Communication (NFC), cellular networks, satellite networks, telecommunications networks, Wide Area Networks (WAN) and so on. Memory (320) and operating system (306) are in data communication with CPU (305) via bus (310). Memory components include volatile and non-volatile memory and more than one of each type of memory, including Random Access Memory (RAM) (320), Read Only Memory (ROM) (325) and mass storage device (345), the latter comprising one or more solid-state drives (SSDs). Memory (320) also includes secure storage (346) for securely storing secret keys, or private keys. Those skilled in the art will recognize that the memory components described above comprise non-transitory computer-readable media and should be considered to comprise all computer-readable media except for transient propagation signals. Typically, instructions are stored as program code in the memory components but may also be programmed.Memory ( 32 0 ) may include kernels and / or programming modules such as software applications that may be stored in volatile or non-volatile memory. Here the term processor is used to refer generally to any device or component capable of processing such instructions and may include: a microprocessor, microcontroller, programmable logic device, or other computing device. That is, the processor 305 may be provided with suitable logic circuitry to receive input, process it according to instructions stored in memory and produce output (e.g., to a memory component or to a display 340). In this embodiment, the processor 305 may be a single-core or multi-core processor with a memory address space. In one example, the processor 305 may be multi-core, including for example an 8-core CPU. In another example, it may be a cluster of CPU cores operating in parallel to accelerate computation. In general, the homoglyph detection module (125) comprises a homoglyph encoder Eh, trained via a pre-trained conditional Generative Adversarial Network (GAN) labeled as Phish-GAN configured and trained to generate an infinite homoglyph dataset based on multiple letters, and a reference database DH, generated during the setup phase. The training process flow of Phish-GAN (405) and the homoglyph encoder EH, namely encoder (450), is illustrated in Figure 4. The architecture of Phish-GAN (40 5) is generally based on the Pix2Pix network architecture with some new changes made to the loss function and network architecture. As illustrated in Figure 4, it can be seen that the main components of Phish-GAN (40 5) are the Generator Neural Network (415) and the Discriminator (420), D(). During the initial stage, since the generator (415) has not been trained, its output initially consists only of noise, regardless of its input. In embodiments of the present invention, the generator (415) may comprise, but is not limited to, a UNet architecture with skip connections connecting the down-sampling and up-sampling layers.The discriminator (420) may comprise, but is not limited to, a convolutional classifier neural network configured to learn to classify whether an input image is a real image or a fake image, i.e., a PhishGAN / GAN generated image. An example workflow of the discriminator (420) is illustrated in Figure 5. When a glyphed image (502) is provided to the discriminator (504), the discriminator (504) should ideally produce an output indicating that the image is a fake image. Conversely, when a real image (506) is provided to the same discriminator (504), the discriminator (504) should ideally produce an output indicating that the image is a real image. To train Phish-GAN (4 0 5) , an open source dataset y consisting of domains and their possible similarities is used . The entire dataset y is then given to an image renderer (4 1 0 ) , which is configured to render a string of some Letters into an image, x. The rendered image, x, from the dataset, and some randomly generated noise, z are then given to a Neural Network (415) . The generator (415) uses the received rendered image, x and the randomly generated noise, z to generate a glyphed version G(x, z) of each rendered image, x. The glyphed version G(x, z) and the rendered image x are then given to a scriminator (420) . The scriminator (420) then attempts to determine the real image and the fake image based on the provided data.The output generated by the scriminator (420) is compared in the training step (430) to determine whether the scriminator (420) successfully identifies the real image and the fake image and the result of step (430) is then given to the discriminator (420) to train it. The output of the discriminator (420) is then fed back to the generator (415) to train it in an adversarial manner (i.e. the generator training loss will be low if the discriminator (420) is fooled into believing that a particular GAN-generated input image is a real image and vice versa) through the training step (4 4 0). In embodiments of the present invention, the dot product loss function Ldot, may be used as an additional loss in step 440 to train the generator 415, wherein the dot product loss Ldot is defined as: Ldot = flat((G(x,z)))· flat(x) where flatQ is defined as a flat function that reshapes the image tensor into a vector to compute the dot product. It is found that such a loss function is useful in preserving image models. The objective function of the generator G* can then be defined as: G* = minG(\og(D(x)) + log(l - D(G(x,z))) + Ldot) where (log(D(x)) + log(l - D(G(x,z))j is the typical generator adversarial loss which is inversely proportional to how well the discriminator performs, and the objective function in the scriminator D* can then be defined as: D* = maxD(log (D(x)) + log^l where (log + log(l - D(G(x,z))}) is defined as the typical discriminator loss, which is inversely proportional to how well the generator performs. Once the Phish-GAN (405) is trained, its output (406) can then be used to train the encoder (450) . In embodiments of the present invention, the encoder 450 may comprise, but is not limited to, a Convolutional Neural Network (CNN). In embodiments of the present invention, a contrastive loss function, such as, but not limited to, the Triplet loss technique, as illustrated at the bottom of Figure 4, may be used to train the encoder 450. The Triplet loss technique generally comprises three inputs: a Positive input (P), an Anchor input (A) and a Negative input (N); and three outputs: a Positive encoding E(P), a Negative encoding E(N), and an Anchor encoding E(A). In an embodiment of the present invention, for training the encoder (450), a data set consisting of the most popular domains is used as a positive input (P), the output of the Phish-GAN (405) is used as an anchor (A) input (wherein the data set consisting of the most popular domains is provided as an input to the Phish-GAN (405), and random samples of domains that the encoder (450) deems most similar to the corresponding anchor input (A) but excluding the corresponding positive input (P) are provided as negative inputs (N). In other words, it can be said that the positive input (P) consists of examples of the anchor input (A) attempted to imitate from the data set consisting of the most popular domains, while the negative samples are randomly drawn from a list of domains that are most similar (as deemed by the encoder (450)) to the anchor input (A) but excluding the positive input (P). The Triplet Loss Ltripiet can be defined as: Lmpiet = min(max (| |E(Z) - E(P)||2- ||E(Z) - E(N)112+ M, 0.0) C where we minimize the maximum of | |F( / 1) - F(P)| |2- | |F(j4) - E(W)| |Z+ M and 0. M is defined as Margin. It is clear from the equation that minimizing the Triplet loss Ltripiet is equivalent to ensuring that the distance between E(A) and E(P) is at least smaller than the distance between E(A) and E(N), with a margin of M. If it is more, the loss will be zero and will not affect the training of the encoder (450). In this way, the encoder (450) is trained to produce similar encodings for positive and anchor inputs and at the same time, different encodings for anchor and negative inputs with a margin of at least M. In other embodiments of the present invention, other similarity loss functions can also be used as the similarity function for the loss Triplets.In another embodiment, the NT-Xent loss along with the applicable cosine loss function can be used to train the encoder. Figure 6 illustrates a workflow showing how an encoder 450 can be trained in accordance with embodiments of the present invention. A dataset 601 comprises a dataset having the most popular domains and this dataset is provided to an image renderer 605. The rendered string images in the dataset 601 are then provided to the trained Phish-GAN 615 and also as Positive input (P) to the encoder 450. The glyphed output of the trained Phish-GAN 615 is then provided to the encoder 450 as Anchor input (A). Random samples of the domain obtained from the dataset 601, which are considered by the encoder 450 to be similar to the anchor (A) (excluding the positive samples provided to the Positive input (P)) are then provided as negative input (N) to the encoder 450. The encodings E(P), E(A) and E(N) along with all the given inputs are then all used by the contrastive loss function to train the encoder (450) . Once trained, the desired encoder (450) can then be used to generate encodings from the queried domains and the domains contained in a dataset of popular domains. If the Euclidean distance between the encoding of the queried domain and any of the domain encodings in the dataset is less than a certain threshold, the queried domain is classified as a homoglyphic phishing domain and the target domain (i.e., the domain the homoglyph is attempting to impersonate) is then determined to be the domain in the dataset whose encoding has the smallest Euclidean distance to the encoding of the queried domain. This workflow is illustrated in Figure 7. The checklist (702) consists of a list of popular domains generated by various external databases. Domain images rendered from the checklist (702) are then created by an image renderer (704) and provided to a desired encoder (710). The trained encoder (710) then provides the encodings from the checklist (702) to the database (708). When a queried domain is provided to the image renderer (706), which is actually the same module as the image renderer (704), the image renderer (706) then renders an image of the queried domain. The rendered image of the queried domain is then provided to the queried encoder (710). The trained encoder (710) then generates an encoding of the queried domain. The similarity of the queried domain encoding to the encodings in the database (708) is then compared in step (712). If the Euclidean distance between the queried domain encoding and any of the domain encodings in the database is less than a certain threshold value (this should theoretically be a margin M), the queried domain is then classified as a homoglyphic phishing domain and an alert with the targeted domain is then generated.The targeted domain (i.e. the homoglyph domain that is trying to mimic ) is the corresponding domain in the database ( 708) whose encoding has the smallest Euclidean distance from the encoding of the queried domain. In other embodiments of the present invention, a hashing algorithm such as a Locality Sensitive Hashing algorithm may be applied to the encoding of domains in the checklist and the encoding of the queried domain to quickly filter out domains whose encoding is clearly different from the queried domain. This may significantly speed up the search for similar domains. A reduced-dimension example encoding of homoglyphic phishing domains (popular domains), as obtained from the output of the trained encoder, along with their associated 'targeted' domains is plotted in Figure 8. Specifically, homoglyphic phishing domains (802) are associated with the target domain 'instagram.com', homoglyphic phishing domains (804) are associated with the target domain 'yahoo.com', homoglyphic phishing domains (806) are associated with the target domain 'facebook.com', homoglyphic phishing domains (808) are associated with the target domain 'google.com', homoglyphic phishing domains (810) are associated with the target domain 'inkedin.com'. com', homogl if phishing domains ( 8 1 2 ) are associated with the target domain 'covid19info.live, homogl if phishing domains ( 81 4 ) are associated with the target domain 'wikipedia . org ' , the phishing domains homogl if ( 81 6 ) are associated with the target domain ' microsoft .com' , homoglyph phishing domains (81 8 ) are associated with their target domain ' twitter . com' , homoglyph phishing domains (820 ) are associated with their target domain ' youtube . com' , and homoglyph phishing domains (8 22 ) are associated with their target domain ' apple . com' . Simultaneously, as the DNS record (105) is being rendered by the string image renderer (1 0 5), the DNS record (105) will also be rendered by the Swype image renderer (115) into Swype-like images. The Swype image renderer (115) does this by rendering Swype-like images based on the QWERTY keyboard layout because this layout is the most widely adopted keyboard format. In embodiments of the present invention, this is done by mapping each character in the string to a grid location based on its physical location on a QWERTY keyboard. For example, the character q is mapped to the grid [1; 0] because it is located on the second row and first column on a QWERTY keyboard. To ensure that the lines are separated and not directly on top of each other, a small amount of noise is added to each keyboard position corresponding to each character in the string. In this embodiment, random uniform noise between 0 and 0.1 is added for both axes.This corresponds to 10% of the keys on the keyboard because each key on the keyboard is defined to have a length and height of 1. Next, to account for the order of characters in a text string, a predefined sequence of colors is used (although other identification methods can also be used). For example, the first stroke between the 1st and 2nd characters will always be blue, the next stroke between the 3rd and 4th characters will always be light blue, etc. Finally, the location of the corresponding keys (along with noise) on a 4 x 10 grid, corresponding to a QWERTY keyboard, is multiplied by a factor of 10 and rendered into a 40 x 100 image via the Python package Pillow. Figure 9 illustrates two examples of popular domains, namely domains (902) and (906); and two possible typo variants, namely variants (904) and (908). As shown, through the use of the Swype image renderer (900), the Swype-like images of the two domains (912) and (916); are similar to the Swype-like images of the corresponding typo variants (914) and (918), respectively. This occurs for domain (902) and its variant (904), because o and i are right next to each other on the keyboard. Therefore, the difference between the Swype-like images of google (912) and goigle (914) is barely noticeable. Similarly, for domain (906) and its variant (908), a and q are right next to each other on the keyboard, thus rendering facebook (916) and the Swype-like fqcebook (918) almost identically. In general, the typo detection module (130) comprises a trained typo encoder ES and a reference database DS (which has been generated as previously described above). Referring to Figure 10, the ES encoder (1015) may be trained using a contrastive loss function such as, but not limited to, a Triplet loss function (as described in the previous section) or a Normalized Temperature-scaled Cross Entropy (NT-Xent) loss function so that the encoder (1 0 1 5) can produce similar encodings for the domain and its typo variants, and different encodings for the domain and its non-typo variants.Using the same methodology used to train the EH homoglyph encoder, which consists of, but is not limited to, a CNN, the actual domain is provided as the Positive input (P), the typo variants are provided as the Anchor input variants (A) and the typo variants that the encoder considers (101 5) to output. 6 visual characteristics similar to the anchor (A) are provided as Negative (N) inputs to the encoder (1015). In an embodiment of the present invention, the NT-Xent loss function is used to train the encoder (1015). The NTXent loss function utilizes the cosine, s±,j instead of the Euclidean distance. It also utilizes the cross-entropy loss to train the encoder. One advantage of this approach over the Triplet loss is that instead of sampling only one negative, a set of negatives can be used to train the model in one go. In this embodiment, the top 8 samples closest to the Anchor (as perceived by the encoder (1015)) and excluding the positive samples are used as the Negative samples. The cosine value between the input vectors s(and sj, s±,j is defined as: Y / Sy'IMiNi where s / is defined as the transpose of the input vector s / . The numerator is essentially a dot product and the denominator normalizes the numerator to have a magnitude of 1 so that the output can be interpreted as the cosine of the angle between the two input vectors. The NT-Xent loss function, LNT-xent is then defined as: ^NT-Xent where sar is the cosine similarity between the anchor and the positive, sa„ is the cosine similarity between the anchor and 7 specific negative samples and r is the temperature to scale the loss. Specifically, encoder (1015) is trained to generate meaningful embeddings that can be used to detect mistyped phishing domains. An example CNN architecture for encoder (1015) is illustrated in Table 2 below. Table 2 Filter Stride Kernel Type Convolution Padding Activation 8 [1,1] [3,3] Conv2D Same leaky ReLu 16 [1,1] [3,3] Conv2D Same leaky ReLu 64 [1,1] [3,5] Conv2d Sah leaky ReLu 64 [1,2] [3,5] Conv2d Sah ReLu 128 is [2,2] [3,5] Conv2d Sah leaky ReLu 128 [2,2] [3,5] Conv2d Sah leaky ReLu 128 [2,2] [3,5] Conv2d Sah leaky ReLu 1024 - - Padat - t anh 512 - - Padat - leaky ReLu 25 - 12 - Padat no The first two layers with the same padding are important to ensure that information at the edges of the image is preserved. The output of the last layer is L2-normalized so that each embedding has a magnitude of 1. This is done so that both the Triplet (TL) loss and the NT-Xent (NL) loss can be used to train the model. Specifically, setting the embedding to have an L2 norm of 1 will mean minimizing the Euclidean distance between anchor and positive pairs according to the TL loss formulation will be equivalent to maximizing the cosine radius, since the square of the Euclidean distance between normalized vectors is inversely proportional to their cosine similarity. Referring to Figure 10, domain (1001), which consists of the top 20k domains in the millions of domains obtained from an external database is provided to DNSTwist (1005) and the image renderer (1010b). DNSTwist (1005) then proceeds to generate samples of typo-phishing domains for domain (1001). Specifically, DNSTwist (1005) permutates each of the domain names in domain (1001) to generate possible typo-phishing domains based on a number of pre-defined rules that are likely to be used by cyber attackers. The domains generated by DNSTwist (1005) also take keyboard distance into account by having an allowable dictionary for each key to be permuted. In addition, it is worth noting that the generated dataset is biased towards small edit distances (b 2).In short, the data set produced by DNSTwist (1005) will give a total of about two million possible phishing domains, where each of the possible phishing domains is derived from one of the domain names in the domain (1001). 9 This dataset generated by DNSTwist is then provided to the image renderer (1010a) (essentially the same as the image renderer (1010b)) which proceeds to render the domains in this dataset into Swype-like images which are used as Anchor (A) inputs for the encoder (1015). Simultaneously the Swype-like images rendered by the image renderer (1 01 0b) from the domain 1 00 1 are provided as Positive (P) inputs for the encoder (1015). The non-typo-squatting variants which the encoder (1015) deems similar to the anchors but are not positive samples are then provided as Negative (N) inputs for the encoder (1015). After receiving all these inputs, the encoder (1015) then uses a contrastive loss function such as the Triplet loss function or the NT-Xent loss function to train the encoder (1015) at step 1020. Once trained, the encoder (1015) can be used to generate encodings for both the corresponding images resembling Swype from the queried domain and the domains in the checklist, which consists of the top 20k domains from the vast dataset of millions. If the similarity score, which in this case is the cosine score between the encoding from the queried domain and one of the encodings from the domains in the checklist is greater than a certain threshold value, the domain is then classified as typo-phishing and the targeted domain (i.e., the domain attempting to mimic the typo) is the domain in the checklist whose encoding is deemed most similar to the encoding of the queried domain. A flowchart showing this process is illustrated in Figure 11. The checklist (1102) consists of a list of popular domains as generated by various external databases. Swype-like images of the domains from the checklist (1102) are rendered by an image renderer (1104) and provided to a trained encoder (1106). The trained encoder (1106) then provides the encodings from the checklist (1102) to the database (1112). When a queried domain (1108) is provided to an image renderer (1110), the image renderer (1110) renders a Swype-like image of the queried domain (1108). The rendered image of the queried domain (1108) is then provided to a trained encoder (1106). The trained encoder (1106) then generates an encoding of the queried domain. A similarity comparison of the queried domain encoding is then performed with the encodings in the database (1112) in step (1114). If the cosine similarity (or Euclidean distance) between the queried domain encoding and any of the domain encodings in the dataset is greater (or less in terms of Euclidean distance) than a certain value, the queried domain is then classified as typo-phishing and an alert with the targeted domain is then generated.The targeted domain (i.e., the domain that the homoglyph tries to resemble) is the corresponding domain in the database (1112 ) , whose encoding has the greatest cosine similarity (or smallest Euclidean distance) to the encoding of the queried domain. The reduced dimensionality of the encoding of example typo-phishing domains (from popular domains), as obtained from the output of the trained encoder, along with their associated 'targeted' domains is plotted in Figure 12. Specifically, typo-phishing domains (1202) are associated with their target domain 'instagram.com', typo-phishing domains (1204) are associated with their target domain 'microsoft.com', typo-phishing domains 1206 are associated with their target domain 'facebook.com', typo-phishing domains (1208) are associated with their target domain 'youtube.com', typo-phishing domains (1210) are associated with their target domain 'l inkedin'. com', typo-in-phishing domains (1212) are associated with their target domain 'google.com', and typo-in-phishing domains (1214) are associated with their target domain 'apple . com'. In embodiments of the present invention, a weighted Damerau-Levenshtein Distance (DLD) algorithm is implemented to compute the edit distance, weighted by keyboard distance, between the queried domain and the identified target domain. This algorithm is capable of providing additional rich information and also acts as a verification step to demonstrate that the neural network and the convolutional DLD-based algorithm both provide equivalent results. In other embodiments of the present invention, a hashing algorithm such as the Locality Sensitive Hashing (LSH) algorithm can be applied to the encoding of domains in the checklist and the encoding of the queried domain to quickly filter out domains whose encoding is clearly different from the queried domain. This can significantly speed up the search for similar domains. In one such experiment, the LSH algorithm successfully accelerated the search by up to 12 times. The homoglyph detection module (125) and the typo detection module (130) are configured to detect and identify domains that attempt to impersonate legitimate domains. Unlike these two modules, the general phishing detection module (135) is configured to detect common phishing domains that exploit human weaknesses. Examples of such domains include, but are not limited to, watch-this[.]live, get-free-airtickets[.]live, celebsecret[.]online, etc. These domains do not aim to impersonate a specific domain but try to lure people into clicking on them, thereby facilitating phishing, malware propagation, etc. In other words, the general phishing module (135) is configured to detect domains, not resembling specific well-known domains that exploit human desires in an attempt to trick people into clicking on them, thereby facilitating phishing attacks. To achieve this, the phishing detection module (135) utilizes Natural Language Processing (NLP) techniques such as a transformer architecture to detect such domains. In an embodiment of the present invention, in addition to training a transformer model from scratch and using character-level tokenization, a desirable transformer neural network such as, but not limited to, a Bidirectional Encoder Representation from Transformers (BERT) model (trained on the open-source Wikipedia text corpus) is employed. Transfer learning is then performed by further refining the model based on a dataset consisting of domains verified by VirusTotal and PhishTank. The model architecture is illustrated in Figure 13. The subword tokenization scheme (1302) was then used with subword tokens obtained from the Wikipedia corpus. The subword tokenization scheme (1302) was found to have more semantic meaning and better ability to understand certain words commonly used to trick people into clicking on domains such as win, “free”, watch, etc. The model is then refined by taking the output (1306) of the transformer (1304) and then passing it through multiple Dense layers (1308) (i.e., multi-level perceptron) to obtain a sigmoid-activated binary output indicating whether the domain is a common phishing-friendly domain or not. Model training is performed using a binary cross-entropy loss function. At the end of the training phase, the transformation model can take an input domain name, perform subword tokenization on it, and then output a probability of whether the input domain is a possible phishing domain or not. To reduce the number of false alarms when large amounts of large-scale network traffic data are provided to the phishing detection module (135), an additional workflow is adopted to exploit another feature, resolved IP addresses. Resolved IP addresses consist of DNS server replies to the query IP, when the query IP queries a specific domain's IP address. This is an important feature because attackers tend to reuse their infrastructure to gain the widest reach with minimal effort. Our data study shows that multiple phishing domains tend to reside on the same IP address. The workflow for this process is illustrated in Figure 14. A list of keywords commonly used to lure people into clicking on a site is initially created. This list can be obtained through PhishTank and is then supplemented with additional information to obtain a phishing reference list K. When a set of DNS records is provided, the keyword filter will filter out records whose domain names do not have at least one keyword in the K list in step (1402). The remaining domain names, which have at least one keyword in the list K, are then given to the neural network in step ( 1 4 0 4) (e.g., a BERT-based transformer model). The suspicious domain names (i.e., domain names that are flagged by the neural network ( 1 4 0 4 ) to be possible common phishing domains) obtained from step ( 1404) are then used, in step (1406), to determine the corresponding IP for each of the suspicious domains, through the original DNS data set. This set of suspicious IPs is then labeled as the set P . For each resolved IP in the set P, all domains that resolve to that particular IP, regardless of the initial keyword list used as a filter, are then retrieved. For each retrieved domain, it is then processed again through the neural network to determine whether the retrieved domain is a suspicious domain that should be flagged and this is done in step (1408). If the proportion of domains marked as suspicious by the neural network exceeds a certain threshold (50% in our embodiment), the domains marked by the neural network will be generated as alerts, i.e., classified as common phishing domains, otherwise all alerts will be discarded. This occurs in step (1410). The alert module (140) comprises a blacklist and rule-based module (205) and a behavioral analytics module (210) as previously illustrated in Figure 2. In an embodiment of the present invention, a blacklist of legitimate domains is generated based on prior research and based on results obtained from the alert module (140) over an extended period of time. Example rules contained in the module (205) may instruct the alert module (140) not to generate an alert if the domain ends with a certain string such as, but not limited to, .com.sg or if the domain ends with a trusted address, such as, but not limited to .gov.sg. In addition to using the legitimate domain blacklist, rules can also be set to remove possible warnings generated by the warning module (140) based on the following rules: 1. The domain name query string associated with each DNS record must be a valid domain name. For example, there must be at least one ' . ' in the domain name query string. 2. The domain name string must contain a valid Top Level Domain (TLD). 3. There must be valid characters in the domain name string. 4. There must be a valid number of characters in the domain name string. Further, this blacklist may be updated periodically based on the output generated by the alert module (140) over an extended period of time and may also be modified in accordance with the requirements of a person skilled in the art. In a further development of the present invention, the behavioral analytics module (210) may be configured to process filtered alerts obtained from the blacklist- and rule-based education module (205) using two types of behavioral analytics: (i) campaign-level detection, and (ii) periodic question detection. When campaign-level detection is performed, IPs (and by extension, organizations) that have experienced similar types of phishing attacks are initially identified. These IPs are used as proxies so that the system is able to detect phishing campaigns using only network traffic data. Given a certain analysis time period, from the domains provided to the alerting module ( 14 0 ) and then passed through the blacklist and rule-based modules ( 2 0 5 ), a set of query IPs and a corresponding set of phishing domains that have been queried are obtained. The complete set of flagged phishing domains is then consolidated. It should be noted that the size of this set will be equal to the size of the vector that will be generated for each query IP. For each IP that queries at least one of the suspected phishing domain outputs by the module ( 2 0 5 ) , a vector is generated through the following methodology : 1. From the list of suspected phishing domains visited by the query IP, counts are calculated for each phishing domain visited. 2. Using the count, the vector is populated. 3. Finally, the vector is L2 normalized. This is to account for organizations of different sizes. 4. Now that each query IP has a vector associated with it, dimensionality reduction techniques like Uniform Manifold Approximation and Projection (UMAP) or TDistributed Stochastic Neighbor Embedding (TSNE) can be applied followed by hierarchical clustering to automatically determine clusters. The illustration of the process carried out in step 3 above is explained in detail as follows: a. In this example, it is assumed that two IPs query the suspected phishing domain as shown below: aa.bb.cc.dd: [bbb.com, aaa.com, eee.com, aaa.com, bbb.com] 11.22.33.44: [ccc.com, ccc.com, ddd.com, aaa.com, eee.com] b. The set of suspected phishing domains was first consolidated as follows: {aaa.com, bbb.com, ccc.com, ddd.com, eee.com} c. Since there are five (5) unique suspected phishing domains, the output vector will have a dimension of 5. d. Next, for each IP, a count-based vector is generated as illustrated in Figure 5 where a count-based vector (1502) is generated for the first IP address 11.22.33.44 while a count-based vector (1504) is generated for the second IP address “aa.bb.cc.dd”. e. Finally, the two count-based vectors (1502) and (1504) are L2 normalized so that their magnitudes are both 1. In other embodiments of the present invention, Locality Sensitive Hashing (LSH) may be used instead of a clustering hierarchy to obtain vectors having similar characteristics. In a further embodiment of the present invention, the behavioral analytics module 210 may be configured to analyze the timestamps when queries to the detected phishing domains are made, for each query IP, to create a time series. Based on this list of timestamps, relative times are then calculated (i.e., the time difference between each record in the list and the first record in the list). These relative times are then binned into selected time intervals (i.e., these time interval bins can be referred to as sampling periods). In this embodiment, the sampling period is defined at 1 minute (i.e., 60 seconds). Figure 16 illustrates an example of such a plot. As can be seen, the x-axis consists of 1440 minutes, which is equivalent to one day. This is because in this embodiment, the goal is to determine the frequency of queries for suspected phishing domains in a day. The timeframe of this analysis is arbitrary and can be increased. For each minute (in terms of relative time), the number of queries to identify phishing domains that occurred in that minute, relative to the record The first 9, combined (i.e. binned) and calculated. Once the (1602) plot has been generated, the (1602) plot can be subjected to more advanced frequency analysis. In a further embodiment of the present invention, after each time stamp list is converted to the representation shown in Figure 17, the above signal is then passed through a Hanning filter (1702) as illustrated in Figure 7, to reduce ringing in the frequency domain. Ringing is a product of the abrupt end of the signal. In the above example, the signal abruptly ends at ~1200 minutes. This abrupt end is equivalent to a brick wall filter, which is the same as multiplying by a square function. Since the square function in the frequency domain is a sinc function, we will see many high side lobes in the frequency domain. Therefore, in this embodiment, a Hanning filter is used, by multiplying the above signal by a Hanning Filter function as shown in Figure 17. Note that the Hanning filter is applied from 0 to the last timestamp that has a non-zero occurrence. In other embodiments of the present invention, other filter functions such as the Hamming or Blackman filter functions may be used. This signal can then be converted to the frequency domain using a Discrete Fourier Transform algorithm for additional signal processing and analysis.In our embodiment, we use a frequency determination method in the frequency domain to determine the presence of periodic signals to determine whether the attack has progressed to the next stage. In an exemplary implementation of the present invention, the behavioral analytics module (210) is configured to process filtered alerts obtained from the blacklist- and rule-based learning module (205) using two types of behavioral analytics: (i) campaign-level detection, and (ii) periodic query detection. A complete set of query IPs found to invoke the phishing domain is then generated and plotted as dots in Figure 18. The clusters shown in Figure 18, specifically, clusters (1802, 1804, 1806, 1808, 1810, 1812, 1814, 1816, 1818, 1820) represent various phishing campaigns targeting various IP addresses. When the plot in Figure 18 is further analyzed using frequency analysis, it is found that one cluster of IPs queries similar phishing domains with a clear periodicity over 30 minutes, for example as shown in Figure 19 where peaks (1902, 1904 and 1906) appear periodically. This periodicity can be used to indicate that such attacks consist of more advanced attacks. Various other changes, substitutions, variations and modifications may be understood by those skilled in the art and it is intended that the present invention includes all changes, substitutions, variations and modifications that are within the scope of the appended claims.

Claims

Claims :

1. A system for detecting phishing domains in a Domain Name System (DNS) record set comprising: a homoglyph phishing domain detection module comprising a trained homoglyph encoder Eh and a reference database Dh, said module configured to: receive string images, Iht_n, that have been rendered from homoglyph domains, wherein the homoglyph domains comprise domains each comprising punycode; encode, using the trained homoglyph encoder Eh, each of the string images Iht_n into their encodings eHT n; classify each homoglyph domain as a homoglyph phishing domain when the Euclidean distance between the corresponding encoding eHT n and any encoding in the reference database Dh is below a predetermined threshold value;a typo-phishing domain detection module comprising a trained typo-encoder Es and a reference database Ds, the module configured to: receive Swype-like images, Ist_n, of domains rendered from a set of DNS records; encode, using the trained typo-encoder Es, each of the Swype-like images, Ist_n into their encodings esT n; classify each of the domains used to generate the set of Swype-like images, Ist_n, as typo-phishing when the Euclidean distance between the corresponding encoding esT n and any encoding in the reference database Ds is below a predetermined threshold value;a general phishing domain detection module comprising a trained transformer-based neural network, the module configured to: receive domains identified from a set of DNS records to have strings that at least partially match strings in a phishing reference list K; generate, using the trained transformer-based neural network, a probability score for each of the identified domains; update Internet Protocol (IP) addresses for each identified domain having a probability score exceeding a predetermined probability threshold value; for each of the resolved IP addresses, obtain all external domains associated with the resolved IP address, wherein external domains refer to all domains in the set of DNS records that are resolved to the updated IP address;generating, using a transformer-based neural network, a probability score for each of the retrieved external domains; classifying each retrieved external domain having a probability score exceeding a predetermined probability threshold as a common phishing domain; and an alerting module configured to generate alerts for the detected phishing domains in the DNS record set based on homoglyph phishing domains from the homoglyph phishing domain detection module, typo-phishing domains from the typo-phishing domain detection module and common phishing domains from the common phishing domain detection module.; 2. The system according to claim 1 wherein the alert module comprises a blacklist-based filtering module and rules configured to filter benign domain names from identified phishing domains.

3. The system according to claim 2, wherein the alerting module further comprises: a behavioral analytics module configured to: obtain from the blacklist-based and rule-based filtering module unfiltered phishing domains; obtain IP addresses that query at least one of the unfiltered phishing domains; for each IP address that queries at least one of the unfiltered phishing domains, generate a count-based vector based on the number of queries for each unfiltered phishing domain made by the IP address; apply L2 normalization to each of the count-based vectors; apply Hierarchical clustering to the IP addresses and their count-based vectors to identify count-based vectors that have similar characteristics;and classify IP addresses associated with count-based vectors identified as IP addresses experiencing the same phishing attack campaign.; 4. The system according to claim 2, wherein the alerting module further comprises: a behavioral analytics module configured to: obtain from the blacklist- and rule-based filtering module unfiltered phishing domains; obtain IP addresses that query at least one of the unfiltered phishing domains; for each IP address that queries at least one of the unfiltered phishing domains, generate a count-based vector based on the number of queries for each unfiltered phishing domain made by the IP address; apply L2 normalization to each count-based vector; apply Locality Sensitive Hashing (LSH) to the IP addresses and their count-based vectors to identify count-based vectors that have similar characteristics;and classify IP addresses associated with count-based vectors identified as IP addresses subject to phishing attack campaigns.; 5. A system according to claims 3 and 4 wherein the behavioral analytics module further comprises a dimensionality reduction procedure such as TSNE or UMAP prior to hierarchical clustering or LSH.

6. The system according to claim 2, wherein the alerting module further comprises: a further behavioral analytics module configured to: obtain from the blacklist- and rule-based filtering module unfiltered phishing domains; obtain IP addresses that query at least one of the unfiltered phishing domains; for each IP address that queries at least one unfiltered phishing domain, collect a sorted list of timestamps when a query to the at least one unfiltered phishing domain is performed; calculate a relative time using the sorted timestamps, wherein each calculated relative time is an elapsed time with respect to the first timestamp;relative time bins calculated into a desired sampling frequency and counting the number of entries in each bin to obtain an event time series, wherein the event time series is defined as the number of queries made to at least one unfiltered phishing domain; applying a Hanning filter to the event time series; and performing a frequency analysis on the filtered event series to determine the presence of periodicity and its associated frequency.; 7. The system according to claim 1 wherein the homoglyph encoder Eh is trained by minimizing a triplet loss training function, Ltripiet, which is related to the parameters of the homoglyph encoder EH, and the function Ltripiet, is defined as, Ltripiet = (||E(A) -mil2 - | |E(A) - ml |2 + M,0.0) E where the Positive input of the Ltripiet function is provided with a set of rendered images from a set of frequently visited popular Internet domains, the Anchor input of the Ltripiet function is provided with a set of outputs from a trained Phish-Generative Adversarial Network (Phish-GAN) each corresponding to a glyphed version of the current set's positive input, the Negative input of the Ltripiet function is provided with a set of domain string images sampled from a set of frequently visited popular Internet domains that the EH encoder deems similar to the current set's anchor input but does not include actual positive samples for that set, and where E(P) is defined as the Positive encoded output, E(A) is defined as the Anchor encoded output, E(N) is defined as the Negative encoded output and M is the margin.

8. The system according to claim 1 wherein the homoglyph encoder EH is trained by minimizing a Normalized Temperature-s caled Cross Entropy (NT-Xent) loss function LNT-xent, defined as, ^NT-Xent = min — Ybn e τ wherein the Positive input of the LNT-xent function is provided with a set of rendered images from a set of frequently visited popular Internet domains, the Anchor input of the LnT-xent function is provided with a set of outputs from a trained Phish-Generative Adversarial Network (PhishGAN) each corresponding to a glyphed version of the current set's positive input, the Negative input of the LnT-xent function is provided with a set of domain string images from a set of frequently visited popular Internet domains that the encoder Eh deems similar to the current set's anchor input but does not include actual positive samples for the set, and wherein sa,p is a cosine similarity measure between the encodings of the anchor sample and the positive sample and sarn is a cosine similarity measure between the encodings of the anchor sample and the negative sample., 9. The system according to claims 7 and 8 wherein the trained Phish-GAN comprises: a trained generator, G, configured to receive images x rendered from a training data set, y, and randomly generated noise, z, to generate glyphed versions, G(x,z) of each of the received images; a trained scriminator, D, configured to: receive glyphed versions, G(x,z) of the trained generator G, and the images x;and classify the images x and G(x,z) into fake or real images through a function in the scriminator D(), where the generator G is trained using an auxiliary dot product loss function, Ldot defined as: Ldot = flat(x) where flat(j is defined as a flat function that reshapes the image tensor into a vector to compute the dot product, and where the trained Phish-GAN consists of a generator objective function G* and a discriminator objective function D* defined as G* = minG (log(D(x)) + log(l - D(G(x, z))) + Ldot) D* = moxD(log (D(x)) + log^l - D(G(x,z))^); 10. The system according to claim 1 wherein the typo-encoder Es is trained by minimizing a Normalized Temperature-s caled Cross Entropy (NT-Xent) loss function LNT-xent, defined as.Lw-Kent — m^n - where the Positive input of the LNT-Xent function is provided with a set of Swype-like images rendered from a set of frequently visited popular Internet domains, the Anchor input of the LsT-xent function is provided with a set of Swype-like images from typo-phishing generated domains targeting the corresponding set positive input, the Negative input of the LnT-xent function is provided with a set of Swype-like images from a set of frequently visited popular Internet domains that the Es encoder deems similar to the current set anchor input but does not include actual positive samples for the set, and where sc,p is a cosine similarity measure between the encodings of the anchor sample and the positive sample and 3α,η is a cosine similarity measure between the encodings of the anchor sample and the negative sample.

11. The system according to claim 1 wherein the typo encoder Es is trained by minimizing the Triplet loss function Ltripiet, defined as, Yipiet = min(niax(|^ - ||E(Λ) - E(7V)| |2 + M, 0.0) c wherein the Positive input of the Ltripiet function is provided with a batch of Swype-like images rendered from a collection of frequently visited popular Internet domains, the Anchor input of the Ltripiet function is provided with a batch of Swype-like images from typo-speciated phishing domains generated that target the corresponding positive input of the set, the Negative input of the Ltripiet function is provided with a batch of Swype-like images from domains from a collection of frequently visited popular Internet domains that the encoder Es deems similar to the anchor input of the current set but does not include actual positive samples for the set, and wherein E(P) is defined as the Positive encoded output, E(A) is defined as the Anchor encoded output, E(N) is defined as the Negative encoded output and M is the margin.

12. The system according to claim 1 wherein the transformer-based neural network is trained using a binary cross-entropy loss function.

13. The system according to claim 1 wherein generating a probability score for each of the identified domains using a general phishing domain detection module comprises a general phishing domain detection module configured to: perform sub-word tokenization on each of the identified domains, and generate, using a trained transformer-based neural network, a probability score based on the sub-word tokens.

14. The system according to claim 13 wherein the common phishing domain detection module is further configured to: for each of the resolved IP addresses, obtain all external domains, wherein the external domains comprise domains resolved to the IP address, generate, using a trained transformer-based neural network, a probability score for each of the external domains based on said sub-word tokens; and classify all external domains whose probability score exceeds a predetermined threshold value as common phishing domains when it is determined that the percentage of the obtained external domains classified as common phishing domains exceeds the percentage threshold value.

15. The system according to claim 1 wherein, classifying each homoglyph domain as a homoglyph phishing domain by the homoglyph phishing domain detection module comprises the homoglyph phishing domain detection module configured to: classify each homoglyph domain as a homoglyph phishing domain When the cosine similarity between the corresponding encoding Bht n and any encoding in the reference database Dh is above a predetermined threshold value;classifying each domain used to generate a set of Swype-like images, Ist_n, by a typo-phishing domain detection module comprising a typo-phishing domain detection module configured to: classify each domain used to generate a set of Swype-like images, Ist_n, as typo-phishing When the cosine similarity measure between the corresponding encoding Bst n and any encoding in the DS reference database is above a predetermined threshold value.; 16. The system according to claim 1 wherein, the homoglyph phishing domain detection module is further configured to: receive rendered string images, lHT_Nall, of all queried domains; encode, using a trained homoglyph encoder Eh, each of the string images lHT_Nall into their encodings Bht Nall; classify each queried domain as a similarity phishing domain when a similarity measure between the corresponding encoding Bht n and any encoding in the reference database Dh exceeds a predetermined threshold value.

17. A method for detecting phishing domains in a Domain Name System (DNS) record set using a homoglyph phishing domain detection module f comprising a trained homoglyph encoder Eh and a reference database Dh, a typo-phishing domain detection module comprising a trained typo-encoder Es and a reference database Ds, a general phishing domain detection module comprising a trained transformer-based neural network and an alert module, the method comprising: receiving, using the homoglyph phishing domain detection module, string images, Iht_n, that have been rendered from homoglyph domains, wherein the homoglyph domains comprise domains each comprising punycodes; encoding, using the trained homoglyph encoder Eh, each of the string images Iht_n into their encodings eHT n;classifying, using the homoglyph phishing domain detection module, each homoglyph domain as a homoglyph phishing domain when the Euclidean distance between its corresponding encoding eHT n and any encoding in the reference database Dh is below a predetermined threshold value; receiving, using the typo-phishing domain detection module the Swype-like images, 1st n, of the 7 4 rendered domains from the DNS record set; encoding, using the trained typo-phishing encoder Es of the typo-phishing domain detection module, each of the Swype-like images, Ist_n into their encodings esT n;classifying, using a typo-phishing domain detection module, each domain used to generate a set of Swype-like images, Ist_n, as typo-phishing when the Euclidean distance between the associated encoding eST n and any encoding in the reference database Ds is below a predetermined threshold value; receiving, using a general phishing domain detection module, domains identified from the DNS record set to have strings that at least partially match strings in the phishing reference list K; generating, using a transformer-based neural network trained from the general phishing domain detection module, a probability score for each of the identified domains;resolving, using a general phishing domain detection module, Internet Protocol (IP) addresses for each of the identified domains that have a probability score exceeding a predetermined probability threshold value; for each of the resolved IP addresses, using a general phishing domain detection module to: obtain all external domains associated with the resolved IP address, wherein external domain refers to all domains in the set of DNS records that are resolved to the updated IP address; generating, using a transformer-based neural network, a probability score for each of the obtained external domains; classifying each of the obtained external domains that have a probability score exceeding a predetermined probability threshold value as a general phishing domain;and generating, using the alert module, alerts for phishing domains detected in the DNS record set based on homoglyph phishing domains from the homoglyph phishing domain detection module, typo- phishing domains from the typo- phishing domain detection module and general phishing domains from the general phishing domain detection module.; 18. The method according to claim 17 wherein the alerts generated using the alert module comprise: filtering, using the blacklist and rule-based filtering module, benign domain names from identified phishing domains.

19. The method according to claim 18, wherein the alerts generated using the alert module comprise: 7 6 obtaining, using the behavioral analytics module, from the blacklist-based and rule-based filtering module unfiltered phishing domains; obtaining, using the behavioral analytics module, IP addresses that query at least one of the unfiltered phishing domains; for each IP address that queries at least one of the unfiltered phishing domains, using the behavioral analytics module to: generate a count-based vector based on the number of queries for each unfiltered phishing domain generated by the IP address; apply L2 normalization to each count-based vector;applying, using a behavioral analytics module, Hierarchical clustering to IP addresses and their count-based vectors to identify count-based vectors that share similar characteristics; and classifying, using a behavioral analytics module, IP addresses associated with the identified count-based vectors as IP addresses that have experienced the same phishing attack campaign.; 20. The system according to claim 18, wherein the alerts generated using the alert module comprise: obtaining, using the behavioral analytics module, from the blacklist-based and rule-based filtering module unfiltered phishing domains; obtaining, using the behavioral analytics module, IP addresses that query at least one of the unfiltered phishing domains; for each IP address that queries at least one of the unfiltered phishing domains, using the behavioral analytics module to: generate a count-based vector based on the number of queries for each unfiltered phishing domain generated by the IP address; apply L2 normalization to each count-based vector;applying, using a behavioral analytics module, Locality Sensitive Hashing (LSH) to the IP addresses and their count-based vectors to identify count-based vectors that share similar characteristics; and classifying, using a behavioral analytics module, the IP addresses associated with the identified count-based vectors as IP addresses subject to a phishing attack campaign.;

Images