Domain name detection method, device, and storage medium

Abstract

Embodiments of the present disclosure provide a domain name detection method, a device, and a storage medium. The method comprises: matching a domain name to be detected with a preset domain name set, wherein the preset domain name set comprises a plurality of trusted domain names; if the domain name to be detected is not in the preset domain name set, calculating an editing distance between each of at least some of level domain names in the domain name to be detected and each preset domain name keyword in a domain name keyword set; if the editing distance between any target level domain name and any target preset domain name keyword is less than a preset distance threshold, acquiring a character pair of the target level domain name and the target preset domain name keyword which are different from each other, and matching the character pair with a similar character pair set; and if it is determined that the character pair is in the similar character pair set, determining that there is a security risk in the domain name to be detected. According to the embodiments of the present disclosure, counterfeit domain names can be effectively detected, accuracy is improved, false alarms are reduced, the algorithm is simple, implementation difficulty is low, and complexity and performance overhead are low.

Description

Domain name detection method, device and storage medium

[0001] This application claims priority to Chinese Patent Application No. 202311101918.0 filed on August 29, 2023, and the contents of the above-mentioned Chinese patent application disclosure are hereby incorporated by reference in their entirety as a part of this application. Technical Field

[0002] The embodiments of the present disclosure relate to a domain name detection method, device, and storage medium. Background Art

[0003] Phishing domains resemble legitimate domains, creating deceptive and misleading images that can easily fool users into believing they are legitimate and trustworthy. Phishing domains are often used for phishing, spam, or phishing emails, and for command-and-control (C2) servers. They are a common cyberattack method with low cost and wide-ranging impact.

[0004] The basic method for detecting counterfeit domain names is to calculate the keyword edit distance between the domain name to be detected and the target domain name. If the edit distance is less than or equal to a preset threshold, the domain name to be detected is determined to be a counterfeit domain name of the target domain name.

[0005] However, the above-mentioned counterfeit domain name detection method is not very accurate and there are a large number of false positives.

[0006] Summary of the Invention

[0007] The embodiments of the present disclosure provide a domain name detection method, device, and storage medium to improve the accuracy of counterfeit domain name detection and reduce false positives in counterfeit domain name detection.

[0008] In a first aspect, an embodiment of the present disclosure provides a domain name detection method, comprising:

[0009] Matching the domain name to be detected with a preset domain name set, wherein the preset domain name set includes multiple trusted domain names;

[0010] If the domain name to be detected is not in the preset domain name set, calculating the edit distance between at least some of the level domain names in the domain name to be detected and preset domain name keywords in the domain name keyword set, where the domain name keyword set is constructed based on keywords in any trusted domain name;

[0011] If the edit distance between any target-level domain name and any target preset domain name keyword is less than a preset distance threshold, obtaining a character pair in which the target-level domain name and the target preset domain name keyword are different, and matching the character pair with a set of similar character pairs, wherein the set of similar character pairs includes a plurality of similar character pairs, each similar character pair including two visually similar characters or character strings;

[0012] If it is determined that the character pair is in the similar character pair set, it is determined that the domain name to be detected has a security risk.

[0013] In a second aspect, an embodiment of the present disclosure provides a domain name detection device, including:

[0014] A domain name matching unit, configured to match the domain name to be detected with a preset domain name set, wherein the preset domain name set includes a plurality of trusted domain names;

[0015] an edit distance calculation unit, configured to calculate, if the domain name to be detected is not in the preset domain name set, the edit distance between at least some of the level domain names in the domain name to be detected and preset domain name keywords in a domain name keyword set, wherein the domain name keyword set is constructed based on keywords in any trusted domain name;

[0016] A similar character pair matching unit is used to obtain a character pair in which the target-level domain name and the target preset domain name keyword are different if the edit distance between the target-level domain name and the target preset domain name keyword is less than a preset distance threshold, and match the character pair with a similar character pair set, wherein the similar character pair set includes multiple similar character pairs, each similar character pair includes two visually similar characters or character strings; if it is determined that the character pair is in the similar character pair set, it is determined that the domain name to be detected has a security risk.

[0017] In a third aspect, an embodiment of the present disclosure provides an electronic device, including: at least one processor and a memory;

[0018] The memory stores computer-executable instructions;

[0019] The at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor performs the domain name detection method as described in the first aspect and various possible designs of the first aspect.

[0020] In a fourth aspect, an embodiment of the present disclosure provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer-executable instructions. When a processor executes the computer-executable instructions, the domain name detection method described in the first aspect and various possible designs of the first aspect is implemented.

[0021] In a fifth aspect, an embodiment of the present disclosure provides a computer program product, comprising computer-executable instructions. When a processor executes the computer-executable instructions, the domain name detection method as described in the first aspect and various possible designs of the first aspect is implemented. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, a brief introduction to the drawings required for the embodiments will be given below. Obviously, the drawings described below are some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0023] FIG1 is an example diagram of a domain name detection method provided by an embodiment of the present disclosure;

[0024] FIG2 is a flowchart of a domain name detection method according to an embodiment of the present disclosure;

[0025] FIG3 is a flowchart of a domain name detection method provided by another embodiment of the present disclosure;

[0026] FIG4 is a schematic diagram of a process for constructing a similar character pair set according to an embodiment of the present disclosure;

[0027] FIG5 is a structural block diagram of a domain name detection device provided by an embodiment of the present disclosure; and

[0028] FIG6 is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0029] To make the objectives, technical solutions, and advantages of the embodiments of the present disclosure more clear, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present disclosure without making any creative efforts shall fall within the scope of protection of the present disclosure.

[0030] The fundamental method for detecting phishing domain names is to calculate the edit distance between the keywords in the domain being tested and the keywords in the target domain. If the edit distance is less than or equal to a preset threshold, the domain being tested is deemed a phishing domain of the target domain. The edit distance is a quantitative measure of the degree of difference between two given strings. The smaller the edit distance, the more similar the two strings are. When the two strings are equal, the edit distance is 0. It is measured by the minimum number of operations required to transform one string into the other. Permitted transformation operations include insertion, deletion, and substitution.

[0031] However, some counterfeit domain name detection methods only use edit distance to measure similarity to determine whether a domain is counterfeit. Edit distance cannot fully reflect visual similarity, especially since domain names are non-repeatable and relatively rare assets. Once a large number of distinctive domain names are registered, others cannot register them. Finding a distinctive and non-duplicate domain name when registering a domain name becomes very difficult. This causes domain name registrants to often register domain names that are similar to existing domain names. This makes it particularly easy to detect a large number of normal, non-malicious, similar domain names when detecting counterfeit domain names. In addition, a large number of malicious counterfeit domain names directly use keywords of existing domain names or corporate entities in the domain name without modifying them. This makes the similarity-based algorithm directly ineffective, resulting in a large number of false positives. Therefore, the accuracy of the above counterfeit domain name detection methods is not high and there are many false positives. In practical scenarios, counterfeit domain name detection requires an effective solution to improve accuracy and eliminate a large amount of noise interference.

[0032] To address the aforementioned technical issues, the present disclosure provides a domain name detection method that incorporates visual features into the counterfeit domain name detection process, detecting counterfeit domain names from a visual perspective. A noise reduction scheme is also incorporated to reduce the occurrence of false positives. A preset domain name set can be used to initially filter out some trusted domain names, achieving a certain degree of noise reduction and reducing the amount of data. For domain names to be detected that are not filtered out, a domain name keyword set can be used to identify preset domain name keywords that are less different from at least some of the domain names at the level of the domain name to be detected based on edit distance. This is then combined with a set of similar character pairs to determine whether the domain name to be detected is counterfeit from a visual feature perspective. This method effectively detects counterfeit domain names, improves accuracy, reduces false positives, and features a simple algorithm with low implementation difficulty, complexity, and performance overhead.

[0033] The domain name detection method disclosed in the present invention can be applied to electronic devices such as servers. As shown in Figure 1, preliminary filtering is achieved by matching the domain name to be detected with a preset domain name set, wherein the preset domain name set includes multiple trusted domain names; if the domain name to be detected is not in the preset domain name set, the edit distance between at least some of the level domain names in the domain name to be detected and the preset domain name keywords in the domain name keyword set is calculated, wherein the domain name keyword set is generated based on the keywords in any trusted domain name; if the edit distance between any target level domain name and any target preset domain name keyword is less than a preset distance threshold, a character pair in which there is a difference between the target level domain name and the target preset domain name keyword is obtained, and the character pair is matched with a similar character pair set, wherein the similar character pair set includes multiple similar character pairs, and each similar character pair includes two visually similar characters or character strings; if it is determined that the character pair is in the similar character pair set, it is determined that there is a security risk in the domain name to be detected.

[0034] The domain name detection method disclosed herein will be described in detail below with reference to specific embodiments.

[0035] Refer to Figure 2, which is a flowchart of a domain name detection method provided by an embodiment of the present disclosure. The method of this embodiment can be applied to electronic devices such as terminal devices or servers. The domain name detection method includes:

[0036] S201: Match the domain name to be detected with a preset domain name set, where the preset domain name set includes multiple trusted domain names.

[0037] In this embodiment, the preset domain name set can be a domain name set constructed offline (or can be updated in real time), which can include multiple trusted domain names (legitimate domain names or non-malicious domain names). In other words, the preset domain name set can be a domain name whitelist. The trusted domain names in the preset domain name set can be manually set. Of course, considering that the number of visits to counterfeit domain names is generally relatively low, the electronic device can also obtain some high-traffic domain names and add them to the preset domain name set.

[0038] Optionally, historical visit data of multiple alternative domain names in the past preset time period can be obtained, for example, the average number of visits / frequency of each alternative domain name in several cycles such as hours, days, weeks, and months in a recent period of time (such as one month); if the historical visit data of any alternative domain name in the past preset time period exceeds a preset visit threshold, the alternative domain name can be added to the preset domain name set to construct the preset domain name set.

[0039] In this embodiment, based on the preset domain name set, the domain name to be detected is matched with the trusted domain names in the preset domain name set. If the domain name to be detected is in the preset domain name set, that is, the domain name to be detected is exactly the same as a trusted domain name in the preset domain name set, then it can be determined that the domain name to be detected is a trusted domain name (a legal domain name or a non-malicious domain name), and there is no need to execute subsequent steps; if the domain name to be detected is not in the preset domain name set, it is necessary to execute the subsequent steps for further judgment.

[0040] In this embodiment, by filtering the preset domain name set, trusted domain names within the preset domain name set can be filtered out, thereby reducing the amount of data required to execute subsequent steps and alleviating the processing pressure of subsequent steps. In particular, if the trusted domain names within the preset domain name set are domain names selected based on historical visit data, then filtering the domain names to be detected based on the preset domain name set is equivalent to filtering the domain names to be detected based on visit data (visit baseline), taking into account the fact that counterfeit domain names generally have relatively low visit volumes.

[0041] S202. If the domain name to be detected is not in the preset domain name set, calculate the edit distance between at least some of the level domain names in the domain name to be detected and preset domain name keywords in a domain name keyword set, where the domain name keyword set is generated based on keywords in any trusted domain name.

[0042] In this embodiment, the domain name keyword set can be constructed offline (or updated in real time), including domain name keywords. The domain name keywords can be keywords of some trusted domain names (such as some domain names with high traffic). For example, they can be second-level domain names or third-level domain names in these domain names, etc. For example, if a domain name is abc.xyz.com, the second-level domain name xyz can be added to the preset domain name set as a domain name keyword. Optionally, the third-level domain name abc can also be added to the preset domain name set as a domain name keyword. The preset domain name keywords in the preset domain name set can be set manually, or the electronic device can extract keywords based on some trusted domain names (such as some domain names with high traffic) and construct a domain name keyword set. The trusted domain name can come from the above-mentioned preset domain name set, or it can be any other trusted domain name.

[0043] In this embodiment, after determining that the domain name to be detected is not in the preset domain name set, the edit distance between at least some of the level domain names in the domain name to be detected and the preset domain name keywords in the domain name keyword set can be calculated. Among them, the edit distance is a quantitative measurement of the degree of difference between two given character strings. The smaller the edit distance, the more similar the two character strings are. When the two character strings are equal, the edit distance is 0. The measurement method is to see how many operations are required to transform one character string into another character string. The permitted transformation operations include insertion, deletion and replacement. In this embodiment, the edit distance of each level domain name in the domain name to be detected can be calculated with each preset domain name keyword in the domain name keyword set, and then it is determined whether the calculated edit distance is less than the preset distance threshold (for example, 2 or 3) to find the preset domain name keywords with a smaller degree of difference from the level domain names of the domain name to be detected.

[0044] Among them, since the domain name keyword set does not include top-level domain names (such as .com, .net, .cn, etc.), the top-level domain names of the domain name to be detected can be ignored when calculating the edit distance between at least some of the level domain names in the domain name to be detected and the preset domain name keywords in the domain name keyword set. Optionally, before calculating the edit distance between at least some of the level domain names in the domain name to be detected and the preset domain name keywords in the domain name keyword set, the domain name to be detected can be split according to the period (".") to obtain the various level domain names in the domain name to be detected, and the top-level domain names therein can be ignored.

[0045] S203. If the edit distance between any target-level domain name and any target preset domain name keyword is less than a preset distance threshold, obtain a character pair in which the target-level domain name and the target preset domain name keyword are different, and match the character pair with a set of similar character pairs, wherein the set of similar character pairs includes multiple similar character pairs, and each similar character pair includes two visually similar characters or character strings.

[0046] In this embodiment, when searching for a preset domain name keyword with a small degree of difference from at least part of the level domain name of the domain name to be detected from the domain name keyword set based on the edit distance, considering that the difference between a certain level domain name of the domain name to be detected and a certain preset domain name keyword is small, it may not be intentional counterfeiting, but the character combination of the domain name at this level itself is similar to a certain preset domain name keyword; the difference between a certain level domain name of the domain name to be detected and a certain preset domain name keyword is small, it may also be intentional counterfeiting. Counterfeit domain names usually purposefully modify a few characters of normal domain names, especially by replacing visually similar characters. A common tactic used by domain name phishing schemes is to generate phishing domain names that are highly similar to the original domain name, making it easy for people to mistake them for legitimate domain names. Therefore, in this embodiment, a set of similar character pairs is pre-built. The set includes multiple visually similar character pairs. These similar character pairs can include visually similar single character pairs, such as c and o, g and 9, i and l, i and 1, o and 0, etc., as well as visually similar character string pairs, such as oo and o0, oo and 0o, oo and 00, oao and oa0, obo and ob0, etc. Similar character string pairs may not be limited to the number of characters included. Based on the set of similar character pairs, it is then determined whether the domain name to be detected is phishing using similar character pairs.

[0047] Specifically, if the edit distance between any target-level domain name of the domain name to be detected and any target preset domain name keyword is less than a preset distance threshold, then a character pair (which can be determined when calculating the edit distance) that is different between the target-level domain name of the domain name to be detected and the target preset domain name keyword can be obtained. For example, if a character (or string) in the target-level domain name is different from a character (or string) in the target preset domain name keyword, then these two different characters (or strings) are taken out from the target-level domain name and the target preset domain name keyword respectively to form a character pair, and then the character pair is matched with a similar character pair set to determine whether it is in the similar character pair set. If the character pair is not in the similar character pair set, it means that the target-level domain name is not a counterfeit target preset domain name keyword; if the character pair is in the similar character pair set, it means that the target-level domain name is a counterfeit target preset domain name keyword.

[0048] S204: If it is determined that the character pair is in the set of similar character pairs, it is determined that the domain name to be detected has a security risk.

[0049] In this embodiment, based on the above steps, if the edit distance between at least one target-level domain name of the domain name to be detected and any target preset domain name keyword is less than the preset distance threshold, and the character pairs that are different between the target-level domain name and the target preset domain name keyword are in the set of similar character pairs, then it is determined that there is a security risk in the domain name to be detected, and it is a counterfeit domain name based on the target preset domain name keyword, and the operation is a security risk of being used for network attacks.

[0050] The domain name detection method provided in this embodiment matches the domain name to be detected with a preset domain name set, wherein the preset domain name set includes multiple trusted domain names; if the domain name to be detected is not in the preset domain name set, then calculating the edit distance between at least some of the level domain names in the domain name to be detected and the preset domain name keywords in the domain name keyword set, wherein the domain name keyword set is generated based on the keywords in any trusted domain name; if the edit distance between any target level domain name and any target preset domain name keyword is less than a preset distance threshold, then obtaining a character pair in which there is a difference between the target level domain name and the target preset domain name keyword, and matching the character pair with a similar character pair set, wherein the similar character pair set includes multiple similar character pairs, each similar character pair including two visually similar characters or character strings; if it is determined that the character pair is in the similar character pair set, then determining that there is a security risk in the domain name to be detected. In this embodiment, some trusted domain names are initially filtered out through a preset domain name set, which has a certain noise reduction effect and can reduce the amount of data. For the domain names to be detected that are not filtered out, preset domain name keywords that are less different from at least part of the level domain names of the domain name to be detected can be found from the domain name keyword set based on the edit distance. Then, combined with the set of similar character pairs, it is judged from the perspective of visual features whether the domain name to be detected is counterfeit, thereby effectively detecting counterfeit domain names, improving accuracy, reducing false alarms, and the algorithm is simple, easy to implement, and has low complexity and performance overhead.

[0051] Based on the above embodiment, if the edit distance between at least one target-level domain name of the domain name to be detected and any target preset domain name keyword is less than a preset distance threshold, and all character pairs in which the target-level domain name differs from the target preset domain name keyword are not in the set of similar character pairs, it cannot be directly determined that the domain name to be detected is not a counterfeit domain name. This is because the target-level domain name and the target preset domain name keyword have a high degree of similarity. It is also possible that the target-level domain name is obtained by swapping some character positions based on the target preset domain name keyword. For example, the target-level domain name cbad is counterfeited by swapping only the positions of a and c relative to the target preset domain name keyword abcd. Therefore, after determining that the edit distance between any target-level domain name of the domain name to be detected and any target preset domain name keyword is less than the preset distance threshold, and that all character pairs in which the target-level domain name differs from the target preset domain name keyword are not in the set of similar character pairs, it can be determined whether the target-level domain name is obtained by swapping some character positions based on the target preset domain name keyword. If it is determined that the target-level domain name is obtained by swapping some character positions based on the target preset domain name keyword, it is determined that the domain name to be detected has a security risk.

[0052] Optionally, considering that when the target-level domain name is short, only some characters are swapped between the target-level domain name and the target preset domain name keyword, which is easier to distinguish visually and has a higher probability of not being a counterfeit; and when only the target-level domain name is long enough, swapping characters is somewhat confusing and is more likely to be a counterfeit of the target preset domain name keyword. Therefore, in the above embodiment, when it is determined that the character pair is not in the similar character pair set, the determination of whether the target-level domain name is obtained by swapping some characters of the target preset domain name keyword includes:

[0053] If it is determined that the character pair is not in the similar character pair set, then determine whether the length of the target-level domain name exceeds the preset length; if it is determined that the length of the target-level domain name exceeds the preset length, then determine whether the target-level domain name is obtained by replacing some character positions based on the target preset domain name keyword.

[0054] That is, the judgment of whether the target-level domain name is obtained by replacing part of the character positions based on the target preset domain name keyword is only performed on the target-level domain name whose length exceeds the preset length, while the target-level domain name whose length does not exceed the preset length is ignored. If the target-level domain name does not exceed the preset length, there is no need to judge whether the target-level domain name is obtained by replacing part of the character positions based on the target preset domain name keyword, and it is directly determined that the target-level domain name is not a counterfeit of the target preset domain name keyword.

[0055] Based on the above embodiment, considering that the above domain name detection method may still have noise interference, further noise reduction can be performed on the basis of the above domain name detection method. Specifically, as shown in FIG3 , before finally determining that the domain name to be detected has a security risk, noise reduction can be performed through the following steps to finally determine whether the domain name to be detected is a counterfeit domain name:

[0056] S301, obtaining historical visit data of the domain name to be detected in the past preset period of time, and determining whether the historical visit data of the domain name to be detected in the past preset period of time exceeds a preset visit threshold;

[0057] S302: If the historical visit volume data of the domain name to be detected in the past preset period does not exceed the preset visit volume threshold, then it is determined that the domain name to be detected has a security risk; or

[0058] S303: If the historical visit volume data of the domain name to be detected in the past preset period exceeds a preset visit volume threshold, the domain name to be detected is determined to be a trusted domain name.

[0059] In this embodiment, considering that malicious phishing domains typically have significantly fewer visits than legitimate domains to reduce their chances of being discovered, the phishing domains identified in the previous step are filtered again using visit data, thereby filtering out domains with relatively high visit data, achieving noise reduction and significantly reducing the number of false positives detected. The historical visit data for the domain to be detected within a preset period of time may include, but is not limited to, the number of visits within the last hour, the number of visit hours within the last day, the number of visit days within the last week, etc.

[0060] Based on the above embodiment, the steps of the domain name detection method are as follows:

[0061] Match the domain name to be detected with the preset domain name set; if the domain name to be detected is in the preset domain name set, determine that the domain name to be detected is a trusted domain name; otherwise, if the domain name to be detected is not in the preset domain name set, obtain the domain names of each level in the domain name to be detected (ignoring the top-level domain name), and calculate the edit distance between each level of domain name and the preset domain name keywords in the domain name keyword set. For example, for the target level domain name (such as the second-level domain name), you can take out a preset domain name keyword from the domain name keyword set, and then calculate the edit distance between the preset domain name keyword and the target level domain name. If the edit distance is not less than the preset distance threshold, take out the next preset domain name keyword from the domain name keyword set; if the edit distance is less than the preset distance threshold, obtain the characters that are different between the preset domain name keyword and the target level domain name. A character pair is formed and matched with a set of similar character pairs. If it is determined that the character pair is in the set of similar character pairs, it is determined that the target-level domain name has counterfeited the preset domain name keyword, and the domain name to be detected can be determined to be a counterfeit domain name; if it is determined that the character pair is not in the set of similar character pairs, it can be determined whether the length of the target-level domain name exceeds the preset length. If the length of the target-level domain name does not exceed the preset length, the next preset domain name keyword is taken from the domain name keyword set and the above process is executed again; if the length of the target-level domain name exceeds the preset length, it is determined whether the target-level domain name is obtained by replacing some character positions based on the preset domain name keyword. If so, the domain name to be detected is determined to be a counterfeit domain name; if not, the next preset domain name keyword is taken from the domain name keyword set and the above process is executed again.

[0062] Furthermore, after determining that the domain name to be detected is a counterfeit domain name through the above process, historical visit data of the domain name to be detected in the past preset period can also be obtained, and then based on the historical visit data of the domain name to be detected in the past preset period, it is finally determined whether the domain name to be detected is a counterfeit domain name. Among them, if the historical visit data of the domain name to be detected in the past preset period does not exceed the preset visit threshold, it is finally determined that there is a security risk in the domain name to be detected; if the historical visit data of the domain name to be detected in the past preset period exceeds the preset visit threshold, it is determined that the domain name to be detected is a trusted domain name, that is, the above process has a misjudgment.

[0063] Based on any of the above embodiments, before matching the character pair with a similar character pair set, it is necessary to obtain the similar character pair set in advance. The similar character pair set can be constructed manually or by the following process:

[0064] S401, acquiring images of different single characters and images of different character strings, wherein the character string includes at least two characters;

[0065] S402 : Obtain similarities between the images, determine similar character pairs based on the similarities between the images, and add the similar character pairs to the similar character pair set to construct the similar character pair set.

[0066] In this embodiment, the set of similar character pairs may include visually similar single character pairs, such as c and o, g and 9, i and l, i and 1, o and 0, etc., and may also include visually similar character string pairs, such as oo and o0, oo and 0o, oo and 00, oao and oa0, obo and ob0, etc., wherein similar character string pairs may not be limited to the number of characters included therein.

[0067] So first for the alphabetic and numeric character set used by domain names, az, 0-9, get images of all possible character and string pairs, including;

[0068] 1) Save each character as an image;

[0069] 2) Combine characters in pairs, such as aa, ab, 00, 01, a1, a2, etc., and save them as images;

[0070] 3) Save character combinations of three or more, such as aaa, abc, aaaa, aaab, etc., as images;

[0071] Furthermore, as shown in FIG4 , a graph similarity algorithm is used to search for similar images from the above images, and the characters or character strings corresponding to the similar images are then determined as a group of similar character pairs, thereby constructing a similar character pair set. The graph similarity algorithm can be any algorithm, such as a cosine similarity algorithm, a hash algorithm, a histogram algorithm, a deep learning algorithm, etc., without limitation herein.

[0072] In which, when obtaining the similarity between each image and determining similar character pairs based on the similarity between each image, the similarity between images of different single characters can be obtained. If the similarity between the images of any two single characters is greater than a preset similarity threshold, the two single characters are determined to be a pair of similar character pairs; and / or, the similarity between images of different character strings is obtained. If the similarity between the images of any two character strings is greater than a preset similarity threshold, the two character strings are determined to be a pair of similar character pairs.

[0073] In this embodiment, by constructing a similar character pair set based on visual features (image similarity) in advance, similar character pairs that are easily confused can be better identified, providing a basis for determining counterfeit domain names.

[0074] Corresponding to the domain name detection method described in the preceding embodiment, Figure 5 is a block diagram of the domain name detection device provided in an embodiment of the present disclosure. For ease of illustration, only the portions relevant to the present embodiment are shown. Referring to Figure 5 , the domain name detection device 500 includes a domain name matching unit 501, an edit distance calculation unit 502, and a similar character pair matching unit 503.

[0075] The domain name matching unit 501 is configured to match the domain name to be detected with a preset domain name set, wherein the preset domain name set includes multiple trusted domain names;

[0076] an edit distance calculation unit 502 for calculating, if the domain name to be detected is not in the preset domain name set, an edit distance between at least some of the level domain names in the domain name to be detected and preset domain name keywords in a domain name keyword set, wherein the domain name keyword set is constructed based on keywords in any trusted domain name;

[0077] The similar character pair matching unit 503 is used to obtain a character pair in which the target-level domain name and the target preset domain name keyword are different if the edit distance between the target-level domain name and the target preset domain name keyword is less than a preset distance threshold, and match the character pair with a similar character pair set, wherein the similar character pair set includes multiple similar character pairs, each similar character pair includes two visually similar characters or character strings; if it is determined that the character pair is in the similar character pair set, it is determined that the domain name to be detected has a security risk.

[0078] In one or more embodiments of the present disclosure, the device further includes a character transposition determination module, configured to:

[0079] If it is determined that the character pair is not in the similar character pair set, determining whether the target level domain name is obtained by replacing some characters of the target preset domain name keyword;

[0080] If it is determined that the target-level domain name is obtained by replacing the positions of some characters of the target preset domain name keyword, it is determined that the domain name to be detected has a security risk.

[0081] In one or more embodiments of the present disclosure, if it is determined that the character pair is not in the similar character pair set, the character transposition determination module is configured to:

[0082] If it is determined that the character pair is not in the similar character pair set, determining whether the length of the target level domain name exceeds a preset length;

[0083] If it is determined that the length of the target-level domain name exceeds the preset length, it is determined whether the target-level domain name is obtained by replacing the positions of some characters of the target preset domain name keyword.

[0084] In one or more embodiments of the present disclosure, the device further includes a noise reduction module, configured to:

[0085] Obtaining historical visit data of the domain name to be detected in the past preset period of time, and determining whether the historical visit data of the domain name to be detected in the past preset period of time exceeds a preset visit threshold;

[0086] If the historical visit data of the domain name to be detected in the past preset period does not exceed the preset visit threshold, it is determined that the domain name to be detected has a security risk; or

[0087] If the historical visit volume data of the domain name to be detected in the past preset time period exceeds a preset visit volume threshold, the domain name to be detected is determined to be a trusted domain name.

[0088] In one or more embodiments of the present disclosure, the device further includes an offline processing module, configured to:

[0089] Obtain historical visit data for multiple candidate domain names within a preset period of time;

[0090] If the historical visit data of any candidate domain name in the past preset time period exceeds the preset visit threshold, the candidate domain name is added to the preset domain name set to construct the preset domain name set.

[0091] In one or more embodiments of the present disclosure, the offline processing module is further configured to:

[0092] Acquire images of different single characters and images of different character strings, wherein the character string includes at least two characters;

[0093] The similarities between the images are obtained, similar character pairs are determined based on the similarities between the images, and the similar character pairs are added to the similar character pair set to construct the similar character pair set.

[0094] In one or more embodiments of the present disclosure, when obtaining the similarity between the images and determining similar character pairs based on the similarity between the images, the offline processing module is configured to:

[0095] Obtaining similarities between images of different single characters, and if the similarity between the images of any two single characters is greater than a preset similarity threshold, determining the any two single characters as a similar character pair; and / or

[0096] The similarity between images of different character strings is obtained, and if the similarity between the images of any two character strings is greater than a preset similarity threshold, the any two character strings are determined to be a similar character pair.

[0097] In one or more embodiments of the present disclosure, before calculating the edit distance between at least some of the level domain names in the domain name to be detected and the preset domain name keywords in the domain name keyword set, the edit distance calculation unit 502 is further configured to:

[0098] The domain name to be detected is split according to the period to obtain at least part of the level domain names in the domain name to be detected, and the top-level domain names therein are ignored.

[0099] The device provided in this embodiment can be used to execute the technical solution of the above method embodiment. Its implementation principle and technical effects are similar and will not be described in detail in this embodiment.

[0100] Referring to FIG6 , a schematic diagram of the structure of an electronic device 600 suitable for implementing an embodiment of the present disclosure is shown. The electronic device 600 may be a terminal device or a server. The terminal device may include, but is not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, personal digital assistants (PDAs), tablet computers (Portable Android Devices, PADs), portable multimedia players (PMPs), vehicle-mounted terminals (e.g., vehicle-mounted navigation terminals), and fixed terminals such as digital TVs and desktop computers. The electronic device shown in FIG6 is merely an example and should not limit the functionality and scope of use of the embodiments of the present disclosure.

[0101] As shown in FIG6 , the electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage device 608 into a random access memory (RAM) 603. Various programs and data required for the operation of the electronic device 600 are also stored in the RAM 603. The processing device 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0102] Typically, the following devices may be connected to the I / O interface 605: an input device 606 including, for example, a touch screen, a touchpad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 607 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 608 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 609. The communication device 609 may allow the electronic device 600 to communicate with other devices wirelessly or by wire to exchange data. Although FIG. 6 shows an electronic device 600 having various devices, it should be understood that it is not required to implement or have all of the devices shown. More or fewer devices may be implemented or have alternatively.

[0103] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network via the communication device 609, or installed from the storage device 608, or installed from the ROM 602. When the computer program is executed by the processing device 601, the above-mentioned functions defined in the method of the embodiment of the present disclosure are performed.

[0104] It should be noted that the computer-readable medium mentioned above in the present disclosure may be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or component, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, device, or component. In the present disclosure, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, which carries computer-readable program code. Such a propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium that can transmit, propagate, or transport a program for use by or in conjunction with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium may be transmitted using any suitable medium, including but not limited to wires, optical cables, RF (radio frequency), etc., or any suitable combination thereof.

[0105] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0106] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device executes the method shown in the above embodiment.

[0107] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages, or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet Service Provider).

[0108] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the module, program segment, or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of the boxes in the block diagram and / or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0109] The units involved in the embodiments described in this disclosure may be implemented in software or hardware. In some cases, the name of a unit does not limit the unit itself. For example, the first acquisition unit may also be described as a "unit for acquiring at least two Internet Protocol addresses."

[0110] The functions described above herein may be performed, at least in part, by one or more hardware logic components. For example, and without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chip (SOCs), complex programmable logic devices (CPLDs), and the like.

[0111] In the context of the present disclosure, a machine-readable medium can be a tangible medium that can contain or store a program for use by or in conjunction with an instruction execution system, device or equipment. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium can include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0112] In a first aspect, according to one or more embodiments of the present disclosure, a domain name detection method is provided, comprising:

[0113] Matching the domain name to be detected with a preset domain name set, wherein the preset domain name set includes multiple trusted domain names;

[0114] If the domain name to be detected is not in the preset domain name set, calculating the edit distance between at least some of the level domain names in the domain name to be detected and preset domain name keywords in the domain name keyword set, where the domain name keyword set is constructed based on keywords in any trusted domain name;

[0115] If the edit distance between any target-level domain name and any target preset domain name keyword is less than a preset distance threshold, obtaining a character pair in which the target-level domain name and the target preset domain name keyword are different, and matching the character pair with a set of similar character pairs, wherein the set of similar character pairs includes a plurality of similar character pairs, each similar character pair including two visually similar characters or character strings;

[0116] If it is determined that the character pair is in the similar character pair set, it is determined that the domain name to be detected has a security risk.

[0117] According to one or more embodiments of the present disclosure, the method further includes:

[0118] If it is determined that the character pair is not in the similar character pair set, determining whether the target level domain name is obtained by replacing some characters of the target preset domain name keyword;

[0119] If it is determined that the target-level domain name is obtained by replacing the positions of some characters of the target preset domain name keyword, it is determined that the domain name to be detected has a security risk.

[0120] According to one or more embodiments of the present disclosure, if it is determined that the character pair is not in the set of similar character pairs, determining whether the target level domain name is obtained by replacing some character positions based on the target preset domain name keyword includes:

[0121] If it is determined that the character pair is not in the similar character pair set, determining whether the length of the target level domain name exceeds a preset length;

[0122] If it is determined that the length of the target-level domain name exceeds the preset length, it is determined whether the target-level domain name is obtained by replacing the positions of some characters of the target preset domain name keyword.

[0123] According to one or more embodiments of the present disclosure, before determining that the domain name to be detected has a security risk, the method further includes:

[0124] Obtaining historical visit data of the domain name to be detected in the past preset period of time, and determining whether the historical visit data of the domain name to be detected in the past preset period of time exceeds a preset visit threshold;

[0125] If the historical visit data of the domain name to be detected in the past preset period does not exceed the preset visit threshold, it is determined that the domain name to be detected has a security risk; or

[0126] If the historical visit volume data of the domain name to be detected in the past preset time period exceeds a preset visit volume threshold, the domain name to be detected is determined to be a trusted domain name.

[0127] According to one or more embodiments of the present disclosure, before matching the domain name to be detected with the preset domain name set, the process further includes:

[0128] Obtain historical visit data for multiple candidate domain names within a preset period of time;

[0129] If the historical visit data of any candidate domain name in the past preset time period exceeds the preset visit threshold, the candidate domain name is added to the preset domain name set to construct the preset domain name set.

[0130] According to one or more embodiments of the present disclosure, before matching the character pair with a set of similar character pairs, the method further includes:

[0131] Acquire images of different single characters and images of different character strings, wherein the character string includes at least two characters;

[0132] The similarities between the images are obtained, similar character pairs are determined based on the similarities between the images, and the similar character pairs are added to the similar character pair set to construct the similar character pair set.

[0133] According to one or more embodiments of the present disclosure, obtaining the similarity between the images and determining similar character pairs based on the similarity between the images includes:

[0134] Obtaining similarities between images of different single characters, and if the similarity between the images of any two single characters is greater than a preset similarity threshold, determining the any two single characters as a similar character pair; and / or

[0135] The similarity between images of different character strings is obtained, and if the similarity between the images of any two character strings is greater than a preset similarity threshold, the any two character strings are determined to be a similar character pair.

[0136] According to one or more embodiments of the present disclosure, before calculating the edit distance between at least some of the level domain names in the domain name to be detected and the preset domain name keywords in the domain name keyword set, the method further includes:

[0137] The domain name to be detected is split according to the period to obtain at least part of the level domain names in the domain name to be detected, and the top-level domain names therein are ignored.

[0138] In a second aspect, according to one or more embodiments of the present disclosure, a domain name detection device is provided, including:

[0139] A domain name matching unit, configured to match the domain name to be detected with a preset domain name set, wherein the preset domain name set includes a plurality of trusted domain names;

[0140] an edit distance calculation unit, configured to calculate, if the domain name to be detected is not in the preset domain name set, the edit distance between at least some of the level domain names in the domain name to be detected and preset domain name keywords in a domain name keyword set, wherein the domain name keyword set is constructed based on keywords in any trusted domain name;

[0141] A similar character pair matching unit is used to obtain a character pair in which the target-level domain name and the target preset domain name keyword are different if the edit distance between the target-level domain name and the target preset domain name keyword is less than a preset distance threshold, and match the character pair with a similar character pair set, wherein the similar character pair set includes multiple similar character pairs, each similar character pair includes two visually similar characters or character strings; if it is determined that the character pair is in the similar character pair set, it is determined that the domain name to be detected has a security risk.

[0142] According to one or more embodiments of the present disclosure, the device further includes a character transposition determination module, configured to:

[0143] If it is determined that the character pair is not in the similar character pair set, determining whether the target level domain name is obtained by replacing some characters of the target preset domain name keyword;

[0144] If it is determined that the target-level domain name is obtained by replacing the positions of some characters of the target preset domain name keyword, it is determined that the domain name to be detected has a security risk.

[0145] According to one or more embodiments of the present disclosure, if it is determined that the character pair is not in the similar character pair set, the character transposition determination module is configured to:

[0146] If it is determined that the character pair is not in the similar character pair set, determining whether the length of the target level domain name exceeds a preset length;

[0147] If it is determined that the length of the target-level domain name exceeds the preset length, it is determined whether the target-level domain name is obtained by replacing the positions of some characters of the target preset domain name keyword.

[0148] According to one or more embodiments of the present disclosure, the device further includes a noise reduction module, configured to:

[0149] Obtaining historical visit data of the domain name to be detected in the past preset period of time, and determining whether the historical visit data of the domain name to be detected in the past preset period of time exceeds a preset visit threshold;

[0150] If the historical visit data of the domain name to be detected in the past preset period does not exceed the preset visit threshold, it is determined that the domain name to be detected has a security risk; or

[0151] If the historical visit volume data of the domain name to be detected in the past preset time period exceeds a preset visit volume threshold, the domain name to be detected is determined to be a trusted domain name.

[0152] According to one or more embodiments of the present disclosure, the device further includes an offline processing module, configured to:

[0153] Obtain historical visit data for multiple candidate domain names within a preset period of time;

[0154] If the historical visit data of any candidate domain name in the past preset time period exceeds the preset visit threshold, the candidate domain name is added to the preset domain name set to construct the preset domain name set.

[0155] According to one or more embodiments of the present disclosure, the offline processing module is further configured to:

[0156] Acquire images of different single characters and images of different character strings, wherein the character string includes at least two characters;

[0157] The similarities between the images are obtained, similar character pairs are determined based on the similarities between the images, and the similar character pairs are added to the similar character pair set to construct the similar character pair set.

[0158] According to one or more embodiments of the present disclosure, when obtaining the similarity between the images and determining similar character pairs based on the similarity between the images, the offline processing module is configured to:

[0159] Obtaining similarities between images of different single characters, and if the similarity between the images of any two single characters is greater than a preset similarity threshold, determining the any two single characters as a similar character pair; and / or

[0160] The similarity between images of different character strings is obtained, and if the similarity between the images of any two character strings is greater than a preset similarity threshold, the any two character strings are determined to be a similar character pair.

[0161] According to one or more embodiments of the present disclosure, before calculating the edit distance between at least some of the level domain names in the domain name to be detected and the preset domain name keywords in the domain name keyword set, the edit distance calculation unit is further configured to:

[0162] The domain name to be detected is split according to the period to obtain at least part of the level domain names in the domain name to be detected, and the top-level domain names therein are ignored.

[0163] In a third aspect, according to one or more embodiments of the present disclosure, there is provided an electronic device, comprising: at least one processor and a memory;

[0164] The memory stores computer-executable instructions;

[0165] The at least one processor executes the computer-executable instructions stored in the memory, so that the at least one processor performs the domain name detection method as described in the first aspect and various possible designs of the first aspect.

[0166] In a fourth aspect, according to one or more embodiments of the present disclosure, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer-executable instructions. When a processor executes the computer-executable instructions, the domain name detection method described in the first aspect and various possible designs of the first aspect is implemented.

[0167] In a fifth aspect, according to one or more embodiments of the present disclosure, a computer program product is provided, comprising computer-executable instructions. When a processor executes the computer-executable instructions, the domain name detection method as described in the first aspect and various possible designs of the first aspect is implemented.

[0168] The above description is merely a preferred embodiment of the present disclosure and an illustration of the technical principles employed. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by the specific combination of the above-mentioned technical features, but also includes other technical solutions formed by any combination of the above-mentioned technical features or their equivalents without departing from the above-mentioned disclosed concepts. For example, a technical solution formed by replacing the above-mentioned features with (but not limited to) technical features with similar functions disclosed in this disclosure.

[0169] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details have been included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0170] Although the subject matter has been described in language specific to structural features and / or methodological logical acts, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are merely example forms of implementing the claims.

Claims

1. A domain name detection method, comprising: Matching the domain name to be detected with a preset domain name set, wherein the preset domain name set includes multiple trusted domain names; If the domain name to be detected is not in the preset domain name set, then calculating the edit distance between at least some of the level domain names in the domain name to be detected and the preset domain name keywords in the domain name keyword set, wherein the domain name keyword set is generated based on the keywords in any trusted domain name; If the edit distance between any target-level domain name and any target preset domain name keyword is less than a preset distance threshold, then obtaining a character pair in which the target-level domain name and the target preset domain name keyword are different, and matching the character pair with a similar character pair set, wherein the similar character pair set includes a plurality of similar character pairs, and each similar character pair includes two visually similar characters or character strings; as well as If it is determined that the character pair is in the similar character pair set, it is determined that the domain name to be detected has a security risk.

2. The domain name detection method according to claim 1, further comprising: If it is determined that the character pair is not in the similar character pair set, determining whether the target level domain name is obtained by replacing the positions of some characters based on the target preset domain name keyword; as well as If it is determined that the target-level domain name is obtained by replacing the positions of some characters of the target preset domain name keyword, it is determined that the domain name to be detected has a security risk.

3. The domain name detection method according to claim 2, wherein: If it is determined that the character pair is not in the similar character pair set, determining whether the target level domain name is obtained by replacing the positions of some characters based on the target preset domain name keyword includes: If it is determined that the character pair is not in the similar character pair set, determining whether the length of the target level domain name exceeds a preset length; and If it is determined that the length of the target-level domain name exceeds the preset length, it is determined whether the target-level domain name is obtained by replacing the positions of some characters based on the target preset domain name keyword.

4. The domain name detection method according to any one of claims 1 to 3, wherein: Before determining that the domain name to be detected has a security risk, the method further includes: Obtain the historical visit volume data of the domain name to be detected in the past preset period of time, and determine the Detecting whether the historical visit volume data of the domain name in the past preset period exceeds a preset visit volume threshold; If the historical visit volume data of the domain name to be detected in the past preset period of time does not exceed the preset visit volume threshold, it is determined that the domain name to be detected has a security risk; or If the historical access volume data of the domain name to be detected in the past preset time period exceeds a preset access volume threshold, the domain name to be detected is determined to be a trusted domain name.

5. The domain name detection method according to any one of claims 1 to 4, wherein: Before matching the domain name to be detected with the preset domain name set, the method further includes: Obtaining historical visit data of multiple candidate domain names in a preset period of time in the past; and If the historical visit volume data of any candidate domain name in the past preset time period exceeds the preset visit volume threshold, the candidate domain name is added to the preset domain name set to construct the preset domain name set.

6. The domain name detection method according to any one of claims 1 to 5, wherein: Before matching the character pair with a preset similar character pair set, the method further includes: Acquire images of different single characters and images of different character strings, wherein the character string includes at least two characters; and The similarities between the images are obtained, similar character pairs are determined based on the similarities between the images, and the similar character pairs are added to the similar character pair set to construct the similar character pair set.

7. The domain name detection method according to claim 6, wherein: The obtaining of the similarity between the images and determining similar character pairs based on the similarity between the images includes: Obtaining the similarity between images of different single characters, if the similarity between the images of any two single characters is greater than a preset similarity threshold, determining the any two single characters as a pair of similar characters; and / or The similarity between images of different character strings is obtained, and if the similarity between the images of any two character strings is greater than the preset similarity threshold, the any two character strings are determined as a pair of similar characters.

8. The domain name detection method according to any one of claims 1 to 7, wherein: Before calculating the edit distance between at least some of the level domain names in the to-be-detected domain names and the preset domain name keywords in the domain name keyword set, the method further includes: The domain name to be detected is divided according to the period to obtain at least part of the domain name to be detected. The domain names are classified into levels and the top-level domain names are ignored.

9. A domain name detection device, comprising: A domain name matching unit, configured to match the domain name to be detected with a preset domain name set, wherein the preset domain name set includes a plurality of trusted domain names; an edit distance calculation unit, configured to calculate the edit distance between at least some of the level domain names in the domain name to be detected and preset domain name keywords in the domain name keyword set if the domain name to be detected is not in the preset domain name set, wherein the domain name keyword set is generated based on keywords in any trusted domain name; as well as The similar character pair matching unit is configured to obtain a character pair in which a difference exists between any target-level domain name and any target preset domain name keyword if the edit distance between the target-level domain name and the target preset domain name keyword is less than a preset distance threshold, and match the character pair with a similar character pair set, wherein the similar character pair set includes multiple similar character pairs, each similar character pair includes two visually similar characters or character strings; if it is determined that the character pair is in the similar character pair set, it is determined that the domain name to be detected has a security risk.

10. An electronic device comprising: at least one processor and memory, wherein The memory is configured to store computer-executable instructions; The at least one processor is configured to execute the computer-executable instructions stored in the memory, so that the at least one processor executes the domain name detection method according to any one of claims 1 to 8.

11. A computer-readable storage medium storing computer-executable instructions, wherein: When the processor executes the computer-executable instruction, the domain name detection method according to any one of claims 1 to 8 is implemented.

12. A computer program product comprising computer executable instructions, wherein: When the processor executes the computer-executable instruction, the domain name detection method according to any one of claims 1 to 8 is implemented.

Images