DNS Domain Homograph Detection Using Visual CNN Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies are ineffective in detecting homographs of domain names, which are often used by malware and phishing attacks to deceive users, due to their reliance on integer code points rather than visual character similarity, leading to false positives and missed matches.
Innovation Solution
A system utilizing a Convolutional Neural Network (CNN) for character-based detection of homographs, trained offline and deployed online to analyze DNS traffic, maps ASCII characters to visually similar Unicode characters, enabling real-time detection and mitigation of homographs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If integer code point comparison is used for homograph detection, then the detection process is simple and fast, but the detection accuracy is low leading to false positives and missed matches
Solution Approach 1:
The patent replaces the mechanical/algorithmic system of integer code point comparison with a neural network-based visual recognition system. The CNN model processes character images to detect visual similarity, substituting the traditional computational approach with a learning-based visual analysis system that can identify homographs based on their graphical appearance rather than numerical codes.
Solution Approach 2:
The patent changes the detection parameter from integer code points (numerical representation) to visual character features (image-based representation). By converting characters to images and using CNN to extract visual features, the system transforms the detection basis from numerical equality to visual similarity, enabling accurate homograph detection while maintaining processing efficiency through learned feature representations.
2Measurement precision
If visual character similarity analysis is implemented using CNN, then homograph detection accuracy is improved, but the system complexity and computational resources increase
Solution Approach 1:
The patent implements preliminary action by pre-training the CNN model offline using a large dataset of character images and their visual similarities. This offline training phase prepares the model in advance, so that during online operation, the pre-trained model can perform rapid homograph detection without requiring complex real-time training computations. The heavy computational work is done beforehand, simplifying the runtime system.
Solution Approach 2:
The patent uses character image copies as input to the CNN model instead of processing raw character data. By converting characters to standardized images and using these visual copies for analysis, the system simplifies the input processing while maintaining detection accuracy. The CNN model learns from these image copies during training and can efficiently classify homographs during deployment.
3Measurement precision
If offline training and online detection phases are separated, then the model can be trained comprehensively, but the deployment and update process becomes more complex
Solution Approach 1:
The patent creates a universal model through comprehensive offline training that covers multiple character sets, scripts, and homograph patterns. This single pre-trained model serves multiple detection purposes and can handle various types of homographs across different languages and character encodings. The universal model simplifies deployment as one standardized artifact that can be deployed across different environments without requiring environment-specific training.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Various techniques for detecting homographs of domain names are disclosed. In some embodiments, a system, process, and/or computer program product for detecting homographs of domain names includes receiving a DNS data stream, wherein the DNS data stream includes a DNS query and a DNS response for resolution of the DNS query; applying a homograph detector for each domain in the DNS data stream; and detecting a homograph of a domain name in the DNS data stream using the homograph detector.