Domain Name Homograph Detection Using CNN Visual Similarity

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing technologies are ineffective in detecting homographs of domain names, which are used by malware and phishing attacks to deceive users, due to their reliance on integer code points of Unicode characters rather than visual similarity, leading to false positives and missed matches.

Innovation Solution

A system using a Convolutional Neural Network (CNN) is employed to train a deep learning model that recognizes visually similar Unicode characters and maps them to ASCII characters, enabling real-time detection of homographs in DNS traffic.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If existing technologies rely on integer code points of Unicode characters for domain name detection, then the detection process is simple and fast, but the detection accuracy deteriorates leading to false positives and missed matches

Engineering Contradiction:
Improvehomograph detection accuracyVSAvoiddetection system complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The patent replaces the mechanical/algorithmic approach of integer code point comparison with a neural network-based system that processes visual representations of characters. The CNN model takes image inputs of characters and outputs predictions about their visual similarity, substituting traditional computational methods with a learning-based system that captures visual patterns without relying on numerical codes.

Inventive Principle:
Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The patent introduces an intermediary layer between the input domain name and the detection decision. Instead of directly comparing integer code points, the system converts characters to visual representations (images) and uses a neural network as an intermediary processor to determine visual similarity. This intermediary step enables more accurate homograph detection while maintaining system manageability through modular architecture.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Measurement precision

If a deep learning model with CNN is used to recognize visually similar characters, then homograph detection accuracy is improved, but the processing time and computational resources increase

Engineering Contradiction:
Improvevisual similarity recognition accuracyVSAvoiddetection processing time
Core Design Contradiction:
Measurement precisionVSLoss of time

Solution Approach 1:

The patent applies preliminary action by pre-training the CNN model offline using a large dataset of character images and their visual similarities. During this training phase, the network learns to recognize visual patterns and relationships between characters. Once trained, the model can make rapid predictions on new inputs without requiring extensive computational resources, thus reducing real-time processing time while maintaining high accuracy.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The patent utilizes parameter changes by adjusting the model architecture and training parameters to optimize the balance between accuracy and speed. The CNN model incorporates specific layers and activation functions that enable efficient feature extraction. Additionally, the system processes domain names character-by-character, breaking down the complex task into smaller units that can be processed more quickly, thereby reducing overall detection time.

Inventive Principle:
Principle #35Parameter changes

3Measurement precision

If character-based visual similarity analysis is performed for each character in domain names, then detection accuracy is improved, but the computational complexity increases

Engineering Contradiction:
Improvecharacter-level homograph detection accuracyVSAvoidcomputational complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The patent applies segmentation by dividing the domain name into individual characters and processing each character separately through the CNN model. This segmentation allows the system to handle complex visual similarity comparisons in manageable units. Each character is converted to an image representation and processed independently, then the results are combined to determine overall homograph status. This approach reduces computational complexity compared to processing entire domain names as single units while maintaining high character-level detection accuracy.

Inventive Principle:
Principle #1Segmentation

Data Source

PatentUS20250337711A1Detecting homographs of domain names
Publication Date: 2025.10.30 INFOBLOX INC
  • US20250337711A1 patent drawing
  • US20250337711A1 patent drawing
  • US20250337711A1 patent drawing

AI summary

Various techniques for detecting homographs of domain names are disclosed. In some embodiments, a system, process, and/or computer program product for detecting homographs of domain names includes receiving a DNS data stream, wherein the DNS data stream includes a DNS query and a DNS response for resolution of the DNS query; applying a homograph detector for each domain in the DNS data stream; and detecting a homograph of a domain name in the DNS data stream using the homograph detector.