Domain Name Homograph Detection Using CNN Visual Similarity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies are ineffective in detecting homographs of domain names, which are used by malware and phishing attacks to deceive users, due to their reliance on integer code points of Unicode characters rather than visual similarity, leading to false positives and missed matches.
Innovation Solution
A system using a Convolutional Neural Network (CNN) is employed to train a deep learning model that recognizes visually similar Unicode characters and maps them to ASCII characters, enabling real-time detection of homographs in DNS traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing technologies rely on integer code points of Unicode characters for domain name detection, then the detection process is simple and fast, but the detection accuracy deteriorates leading to false positives and missed matches
Solution Approach 1:
The patent replaces the mechanical/algorithmic approach of integer code point comparison with a neural network-based system that processes visual representations of characters. The CNN model takes image inputs of characters and outputs predictions about their visual similarity, substituting traditional computational methods with a learning-based system that captures visual patterns without relying on numerical codes.
Solution Approach 2:
The patent introduces an intermediary layer between the input domain name and the detection decision. Instead of directly comparing integer code points, the system converts characters to visual representations (images) and uses a neural network as an intermediary processor to determine visual similarity. This intermediary step enables more accurate homograph detection while maintaining system manageability through modular architecture.
2Measurement precision
If a deep learning model with CNN is used to recognize visually similar characters, then homograph detection accuracy is improved, but the processing time and computational resources increase
Solution Approach 1:
The patent applies preliminary action by pre-training the CNN model offline using a large dataset of character images and their visual similarities. During this training phase, the network learns to recognize visual patterns and relationships between characters. Once trained, the model can make rapid predictions on new inputs without requiring extensive computational resources, thus reducing real-time processing time while maintaining high accuracy.
Solution Approach 2:
The patent utilizes parameter changes by adjusting the model architecture and training parameters to optimize the balance between accuracy and speed. The CNN model incorporates specific layers and activation functions that enable efficient feature extraction. Additionally, the system processes domain names character-by-character, breaking down the complex task into smaller units that can be processed more quickly, thereby reducing overall detection time.
3Measurement precision
If character-based visual similarity analysis is performed for each character in domain names, then detection accuracy is improved, but the computational complexity increases
Solution Approach 1:
The patent applies segmentation by dividing the domain name into individual characters and processing each character separately through the CNN model. This segmentation allows the system to handle complex visual similarity comparisons in manageable units. Each character is converted to an image representation and processed independently, then the results are combined to determine overall homograph status. This approach reduces computational complexity compared to processing entire domain names as single units while maintaining high character-level detection accuracy.
Data Source
AI summary
Various techniques for detecting homographs of domain names are disclosed. In some embodiments, a system, process, and/or computer program product for detecting homographs of domain names includes receiving a DNS data stream, wherein the DNS data stream includes a DNS query and a DNS response for resolution of the DNS query; applying a homograph detector for each domain in the DNS data stream; and detecting a homograph of a domain name in the DNS data stream using the homograph detector.


