Domain Name Detection Using Similar Character Pair Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing counterfeit domain name detection methods suffer from low accuracy and high false positives due to reliance on edit distance similarity measures, which fail to account for visual similarities and noise interference, especially when domain names are visually similar or use swapped characters.
Innovation Solution
A domain name detection method that incorporates a preset domain name set for preliminary filtering, calculates edit distance with a domain name keyword set, and uses a similar character pair set to identify visually similar characters or strings, reducing false positives by considering visual features and character swaps.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If edit distance calculation is used for counterfeit domain name detection, then the detection process is simple, but the detection accuracy is low and false positives are high
Solution Approach 1:
The patent segments the domain name into multiple levels (first-level domain name, second-level domain name, etc.) and performs detection on each level separately. This allows the system to focus on critical segments like the second-level domain name while ignoring less important parts, thereby improving accuracy without significantly increasing overall complexity
Solution Approach 2:
The patent introduces a confusion character set as an intermediary element to mediate the detection process. By comparing characters against this predefined set of potentially confusing characters (like l, 1, I, O, 0), the system can identify suspicious patterns more accurately than raw edit distance, reducing false positives while maintaining computational efficiency
2Measurement precision
If visual similarity analysis is added to detect counterfeit domain names, then detection accuracy improves, but computational complexity increases
Solution Approach 1:
The patent applies visual similarity analysis selectively only to characters that differ between the detected domain name and the trusted domain name, rather than analyzing the entire domain name string. This localized approach focuses computational resources on the most suspicious parts, improving detection accuracy while minimizing the increase in computational complexity
Solution Approach 2:
The patent performs preliminary filtering using edit distance calculation before conducting more expensive visual similarity analysis. By first identifying domain names with small edit distances and then applying visual similarity checks only to those candidates, the system prepares data in advance to reduce the computational burden of the more complex analysis
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
Embodiments of the present disclosure provide a domain name detection method, a device, and a storage medium. The method comprises: matching a domain name to be detected with a preset domain name set, wherein the preset domain name set comprises a plurality of trusted domain names; if the domain name to be detected is not in the preset domain name set, calculating an editing distance between each of at least some of level domain names in the domain name to be detected and each preset domain name keyword in a domain name keyword set; if the editing distance between any target level domain name and any target preset domain name keyword is less than a preset distance threshold, acquiring a character pair of the target level domain name and the target preset domain name keyword which are different from each other, and matching the character pair with a similar character pair set; and if it is determined that the character pair is in the similar character pair set, determining that there is a security risk in the domain name to be detected. According to the embodiments of the present disclosure, counterfeit domain names can be effectively detected, accuracy is improved, false alarms are reduced, the algorithm is simple, implementation difficulty is low, and complexity and performance overhead are low.