Domain Name Impersonation Detection Using Tokenization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The Domain Name System (DNS) is vulnerable to domain name impersonation, where nefarious parties register domain names that resemble well-known brands, leading to potential phishing and malware distribution, as existing systems lack effective real-time detection mechanisms for such impersonations.
Innovation Solution
A system that generates candidate tokens from DNS names, preprocesses them to remove extraneous characters, and applies literal, phonetic, and homoglyph algorithms to detect potential impersonations, using DNS sensor nodes for real-time monitoring and alerting subscribers to suspicious domain name activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If domain name registration is made easy and unregulated to promote internet growth, then domain name availability and accessibility improve, but domain name impersonation and malicious activities increase
Solution Approach 1:
The system performs preliminary analysis of domain name registration requests by comparing candidate domain names against a database of well-known brands and trademarks before registration is finalized. This preemptive approach identifies potential impersonation attempts early in the registration process, preventing malicious domain names from being registered while still allowing legitimate domain name growth.
Solution Approach 2:
The patent introduces an intermediary detection system that acts as a mediator between domain name registrars and the DNS infrastructure. This intermediary layer analyzes domain name patterns, performs similarity comparisons with known brands, and can block or flag suspicious registrations without disrupting the overall domain name registration ecosystem.
2Measurement precision
If traditional exact matching methods are used for domain name verification, then false positive detections are reduced, but domain name impersonation variations are missed
Solution Approach 1:
The system transforms the detection approach by changing the parameters used for comparison. Instead of exact string matching, the patent applies phonetic algorithms (converting domain names to phonetic representations), homoglyph detection (identifying visually similar characters from different scripts), and substring analysis. These parameter changes enable detection of impersonation variations while maintaining accuracy through multiple verification methods.
Solution Approach 2:
The patent employs partial matching techniques where substrings of domain names are analyzed against brand databases, and excessive action by applying multiple overlapping detection algorithms (phonetic, visual, substring) ensures comprehensive coverage of impersonation variations while filtering out false positives through cross-validation.
3Speed
If real-time domain name monitoring is implemented to detect impersonation, then detection speed and responsiveness improve, but system complexity and computational resources increase
Solution Approach 1:
The monitoring system is segmented into specialized modules: domain name parsing components that break down FQDNs into labels, phonetic algorithm modules for sound-based matching, homoglyph detection modules for visual similarity, and substring analysis components. This segmentation allows each module to perform its specific function efficiently in real-time while reducing overall system complexity through modular design.
Solution Approach 2:
The system performs preliminary processing of domain names by parsing FQDNs into individual labels and pre-computing phonetic representations and homoglyph variants before the actual matching process. This preliminary action prepares data in advance, enabling faster real-time comparison and detection while reducing computational complexity during the critical detection phase.
Data Source
AI summary
Systems and methods are described for detecting domain name impersonation in the domain name system (DNS). A nefarious party may register a domain name in the DNS that impersonates a domain name associated with a company in an attempt to lure users to malicious destination network addresses based on their trust of that company. This may lead to the dilution of the company's online presence as its domains come to be associated with malicious activity. In embodiments, a system is described which receives inputs from a subscriber including the domain names the subscriber wishes to protect, ignore, or give special scrutiny to. The system receives instances of domain names registered in the DNS and performs methods to determine if the domain name is attempting to impersonate the domain names of the subscriber. Alerts are generated so that the subscriber may take corrective action.