Homoglyph Attack Detection via Neural Network Feature Vectors
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies are inadequate in detecting and preventing homoglyph attacks, which utilize visually similar domain names to deceive users into accessing malicious websites, especially with the expansion of Unicode characters increasing the complexity of confusable characters.
Innovation Solution
A homoglyph attack detection service uses a convolutional neural network to generate feature vectors from protected domain names, stores them in a similarity search data store, and compares newly observed domain names to identify visually similar matches using a siamese neural network and similarity threshold, flagging potential threats for further review or action.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If Unicode characters are expanded for internationalized domain names, then global adoption of internet usage is promoted, but the set of confusable characters for homoglyph attacks vastly expands
Solution Approach 1:
The patent pre-generates images of legitimate domain names and creates corresponding feature vectors before attacks occur. These are stored in a database for future comparison, enabling proactive detection rather than reactive response to homoglyph attacks
Solution Approach 2:
The patent introduces an intermediary detection service that acts as a mediator between domain name registration and user access. This service uses image generation and neural network comparison to identify suspicious domain names before they can be used for attacks
2Measurement precision
If visual similarity is used to identify homoglyph attacks, then detection capability is improved, but false positives from legitimately similar domain names increase
Solution Approach 1:
The patent transforms domain names from text to images and then extracts feature vectors, changing the parameter space for comparison. This transformation enables more nuanced similarity assessment that can distinguish between intentional homoglyph attacks and legitimate visual similarities
Solution Approach 2:
The system uses siamese neural networks to learn from comparison results and refine detection thresholds. The feedback mechanism allows the system to adjust its sensitivity based on observed patterns, reducing false positives while maintaining detection accuracy
3Measurement precision
If deep learning techniques are used for image similarity analysis, then detection accuracy is enhanced, but computational complexity and processing time increase
Solution Approach 1:
The patent pre-generates images and computes feature vectors for legitimate domain names before they are needed for detection. This preliminary processing shifts computational burden to offline operations, reducing real-time complexity when actual detection is performed
Solution Approach 2:
The patent uses image copies of domain names as intermediaries for comparison rather than directly analyzing text. These pre-generated images serve as efficient representations that can be quickly compared using neural networks, reducing computational overhead during detection
Data Source
AI summary
The described technology is generally directed towards homoglyph attack detection. A homoglyph attack detection service can create images of customer's protected domain names. A convolutional neural network can generate feature vectors based on the images. The feature vectors can be stored in a similarity search data store. Newly observed domain names can be compared to the customer's protected domain names, by also generating feature vectors for the newly observed domain names and conducting approximate nearest neighbor searches. Search results can be further evaluated by comparing protected domain names to newly observed domain names using a siamese neural network which applies a similarity threshold. Newly observed domain names that meet or exceed the similarity threshold can be flagged for further action.