IDN Homograph Attack Detection via Keyboard Map Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods are inadequate in detecting Internationalized Domain Name (IDN) homograph attacks, where malicious actors create fake domain names that appear similar to legitimate ones by using visually identical characters from different languages, making it difficult for users to distinguish between genuine and deceptive URLs.
Innovation Solution
The proposed solution involves assessing the likelihood that all characters in a URI were typed on a single keyboard map by comparing machine-encoded graphemes from different keyboard map sets, flagging URIs that include characters from multiple or distant keyboard map sets as potentially deceptive, and employing a system to prevent access to such potentially malicious sites.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If visual similarity between homoglyphs is used to create deceptive URIs, then the deceptive capability is improved, but the detectability deteriorates
Solution Approach 1:
The patent changes the parameter from visual appearance to machine-encoded grapheme values. By comparing the Unicode code points of characters in the URI, the system detects homograph attacks based on numerical differences between characters from different keyboard map sets, rather than relying on visual similarity which is indistinguishable to humans.
2Measurement precision
If keyboard map comparison method is used to detect homograph attacks, then the detection accuracy is improved, but the system complexity increases
Solution Approach 1:
The patent pre-establishes keyboard map sets and their corresponding grapheme ranges before detection. These reference data structures are prepared in advance, allowing the detection system to quickly compare URI characters against known keyboard layouts without complex real-time analysis, thereby reducing system complexity while maintaining high detection accuracy.
Data Source
AI summary
Disclosed herein is technology that detects potentially deceptive URI (Uniform Resource Identifier) of a homograph attack (e.g., an Internationalized Domain Name (IDN) homograph attack). In one or more implementations, the detection may be accomplished, at least in part, by assessing the likelihood that all of the characters in the URI (e.g., domain name) were typed on a keyboard using a single keyboard map. This Abstract is submitted with the understanding that it will not be used to interpret or limit the scope or meaning of the claims.