Optical Domain Name Analysis for Homograph Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for identifying potentially malicious domain names are limited in detecting variations that exploit font, typography, and visual similarities, failing to account for how humans are tricked by hackers and phishers.
Innovation Solution
A computer-based system converts domain names to optical images, applies distortions, and uses optical character recognition (OCR) to score similarity with protected domain names, mimicking human perception of malicious links.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If text-based algorithms are used to identify malicious domain names, then the detection process is simple and fast, but the detection precision is insufficient because it cannot account for visual similarities exploited by hackers
Solution Approach 1:
The patent replaces text-based algorithmic comparison with optical image processing and OCR technology. Domain names are converted to images, processed through optical analysis systems, and then converted back to text for comparison. This substitution enables the detection system to evaluate visual similarities the way human eyes perceive them, thereby detecting homograph attacks and font-based spoofing that text algorithms miss.
Solution Approach 2:
The patent introduces an intermediary optical processing system between the domain name input and the comparison analysis. The domain name is first converted to an image representation, then processed through OCR and visual similarity analysis before being converted back to text for final comparison. This intermediary optical analysis layer enables detection of visual spoofing techniques without completely replacing the text-based workflow.
2Reliability
If precomputation of all common variations is performed, then detection coverage is improved, but the time and computational resources required increase significantly
Solution Approach 1:
The patent performs preliminary conversion of domain names to optical images and stores these image representations. When detecting potential spoofing attempts, the system compares incoming domain name images against the pre-computed image database using optical similarity analysis. This preliminary action enables faster detection because the computationally intensive image generation has already been done, and only the comparison step remains.
Solution Approach 2:
The patent creates optical image copies of domain names for storage and comparison purposes. Instead of storing only text representations, the system generates and stores visual image copies that can be directly compared using optical analysis. These image copies enable rapid visual similarity detection without requiring real-time text-based algorithmic analysis of all possible variations.
3Adaptability or versatility
If algorithms are limited to programmed rules, then the system is easier to implement, but it cannot adapt to new spoofing techniques that exploit font, typography, and visual presentation
Solution Approach 1:
The patent replaces rigid text-based comparison algorithms with flexible optical image analysis. The OCR and visual similarity detection systems can naturally adapt to different fonts, typography, and visual presentations because they analyze the actual visual appearance rather than relying on pre-programmed text transformation rules. This substitution enables the system to detect novel spoofing techniques that exploit visual rendering without requiring updates to the underlying detection logic.
Data Source
AI summary
Systems and methods determine whether domain names are potentially maliciously registered variants of a set of monitored domain names. A computer system can receive domain names from a feed of newly registered domain names. For each received domain name, the computer system can generate a series of images of the domain name in different fonts and/or with various distortions applied thereto. The computer system can then transform the domain name images back to text via optical character recognition. Due to the differences in fonts and/or distortions applied to the generated images of the received domain name, the optical character recognition process can produce different text strings than the originally received domain name. The converted textual domain names are then analyzed to determine whether any one is sufficiently similar to a monitored domain name, indicating that the received domain name could be a malicious variant thereof.