Phishing Domain Detection Using Keyboard Distance and GAN Image Recognition
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting phishing domains, such as homoglyph, typo-squatting, and general phishing attacks, are inadequate as they fail to account for keyboard distance and are biased towards specific fonts or fonts used during training, leading to inefficiencies in identifying early-stage phishing attacks and false positives in detecting malware domains.
Innovation Solution
A system utilizing a Generative Adversarial Neural Network (GAN) with a homoglyph encoder and Swype Image Renderer to convert string comparison into image recognition, combined with a Bidirectional Encoder Representations from Transformers (BERT) neural network for natural language understanding, to detect homoglyph, typo-squatting, and general phishing domains, and an alert module for enriching alerts and behavioral analytics to identify phishing campaigns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If Levenshtein edit distance method is used to detect typo-squatting phishing domains, then detection capability is provided, but keyboard distance is not accounted for leading to inaccurate detection
Solution Approach 1:
The patent changes the parameter basis from simple character substitution (Levenshtein distance) to keyboard-position-based distance measurement. It introduces a keyboard layout model where each character is assigned coordinates, and the distance between characters is calculated based on their physical proximity on the keyboard, thereby improving detection accuracy for typo-squatting domains.
Solution Approach 2:
The patent replaces the abstract string-editing mechanism with a physical keyboard-layout-based mechanism. By mapping characters to their physical positions on a keyboard and calculating distances based on spatial relationships, it substitutes the mechanical string manipulation approach with a more realistic model of typographical errors.
2Adaptability or versatility
If simple sum of distances method is used to account for keyboard distance, then keyboard proximity is considered, but transposition of adjacent characters is not detected
Solution Approach 1:
The patent performs preliminary action by sorting the characters of both the domain and its suspected variant before calculating distance. This sorting step ensures that transposed adjacent characters are realigned to their correct positions, allowing the keyboard distance calculation to accurately reflect the minimal movement required to transform one domain into another.
3Productivity
If traditional detection methods are used, then processing speed is maintained, but false positives between malware domains and phishing domains occur
Solution Approach 1:
The patent applies local quality by differentiating detection strategies for different types of domains. It specifically targets phishing domains by looking for visual similarity to legitimate domains, while malware domains are detected through other characteristics. This localized approach to detection quality reduces false positives by applying the appropriate detection criteria to each domain type.
4Measurement precision
If multiple detection techniques are combined to improve accuracy, then detection comprehensiveness is improved, but system complexity increases
Solution Approach 1:
The patent merges multiple detection techniques ( homoglyph detection, typo-squatting detection using keyboard distance, and general phishing detection) into a unified system. By integrating these techniques and sharing common components such as the keyboard layout model and domain processing pipeline, it achieves comprehensive detection while managing system complexity through consolidation.
Data Source
AI summary
This document describes a system and method for detecting phishing-domains, which are used by cyber-attackers to carry out phishing attacks, in a set of Domain Name System (DNS) records, the system comprising a homoglyph phishing domain detection module, a typo-squatting phishing domain detection module, a general phishing domain detection module and an alert module. These modules are configured to collaboratively detect and identify phishing-domains from the set of DNS records using a combination of homoglyph, typo-squatting and general phishing domain techniques. Subsequently, an alert module may be used to correlate the alerts from the various phishing detection modules to discover phishing campaigns occurring in DNS network data.