Detection of squatting domains with intentionally substituted keywords

1 . A system, comprising:

one or more processors configured to:

detect a domain squatting based at least in part on determining one or more substituted keywords based on input domains and seed domains to generate a plurality of potential squatting domains; and

perform an action in response to detecting the domain squatting based at least in part on the one or more substituted keywords; and

a memory coupled to the one or more processors and configured to provide the one or more processors with instructions.

2 . The system of claim 1 , wherein the one or more substituted keywords are determined based at least in part on querying a machine learning model.

3 . The system of claim 2 , wherein the determining the one or more substituted keywords based on input domains and seed domains comprises:

querying a machine learning model based at least in part on the input domains and the seed domain; and

obtaining the one or more substituted keywords.

4 . The system of claim 3 , wherein the machine learning model is a large language model (LLM).

5 . The system of claim 1 , wherein the one or more substitute keyword comprise one or more keywords determined based at least in part on a homophone substitution.

6 . The system of claim 1 , wherein the one or more substitute keyword comprise one or more keywords determined based at least in part on a semantic synonym substitution.

7 . The system of claim 1 , wherein the one or more substitute keyword comprise one or more keywords determined based at least in part on a related-word substitution.

8 . The system of claim 1 , wherein the one or more processors are further configured to:

storing the one or more substituted keywords in a dictionary.

9 . The system of claim 8 , wherein the dictionary is implemented as a hash map.

10 . The system of claim 1 , wherein the seed domains comprise one or more predefined domains.

11 . The system of claim 1 , wherein the seed domains comprises a set of a threshold number of most popular domains.

12 . The system of claim 1 , wherein the seed domains comprise a domain for which a security service is provided to detect the domain squatting.

13 . The system of claim 1 , wherein the one or more processors are further configured to:

obtain the seed domains;

extract domain names from the seed domains; and

generate a trie representing the domain names.

14 . The system of claim 1 , wherein the determining the one or more substituted keywords comprises:

obtaining a set of domain names extracted from the seed domains;

querying a first machine learning model for a set of meaningful words within the set of domain names; and

querying a second machine learning model for a set of confusable words based at least in part on the set of meaningful words.

15 . The system of claim 14 , wherein the first machine learning model and the second machine learning model are the same.

16 . The system of claim 15 , wherein the first machine learning model and the second machine learning model are implemented by a large language model (LLM).

17 . The system of claim 14 , wherein the set of confusable words are stored in a dictionary of one or more substituted keywords.

18 . The system of claim 1 , wherein detecting the domain squatting comprises performing a post-filtering plurality of potential squatting domains to obtain a set of detections.

19 . The system of claim 18 , wherein the post-filtering of detection results comprises determining whether a registration of a domain name selected from the plurality of potential squatting domains corresponds to a defensive registration on behalf of an owner of a seed domain.

20 . The system of claim 19 , wherein the domain name is deemed to be a defensive registration in response to determining that a registrant information for the domain name matches a registrant information for the corresponding seed domain.

21 . A method, comprising:

detecting a domain squatting based at least in part on determining one or more substituted keywords based on input domains and seed domains to generate a plurality of potential squatting domains; and

performing an action in response to detecting the domain squatting based at least in part on the one or more substituted keywords.

22 . A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:

detecting a domain squatting based at least in part on determining one or more substituted keywords based on input domains and seed domains to generate a plurality of potential squatting domains; and

performing an action in response to detecting the domain squatting based at least in part on the one or more substituted keywords.

23 . A system, comprising:

one or more processors configured to:

extract domain names from a plurality of seed domains;

construct a data representation based at least in part on the extracted domain names; and

apply a machine learning model to determine one or more potential abused keyword relationships the plurality of seed domains to extract a plurality of meaningful words; and

a memory coupled to the one or more processors and configured to provide the one or more processors with instructions.

24 . A method, comprising:

extracting domain names from a plurality of seed domains;

constructing a data representation based at least in part on the extracted domain names; and

applying a machine learning model to determine one or more potential abused keyword relationships the plurality of seed domains to extract a plurality of meaningful words.

25 . A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:

extracting domain names from a plurality of seed domains;

constructing a data representation based at least in part on the extracted domain names; and

applying a machine learning model to determine one or more potential abused keyword relationships the plurality of seed domains to extract a plurality of meaningful words.