Tokenization of domain names for domain name impersonation detection using matching
Systems and methods are described for detecting domain name impersonation in the domain name system (DNS). A nefarious party may register a domain name in the DNS that impersonates a domain name associated with a company in an attempt to lure users to malicious destination network addresses based on their trust of that company. This may lead to the dilution of the company's online presence as its domains come to be associated with malicious activity. In embodiments, a system is described which receives inputs from a subscriber including the domain names the subscriber wishes to protect, ignore, or give special scrutiny to. The system receives instances of domain names registered in the DNS and performs methods to determine if the domain name is attempting to impersonate the domain names of the subscriber. Alerts are generated so that the subscriber may take corrective action.
1. A method for processing a domain name system (DNS) name string to obtain a plurality of candidate tokens to detect impersonation, comprising:
(a) parsing a DNS name string based on a delimiting character to generate a plurality of labels;
(b) obtaining a plurality of subsets of labels from the plurality of labels, each of the subsets of labels consisting of a number of labels;
(c) concatenating the labels from each of the subset of labels obtained in (b) according to the order the labels appear in the processed DNS name string when read sequentially to generate a plurality of candidate tokens; and
(d) analyzing each candidate token of the plurality of candidate tokens to determine whether the respective candidate token matches a subscriber string associated with a subscriber.
2. The method of claim 1 , further comprising:
(e) detecting the DNS name string as being newly registered with a domain name system, wherein steps (a)-(d) occur when the DNS name string is detected as being newly registered.
3. The method of claim 1 , further comprising:
(e) determining that the DNS name string is not present in a white list associated with the subscriber, wherein steps (a)-(d) occur when the DNS name string is determined to be not present in the white list.
4. The method of claim 1 , wherein the analyzing (d) comprises analyzing at least one candidate token of the plurality of candidate tokens to determine whether the candidate token impersonates any subscriber string from a plurality of subscriber strings.
5. The method of claim 1 , wherein each label in the plurality of labels corresponds to a substring within the processed DNS name string, wherein the substring appears between successive instances of the delimiting character within the processed DNS name string.
6. The method of claim 4 , wherein each subset of labels obtained in (b) comprises labels that appear consecutively, separated by the delimiting character, in the processed DNS name string.
7. The method of claim 1 , wherein the delimiting character is a period character.
8. The method of claim 1 , wherein the analysis (d) is conducted at least in part using a Levenshtein Distance algorithm.
9. The method of claim 1 , wherein the analysis (d) is conducted at least in part using a Homograph algorithm.
10. The method of claim 1 , wherein the analysis (d) is conducted at least in part using an algorithm that looks for phonetic matches between strings.
11. A non-transitory program storage device having instructions stored thereon that, when executed by at least one computing device, causes the at least one computing device to perform a method for determining when at least one of a plurality of candidate tokens from a Domain Name System (DNS) name string is impersonating at least one of a plurality of subscriber strings, the method comprising:
(a) parsing a DNS name string based on a delimiting character to generate a plurality of labels;
(b) obtaining a plurality of subsets of labels from the plurality of labels, each of the subsets of labels consisting of a number of labels;
(c) concatenating the labels from each subset of labels obtained in (b) according to the order the labels appear in the processed DNS name string when read sequentially to generate a plurality of candidate tokens; and
(d) analyzing each candidate token of the plurality of candidate tokens to determine whether the respective candidate token matches a subscriber string associated with a subscriber.
12. The program storage device of claim 11 , the method further comprising:
(e) detecting the DNS name string as being newly registered with a domain name system, wherein steps (a)-(d) occur when the DNS name string is detected as being newly registered.
13. The program storage device of claim 11 , the method further comprising:
(e) determining that the DNS name string is not present in a white list associated with the subscriber, wherein steps (a)-(d) occur when the DNS name string is determined to be not present in the white list.
14. The program storage device of claim 11 , wherein the analyzing (d) comprises analyzing at least one candidate token of the plurality of candidate tokens to determine whether the candidate token impersonates any subscriber string from a plurality of subscriber strings.
15. The program storage device of claim 11 , wherein each label in the plurality of labels corresponds to a substring within the processed DNS name string, wherein the substring appears between successive instances of the delimiting character within the processed DNS name string.
16. The program storage device of claim 14 , wherein each subset of labels obtained in (b) comprises labels that appear consecutively, separated by the delimiting character, in the processed DNS name string.
17. The program storage device of claim 11 , wherein the delimiting character is a period character.
18. The program storage device of claim 11 , wherein the analysis (d) is conducted at least in part using a Levenshtein Distance algorithm.
19. The program storage device of claim 11 , wherein the analysis (d) is conducted at least in part using a Homograph algorithm.
20. The program storage device of claim 11 , wherein the analysis (d) is conducted at least in part using an algorithm that looks for phonetic matches between strings.