Detecting homographs of domain names

1. A system, comprising:

a processor configured to:

receive a DNS data stream, wherein the DNS data stream includes a DNS query and a DNS response for resolution of the DNS query;

apply a homograph detector for a domain in the DNS data stream, comprising to:

decode the domain to Unicode;

map each character of the Unicode to an ASCII character using an ASCII to Unicode map, wherein the ASCII to Unicode map is generated using a convolutional neural network and trained using training data; and

perform one or more of the following:

A) perform a lookup on a target list; and

 identify matches based on the lookup;

B) apply similarity score metrics; and

 identify nearby/close matches based on threshold similarity scores; and/or

C) implement a k-nearest neighbor; and

 identify matches based on k-NN threshold distance results; and

detect a homograph of a domain name in the DNS data stream using the homograph detector; and

a memory coupled to the processor and configured to provide the processor with instructions.

2. The system recited in claim 1 , wherein the DNS data stream is a live DNS data stream.

3. The system recited in claim 1 , wherein the homograph detector automatically detects homographs of one or more target domain names.

4. The system recited in claim 1 , wherein the processor is further configured to:

perform a mitigation action based on detecting the homograph of the domain name.

5. The system recited in claim 1 , wherein the processor is further configured to:

block the DNS response to impede a client communication with an IP address associated with the homograph of the domain name.

6. The system recited in claim 1 , wherein the DNS response for resolution of the DNS query includes an IP address, and wherein the processor is further configured to:

add the IP address associated with the homograph of the domain name to a blacklist or add homograph domain to a blacklist feed.

7. The system recited in claim 1 , wherein the DNS response for resolution of the DNS query includes an IP address, and wherein the processor is further configured to:

send the IP address associated with the homograph of the domain name to a firewall.

8. The system recited in claim 1 , wherein the processor is further configured to perform one or more mitigation actions comprising to:

generate a firewall rule based on an IP address associated with the homograph of the domain name;

configure a network device to block network communications with the IP address associated with the homograph of the domain name;

quarantine an infected host, wherein the infected host is determined to be infected based on an association with the IP address associated with the homograph of the domain name; and

add the homograph of the domain name to a reputation feed.

9. A method, comprising:

receiving a DNS data stream, wherein the DNS data stream includes a DNS query and a DNS response for resolution of the DNS query;

applying a homograph detector for a domain in the DNS data stream, comprising:

decoding the domain to Unicode;

mapping each character of the Unicode to an ASCII character using an ASCII to Unicode map, wherein the ASCII to Unicode map is generated using a convolutional neural network and trained using training data; and

performing one or more of the following:

A) performing a lookup on a target list; and

identifying matches based on the lookup;

B) applying similarity score metrics; and

identifying nearby/close matches based on threshold similarity scores; and/or

C) implementing a k-nearest neighbor; and

identifying matches based on k-NN threshold distance results; and

detecting a homograph of a domain name in the DNS data stream using the homograph detector.

10. The method of claim 9 , wherein the DNS data stream is a live DNS data stream.

11. The method of claim 9 , wherein the homograph detector automatically detects homographs of one or more target domain names.

12. The method of claim 9 , further comprising:

performing a mitigation action based on detecting the homograph of the domain name.

13. A computer program product, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:

receiving a DNS data stream, wherein the DNS data stream includes a DNS query and a DNS response for resolution of the DNS query;

applying a homograph detector for a domain in the DNS data stream, comprising:

decoding the domain to Unicode;

mapping each character of the Unicode to an ASCII character using an ASCII to Unicode map, wherein the ASCII to Unicode map is generated using a convolutional neural network and trained using training data; and

performing one or more of the following:

A) performing a lookup on a target list; and

identifying matches based on the lookup;

B) applying similarity score metrics; and

identifying nearby/close matches based on threshold similarity scores;

and/or

C) implementing a k-nearest neighbor; and

identifying matches based on k-NN threshold distance results; and

detecting a homograph of a domain name in the DNS data stream using the homograph detector.

14. The computer program product recited in claim 13 , wherein the DNS data stream is a live DNS data stream.

15. The computer program product recited in claim 13 , wherein the homograph detector automatically detects homographs of one or more target domain names.