Visual domain detection systems and methods
Disclosed is an effective domain name defense solution in which a domain name string may be provided to or obtained by a computer embodying a visual domain analyzer. The domain name string may be rendered or otherwise converted to an image. An optical character recognition function may be applied to the image to read out a text string which can then be compared with a protected domain name to determine whether the text string generated by the optical character recognition function from the image converted from the domain name string is similar to or matches the protected domain name. This visual domain analysis can be dynamically applied in an online process or proactively applied in an offline process to hundreds of millions of domain names.
1. A method for generating a set of candidate domains that are determined by a computer to be visually similar to a protected domain name, comprising:
determining, by a computer, a protected domain name;
obtaining, by the computer, a set of domain names from a data source;
for each domain name in the set of domain names:
converting, by the computer, the domain name into an image;
converting, by the computer, the image into a first text string corresponding to the domain name obtained from the data source;
determining, by the computer utilizing a string distance function, a distance between the first text string corresponding to the domain name obtained from the data source and a second text string corresponding to the protected domain name;
determining, by the computer based at least on the distance, whether the first text string corresponding to the domain name obtained from the data source is visually similar to or matches the second text string corresponding to the protected domain name;
responsive to the first text string corresponding to the domain name obtained from the data source being determined as visually similar to or matches the second text string corresponding to the protected domain name, identifying the domain name obtained from the data source as a candidate domain; and
providing a list of the candidate domains that are visually similar to or match the protected domain name.
2. The method according to claim 1 , wherein whether the first text string corresponding to the domain name obtained from the data source is visually similar to or matches the second text string corresponding to the protected domain name is further determined based at least on one of a security policy.
3. The method according to claim 2 , wherein the security policy is defined by at least one of an anti-phishing rule, a brand protection rule, or a domain detection rule.
4. The method according to claim 1 , wherein the determining the distance further comprises calculating an edit distance, an n-gram distance, or a bigram distance between the first text string corresponding to the domain name obtained from the data source and the second text string corresponding to the protected domain name.
5. The method according to claim 1 , wherein the domain name is one of a plurality of domain names obtained from the data source, wherein each of the plurality of domain names is converted into a corresponding image, wherein the corresponding image is converted into a corresponding text string, wherein the corresponding text string is compared with the second text string corresponding to the protected domain name in determining whether the corresponding text string is visually similar to or matches the second text string corresponding to the protected domain name, and wherein any of the plurality of domain names having a corresponding text string determined as visually similar to or matches the second text string corresponding to the protected domain name is identified as a candidate domain.
6. The method according to claim 5 , further comprising:
generating a list of candidate domains from the plurality of domain names, wherein each of the candidate domains has a corresponding text string that has been programmatically determined as visually similar to or matches the second text string corresponding to the protected domain name.
7. The method according to claim 1 , wherein whether the first text string corresponding to the domain name obtained from the data source is visually similar to or matches the second text string corresponding to the protected domain name is further determined based at least on one of a security policy.
8. A system for generating a set of candidate domains that are determined to be visually similar to a protected domain name, comprising:
a processor;
a non-transitory computer-readable medium; and
stored instructions translatable by the processor for:
determining a protected domain name;
obtaining a set of domain names from a data source;
for each domain name in the set of domain names:
converting the domain name into an image;
converting the image into a first text string corresponding to the domain name obtained from the data source;
determining, utilizing a string distance function, a distance between the first text string corresponding to the domain name obtained from the data source and a second text string corresponding to the protected domain name;
determining, based at least on the distance, whether the first text string corresponding to the domain name obtained from the data source is visually similar to or matches the second text string corresponding to the protected domain name;
responsive to the first text string corresponding to the domain name obtained from the data source being determined as visually similar to or matches the second text string corresponding to the protected domain name, identifying the domain name obtained from the data source as a candidate domain; and
providing a list of the candidate domains that are visually similar to or match the protected domain name.
9. The system of claim 8 , wherein whether the first text string corresponding to the domain name obtained from the data source is visually similar to or matches the second text string corresponding to the protected domain name is further determined based at least on a security policy.
10. The system of claim 9 , wherein the security policy is defined by at least one of an anti-phishing rule, a brand protection rule, or a domain detection rule.
11. The system of claim 8 , wherein the determining the distance further comprises calculating an edit distance, an n-gram distance, or a bigram distance between the first text string corresponding to the domain name obtained from the data source and the second text string corresponding to the protected domain name.
12. The system of claim 8 , wherein the domain name is one of a plurality of domain names obtained from the data source, wherein each of the plurality of domain names is converted into a corresponding image, wherein the corresponding image is converted into a corresponding text string, wherein the corresponding text string is compared with the second text string corresponding to the protected domain name in determining whether the corresponding text string is visually similar to or matches the second text string corresponding to the protected domain name, and wherein any of the plurality of domain names having a corresponding text string determined as visually similar to or matches the second text string corresponding to the protected domain name is identified as a candidate domain.
13. The system of claim 12 , wherein the stored instructions are further translatable by the processor for:
generating a list of candidate domains from the plurality of domain names, wherein each of the candidate domains has a corresponding text string that has been programmatically determined as visually similar to or matches the second text string corresponding to the protected domain name.
14. The system of claim 8 , wherein whether the first text string corresponding to the domain name obtained from the data source is visually similar to or matches the second text string corresponding to the protected domain name is further determined based at least on one of a security policy.
15. A computer program product for generating a set of candidate domains that are determined to be visually similar to a protected domain name comprising a non-transitory computer-readable medium storing instructions translatable by a processor for:
determining a protected domain name;
obtaining a set of domain names from a data source;
for each domain name in the set of domain names:
converting the domain name into an image;
converting the image into a first text string corresponding to the domain name obtained from the data source;
determining, utilizing a string distance function, a distance between the first text string corresponding to the domain name obtained from the data source and a second text string corresponding to the protected domain name;
determining, based at least on the distance, whether the first text string corresponding to the domain name obtained from the data source is visually similar to or matches the second text string corresponding to the protected domain name; and
responsive to the first text string corresponding to the domain name obtained from the data source being determined as visually similar to or matches the second text string corresponding to the protected domain name, identifying the domain name obtained from the data source as a candidate domain; and
providing a list of the candidate domains that are visually similar to or match the protected domain name.
16. The computer program product of claim 15 , wherein whether the first text string corresponding to the domain name obtained from the data source is visually similar to or matches the second text string corresponding to the protected domain name is further determined based at least on a security policy.
17. The computer program product of claim 16 , wherein the security policy is defined by at least one of an anti-phishing rule, a brand protection rule, or a domain detection rule.
18. The computer program product of claim 15 , wherein the determining the distance further comprises calculating an edit distance, an n-gram distance, or a bigram distance between the first text string corresponding to the domain name obtained from the data source and the second text string corresponding to the protected domain name.
19. The computer program product of claim 15 , wherein the domain name is one of a plurality of domain names obtained from the data source, wherein each of the plurality of domain names is converted into a corresponding image, wherein the corresponding image is converted into a corresponding text string, wherein the corresponding text string is compared with the second text string corresponding to the protected domain name in determining whether the corresponding text string is visually similar to or matches the second text string corresponding to the protected domain name, and wherein any of the plurality of domain names having a corresponding text string determined as visually similar to or matches the second text string corresponding to the protected domain name is identified as a candidate domain.
20. The computer program product of claim 15 , wherein whether the first text string corresponding to the domain name obtained from the data source is visually similar to or matches the second text string corresponding to the protected domain name is further determined based at least on one of a security policy.