Granted Patent B2

US 12,284,213 · App. 18/815,535 · Granted Apr 22, 2025

Inventors: Wenbin Zhang (Beijing, CN); Wei Zeng (Beijing, CN); Xiaodong Su (Beijing, CN)

Assignee: Beijing Volcano Engine Technology Co., Ltd.

H04L63/1483H04L61/4511H04L63/0435H04L63/1408H04L63/16H04L61/30H04L61/3025H04L63/14

Abstract

Claims (69)

1. A method for domain name detection, comprising:

matching a to-be-detected domain name with a preset domain name set, wherein the preset domain name set comprises a plurality of trusted domain names;

in response to the to-be-detected domain name being not in the preset domain name set, calculating an edit distance between at least part of level domain names of the to-be-detected domain name and a preset domain name keyword in a domain name keyword set, wherein the domain name keyword set is constructed and generated based on a keyword in a trusted domain name;

in response to an edit distance between a target level domain name and a target preset domain name keyword being smaller than a preset distance threshold, acquiring a character pair in which the target level domain name differs from the target preset domain name keyword, and matching the character pair with a similar character pair set, wherein the similar character pair set comprises a plurality of similar character pairs, and each similar character pair comprises two visually similar characters or strings; and

in response to determining that the character pair is in the similar character pair set, determining that the to-be-detected domain name has a security risk.

2. The method of claim 1 , further comprising:

in response to determining that the character pair is not in the similar character pair set, judging whether the target level domain name is obtained by swapping positions of partial characters in the target preset domain name keyword; and

in response to determining that the target level domain name is obtained by swapping the positions of partial characters in the target preset domain name keyword, determining that the to-be-detected domain name has a security risk.

3. The method of claim 2 , wherein the in response to determining that the character pair is not in the similar character pair set, judging whether the target level domain name is obtained by swapping positions of partial characters in the target preset domain name keyword comprises:

in response to determining that the character pair is not in the similar character pair set, judging whether a length of the target level domain name exceeds a preset length; and

in response to determining that the length of the target level domain name exceeds the preset length, judging whether the target level domain name is obtained by swapping the positions of partial characters in the target preset domain name keyword.

4. The method of claim 1 , before the determining that the to-be-detected domain name has a security risk, further comprising:

acquiring historical access amount data of the to-be-detected domain name during a past preset period, judging whether the historical access amount data of the to-be-detected domain name during the past preset period exceeds a preset access amount threshold; and

in response to the historical access amount data of the to-be-detected domain name during the past preset period not exceeding the preset access amount threshold, determining that the to-be-detected domain name has the security risk, or

in response to the historical access amount data of the to-be-detected domain name during the past preset time period exceeding the preset access amount threshold, determining that the to-be-detected domain name is a trusted domain name.

5. The method of claim 1 , before the matching a to-be-detected domain name with a preset domain name set, further comprising:

acquiring historical access amount data of a plurality of alternative domain names during a past preset period; and

in response to historical access amount data of an alternative domain name during the past preset period exceeding a preset access amount threshold, adding the alternative domain name to the preset domain name set to construct the preset domain name set.

6. The method of claim 1 , before the matching the character pair with a similar character pair set, further comprising:

acquiring images of different single-characters and images of different strings, wherein a string comprises at least two characters; and

acquiring a similarity between images, determining a similar character pair based on the similarity between the images, and adding the similar character pair to the similar character pair set to construct the similar character pair set.

7. The method of claim 6 , wherein the acquiring a similarity between images, determining a similar character pair based on the similarity between the images comprises:

acquiring a similarity between images of different single-characters, and in response to a similarity between images of two single-characters being greater than a preset similarity threshold, determining the two single-characters as a similar character pair; and/or

acquiring a similarity between images of different strings, and in response to a similarity between images of two strings being greater than the preset similarity threshold, determining the two strings as a similar character pair.

8. The method of claim 1 , before the calculating an edit distance between at least part of level domain names of the to-be-detected domain name and a preset domain name keyword in a domain name keyword set, further comprising:

dividing the to-be-detected domain name by a dot delimiter to obtain at least part of level domain names of the to-be-detected domain name, and ignoring a top level domain name.

9. An electronic device, comprising:

at least one processor and at least one memory,

wherein the at least one memory stores computer-executable instructions, and the at least one processor executes the computer-executable instructions stored in the at least one memory, causing the at least one processor to implement a method for domain name detection, and the method comprises:

matching a to-be-detected domain name with a preset domain name set, wherein the preset domain name set comprises a plurality of trusted domain names;

in response to the to-be-detected domain name being not in the preset domain name set, calculating an edit distance between at least part of level domain names of the to-be-detected domain name and a preset domain name keyword in a domain name keyword set, wherein the domain name keyword set is constructed and generated based on a keyword in a trusted domain name;

in response to an edit distance between a target level domain name and a target preset domain name keyword being smaller than a preset distance threshold, acquiring a character pair in which the target level domain name differs from the target preset domain name keyword, and matching the character pair with a similar character pair set, wherein the similar character pair set comprises a plurality of similar character pairs, each similar character pair comprises two visually similar characters or strings; and

in response to determining that the character pair is in the similar character pair set, determining that the to-be-detected domain name has a security risk.

10. The electronic device of claim 9 , wherein the method further comprises:

in response to determining that the character pair is not in the similar character pair set, judging whether the target level domain name is obtained by swapping positions of partial characters in the target preset domain name keyword; and

in response to determining that the target level domain name is obtained by swapping the positions of partial characters in the target preset domain name keyword, determining that the to-be-detected domain name has a security risk.

11. The electronic device of claim 10 , wherein the in response to determining that the character pair is not in the similar character pair set, judging whether the target level domain name is obtained by swapping positions of partial characters in the target preset domain name keyword comprises:

in response to determining that the character pair is not in the similar character pair set, judging whether a length of the target level domain name exceeds a preset length; and

in response to determining that the length of the target level domain name exceeds the preset length, judging whether the target level domain name is obtained by swapping the positions of partial characters in the target preset domain name keyword.

12. The electronic device of claim 9 , wherein before the determining that the to-be-detected domain name has a security risk, the method further comprises:

acquiring historical access amount data of the to-be-detected domain name during a past preset period, judging whether the historical access amount data of the to-be-detected domain name during the past preset period exceeds a preset access amount threshold; and

in response to the historical access amount data of the to-be-detected domain name during the past preset period not exceeding the preset access amount threshold, determining that the to-be-detected domain name has the security risk, or

in response to the historical access amount data of the to-be-detected domain name during the past preset time period exceeding the preset access amount threshold, determining that the to-be-detected domain name is a trusted domain name.

13. The electronic device of claim 9 , wherein before the matching a to-be-detected domain name with a preset domain name set, the method further comprises:

acquiring historical access amount data of a plurality of alternative domain names during a past preset period; and

in response to historical access amount data of an alternative domain name during the past preset period exceeding a preset access amount threshold, adding the alternative domain name to the preset domain name set to construct the preset domain name set.

14. The electronic device of claim 9 , wherein before the matching the character pair with a similar character pair set, the method further comprises:

acquiring images of different single-characters and images of different strings, wherein a string comprises at least two characters; and

acquiring a similarity between images, determining a similar character pair based on the similarity between the images, and adding the similar character pair to the similar character pair set to construct the similar character pair set.

15. The electronic device of claim 14 , wherein the acquiring a similarity between images, determining a similar character pair based on the similarity between the images comprises:

acquiring a similarity between images of different single-characters, and in response to a similarity between images of two single-characters being greater than a preset similarity threshold, determining the two single-characters as a similar character pair; and/or

acquiring a similarity between images of different strings, and in response to a similarity between images of two strings being greater than the preset similarity threshold, determining the two strings as a similar character pair.

16. The electronic device of claim 9 , wherein before the calculating an edit distance between at least part of level domain names of the to-be-detected domain name and a preset domain name keyword in a domain name keyword set, the method further comprises:

dividing the to-be-detected domain name by a dot delimiter to obtain at least part of level domain names of the to-be-detected domain name, and ignoring a top level domain name.

17. A non-transient computer-readable storage medium, storing computer-executable instructions, wherein the computer-executable instructions upon being executed by a processor, implement a method for domain name detection, and the method comprises:

matching a to-be-detected domain name with a preset domain name set, wherein the preset domain name set comprises a plurality of trusted domain names;

in response to the to-be-detected domain name being not in the preset domain name set, calculating an edit distance between at least part of level domain names of the to-be-detected domain name and a preset domain name keyword in a domain name keyword set, wherein the domain name keyword set is constructed and generated based on a keyword in a trusted domain name;

in response to an edit distance between a target level domain name and a target preset domain name keyword being smaller than a preset distance threshold, acquiring a character pair in which the target level domain name differs from the target preset domain name keyword, and matching the character pair with a similar character pair set, wherein the similar character pair set comprises a plurality of similar character pairs, each similar character pair comprises two visually similar characters or strings; and

in response to determining that the character pair is in the similar character pair set, determining that the to-be-detected domain name has a security risk.

18. The storage medium of claim 17 , wherein the method further comprises:

in response to determining that the character pair is not in the similar character pair set, judging whether the target level domain name is obtained by swapping positions of partial characters in the target preset domain name keyword; and

in response to determining that the target level domain name is obtained by swapping the positions of partial characters in the target preset domain name keyword, determining that the to-be-detected domain name has a security risk.

19. The storage medium of claim 18 , wherein the in response to determining that the character pair is not in the similar character pair set, judging whether the target level domain name is obtained by swapping positions of partial characters in the target preset domain name keyword comprises:

in response to determining that the character pair is not in the similar character pair set, judging whether a length of the target level domain name exceeds a preset length; and

in response to determining that the length of the target level domain name exceeds the preset length, judging whether the target level domain name is obtained by swapping the positions of partial characters in the target preset domain name keyword.

20. The storage medium of claim 17 , wherein before the determining that the to-be-detected domain name has a security risk, the method further comprises:

acquiring historical access amount data of the to-be-detected domain name during a past preset period, judging whether the historical access amount data of the to-be-detected domain name during the past preset period exceeds a preset access amount threshold; and

in response to the historical access amount data of the to-be-detected domain name during the past preset period not exceeding the preset access amount threshold, determining that the to-be-detected domain name has the security risk, or

in response to the historical access amount data of the to-be-detected domain name during the past preset time period exceeding the preset access amount threshold, determining that the to-be-detected domain name is a trusted domain name.

Assignments (6)

Priority Claims (1)

Continuity (1)

References Cited (30)