Visual domain detection systems and methods

Patent metadata

Field	Value
Publication number	US-10679088-B1
Application number	US-201715430158-A
Country	US
Kind code	B1
Filing date	Feb 10, 2017
Priority date	Feb 10, 2017
Publication date	Jun 9, 2020
Grant date	Jun 9, 2020

Abstract

Disclosed is an effective domain name defense solution in which a domain name string may be provided to or obtained by a computer embodying a visual domain analyzer. The domain name string may be rendered or otherwise converted to an image. An optical character recognition function may be applied to the image to read out a text string which can then be compared with a protected domain name to determine whether the text string generated by the optical character recognition function from the image converted from the domain name string is similar to or matches the protected domain name. This visual domain analysis can be dynamically applied in an online process or proactively applied in an offline process to hundreds of millions of domain names.

First claim

What is claimed is:

1. A method for visual domain detection, comprising:
obtaining, by a computer, a domain name string, the domain name string collected or generated by a data source over a network, the computer comprising at least one processor and at least one non-transitory computer-readable medium;
converting, by the computer, the domain name string for visual domain detection processing, the converting comprising:
determining whether to decode the domain name string based on a format of the domain name string;
responsive to a determination to decode the domain name string, decoding the domain name string into binary characters; and
rendering the binary characters as an image;

applying, by the computer, an optical character recognition (OCR) function to the image, the applying the OCR function to the image generating a text string that is a domain name set of characters;
comparing, by the computer, the text string generated by the OCR function with a protected domain name;
determining, by the computer utilizing a string similarity measure, whether the text string generated by the OCR function from the image converted from the domain name string is similar to or matches the protected domain name, the string similarity measure comprising a bigram distance between the domain name string and the protected domain name; and
communicating, by the computer, a result from the determining to a computing device over the network.

2. The method according to claim 1 , wherein the computer determines prior to the converting whether the domain name string is an internationalized domain name.

3. The method according to claim 2 , wherein the computer determines whether the domain name string is an internationalized domain name by parsing the domain name string and determining whether an ASCII representation consisting of a prefix is present in the domain name string.

4. The method according to claim 3 , wherein the prefix comprises “xn--”.

5. The method according to claim 2 , wherein the computer decodes the internationalized domain name into binary characters, and wherein the computer renders the binary characters into an image file utilizing a draw function.

6. The method according to claim 5 , wherein the binary characters are in UTF8 format.

7. The method according to claim 1 , further comprising:
determining, based on one or more words in the text string, whether the domain name string belongs to same product or service vertical on the Internet as the protected domain name; and
responsive to the domain name string and the protected domain name belonging to the same product or service vertical on the Internet, providing the domain name string to a rules engine for analysis.

8. A system for visual domain detection, comprising:
a computer embodying a visual domain analyzer, the computer comprising at least one processor and at least one non-transitory computer-readable medium storing instructions translatable by the at least one processor to perform:
obtaining a domain name string, the domain name string collected or generated by a data source over a network;
converting the domain name string for visual domain detection processing, the converting comprising:
determining whether to decode the domain name string based on a format of the domain name string;
responsive to a determination to decode the domain name string, decoding the domain name string into binary characters; and
rendering the binary characters as an image;

applying an optical character recognition function (OCR) to the image, the applying the OCR function to the image generating a text string that is a domain name set of characters;
comparing the text string generated by the OCR function with a protected domain name;
determining, utilizing a string similarity measure, whether the text string generated by the OCR function from the image converted from the domain name string is similar to or matches the protected domain name, the string similarity measure comprising a bigram distance between the domain name string and the protected domain name; and
communicating a result from the determining to a computing device over the network.

9. The system of claim 8 , wherein the instructions are further translatable by the at least one processor to determine prior to the converting whether the domain name string is an internationalized domain name.

10. The system of claim 9 , wherein the instructions are further translatable by the at least one processor to determine whether the domain name string is an internationalized domain name by parsing the domain name string and determining whether an ASCII representation consisting of a prefix is present in the domain name string.

11. The system of claim 10 , wherein the prefix comprises “xn--”.

12. The system of claim 9 , wherein the instructions are further translatable by the at least one processor to decode the internationalized domain name into binary characters, and wherein the instructions are further translatable by the at least one processor to render the binary characters into an image file utilizing a draw function.

13. The system of claim 12 , wherein the binary characters are in UTF8 format.

14. The system of claim 8 , wherein the instructions are further translatable by the at least one processor for:
determining, based on one or more words in the text string, whether the domain name string belongs to same product or service vertical on the Internet as the protected domain name; and
responsive to the domain name string and the protected domain name belonging to the same product or service vertical on the Internet, providing the domain name string to a rules engine for analysis.

15. A computer program product for visual domain detection, the computer program product comprising at least one non-transitory computer-readable medium storing instructions translatable by at least one processor to perform:
obtaining a domain name string, the domain name string collected or generated by a data source over a network;
converting the domain name string for visual domain detection processing, the converting comprising:
determining whether to decode the domain name string based on a format of the domain name string;
responsive to a determination to decode the domain name string, decoding the domain name string into binary characters; and
rendering the binary characters as an image;

applying an optical character recognition function (OCR) to the image, the applying the OCR function to the image generating a text string that is a domain name set of characters;
comparing the text string generated by the OCR function with a protected domain name;
determining, utilizing a string similarity measure, whether the text string generated by the OCR function from the image converted from the domain name string is similar to or matches the protected domain name, the string similarity measure comprising a bigram distance between the domain name string and the protected domain name; and
communicating a result from the determining to a computing device over the network.

16. The computer program product of claim 15 , wherein the instructions are further translatable by the at least one processor to determine prior to the converting whether the domain name string is an internationalized domain name.

17. The computer program product of claim 16 , wherein the instructions are further translatable by the at least one processor to determine whether the domain name string is an internationalized domain name by parsing the domain name string and determining whether an ASCII re

Assignees

• Proofpoint Inc

Inventors

• Dalal Gaurav Mitesh
• Mesdaq Ali
• Huffner Sharon
• Nguyen Harold

Classifications

• G06K9/6202

  Physics · mapped topic

• H04L61/1511

  Electricity · mapped topic

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• G06K9/344 Primary

  Physics · mapped topic

• G06K9/6215

  Physics · mapped topic