Visual domain detection systems and methods

Patent metadata

Field	Value
Publication number	US-12347212-B2
Application number	US-202318153835-A
Country	US
Kind code	B2
Filing date	Jan 12, 2023
Priority date	Feb 10, 2017
Publication date	Jul 1, 2025
Grant date	Jul 1, 2025

Abstract

Disclosed is an effective domain name defense solution in which a domain name string may be provided to or obtained by a computer embodying a visual domain analyzer. The domain name string may be rendered or otherwise converted to an image. An optical character recognition function may be applied to the image to read out a text string which can then be compared with a protected domain name to determine whether the text string generated by the optical character recognition function from the image converted from the domain name string is similar to or matches the protected domain name. This visual domain analysis can be dynamically applied in an online process or proactively applied in an offline process to hundreds of millions of domain names.

First claim

What is claimed is:

1. A method for generating a set of candidate domains that are determined by a computer to be visually similar to a seed domain name, comprising:
obtaining, by a computer, a seed text string for the seed domain name; obtaining, by the computer, a set of domain names;
for each domain name in the set of domain names:
obtaining, by the computer, an image of the domain name;
converting, by the computer, the image into a domain name text string;
determining, by the computer, a string similarity measure between the domain name text string and the seed text string;
determining, by the computer based at least on the string similarity measure, whether the domain name text string is visually similar to the seed text string;
responsive to the domain name text string being determined as visually similar to the seed text string, identifying the domain name as a candidate domain; and
providing a list of the candidate domains.

2. The method according to claim 1 , wherein whether the domain name text string is visually similar to the seed text string is further determined based at least on a security policy.

3. The method according to claim 2 , wherein the security policy is defined by at least one of an anti-phishing rule, a brand protection rule, or a domain detection rule.

4. The method according to claim 1 , wherein the determining the distance further comprises calculating an edit distance, an n-gram distance, or a bigram distance between the domain name text string and the seed text string.

5. The method according to claim 1 , wherein obtaining the set of domain names comprises applying at least one first pass filter to a superset of domain names to determine corresponding closeness measures, wherein ones of the domain names in the superset of domain names that meet a closeness requirement of the at least one first pass filter are identified as the set of domain names.

6. The method according to claim 1 , wherein the domain name is one of a plurality of domain names obtained from the data source, wherein each of the plurality of domain names is converted into a corresponding image, wherein the corresponding image is converted into a corresponding text string, wherein the corresponding text string is compared with the seed text string in determining whether the corresponding text string is visually similar to the seed text string, and wherein any of the plurality of domain names having a corresponding text string determined as visually similar to the seed text string is identified as a candidate domain.

7. The method according to claim 6 , further comprising:
generating a list of candidate domains from the plurality of domain names, wherein each of the candidate domains has a corresponding text string that has been programmatically determined as visually similar to the seed text string.

8. A system for generating a set of candidate domains that are determined to be visually similar to a seed domain name, comprising:
a processor;
a non-transitory computer-readable medium; and
stored instructions translatable by the processor for:
obtaining a seed text string;
obtaining a set of domain names;
for each domain name in the set of domain names:
obtaining an image of the domain name;
converting the image into a domain name text string;
determining a string similarity measure between the domain name text string and the seed text string;
determining, based at least on the string similarity measure, whether the domain name text string is visually similar to the seed text string;
responsive to the domain name text string being determined as visually similar to the seed text string, identifying the domain name as a candidate domain; and

providing a list of the candidate domains.

9. The system of claim 8 , wherein whether the domain name text string is visually similar to the seed text string is further determined based at least on a security policy.

10. The system of claim 9 , wherein the security policy is defined by at least one of an anti-phishing rule, a brand protection rule, or a domain detection rule.

11. The system of claim 8 , wherein the determining the distance further comprises calculating an edit distance, an n-gram distance, or a bigram distance between the domain name text string and the seed text string.

12. The system of claim 8 , wherein obtaining the set of domain names comprises applying at least one first pass filter to a superset of domain names to determine corresponding closeness measures, wherein ones of the domain names in the superset of domain names that meet a closeness requirement of the at least one first pass filter are identified as the set of domain names.

13. The system of claim 8 , wherein the domain name is one of a plurality of domain names obtained from the data source, wherein each of the plurality of domain names is converted into a corresponding image, wherein the corresponding image is converted into a corresponding text string, wherein the corresponding text string is compared with the seed text string in determining whether the corresponding text string is visually similar to the seed text string, and wherein any of the plurality of domain names having a corresponding text string determined as visually similar to the seed text string is identified as a candidate domain.

14. The system of claim 13 , wherein the stored instructions are further translatable by the processor for:
generating a list of candidate domains from the plurality of domain names, wherein each of the candidate domains has a corresponding text string that has been programmatically determined as visually similar to the seed text string.

15. A computer program product for generating a set of candidate domains that are determined to be visually similar to a seed domain name comprising a non-transitory computer-readable medium storing instructions translatable by a processor for:
obtaining a seed text string;
obtaining a set of domain names;
for each domain name in the set of domain names:
obtaining an image of the domain name;
converting the image into a domain name text string;
determining a string similarity measure between the domain name text string and the seed text string;
determining, based at least on the string similarity measure, whether the domain name text string is visually similar to the seed text string;
responsive to the domain name text string being determined as visually similar to the seed text string, identifying the domain name as a candidate domain; and

providing a list of the candidate domains.

16. The computer program product of claim 15 , wherein whether the domain name text string is visually similar to the seed text string is further determined based at least on a security policy.

17. The computer program product of claim 16 , wherein the security policy is defined by at least one of an anti-phishing rule, a brand protection rule, or a domain detection rule.

18. The computer program product of claim 15 , wherein the determining the distance further comprises calculating an edit distance, an n-gram distance, or a bigram distance between the domain name text string and the seed text string.

19. The computer program product of claim 15 , wherein obtaining the set of domain names comprises applying at least one first pass filter to a superset of domain names to determine corresponding closeness measures, wherein ones of the domain names in the superset of domain names that meet a closeness requirement of the at least one first pass filter are identified as the set of

Assignees

• Proofpoint Inc

Inventors

• Dalal Gaurav Mitesh
• Mesdaq Ali
• Huffner Sharon
• Nguyen Harold

Classifications

• G06V10/751

  Comparing pixel values or logical combinations thereof, or feature values having positional relevance, e.g. template matching · CPC title

• G06V30/10

  Character recognition · CPC title

• G06F18/22

  Matching criteria, e.g. proximity measures · CPC title

• H04L61/4511

  using domain name system [DNS] · CPC title

• G06V30/153

  using recognition of characters or words · CPC title