Detecting a homoglyph in a string of characters

Patent metadata

Field	Value
Publication number	US-12586398-B2
Application number	US-202318300016-A
Country	US
Kind code	B2
Filing date	Apr 13, 2023
Priority date	Apr 13, 2023
Publication date	Mar 24, 2026
Grant date	Mar 24, 2026

Abstract

A method for detecting a homoglyph in an input text includes receiving a first string of characters and deobfuscating the first string of characters to generate a second string of characters. When at least one character from the first string of characters has replaced another character in the second string of characters based on the deobfuscating, the method further includes determining a visual similarity value based on the first string of characters and the second string of characters and providing an indication whether a homoglyph is present in the first string of characters, based on the visual similarity value.

First claim

What is claimed is:

1 . A computer-implemented method, comprising:
receiving, by a computing system comprising one or more processors, an electronic communication including a first string of characters; deobfuscating the first string of characters to generate a second string of characters; when at least one character from the first string of characters has replaced another character in the second string of characters based on the deobfuscating, determining a visual similarity value based on a weighted sum of a first visual similarity value and a second visual similarity value by:
rendering the first string of characters to obtain a first image,
rendering the second string of characters to obtain a second image,
determining a number of pixels which are different between the first image and the second image to obtain the first visual similarity value, and
measuring a structural similarity between the first image and the second image based on luminance, contrast, and structural characteristics of the first image and the second image, to obtain the second visual similarity value; and
based on the visual similarity value indicating a homoglyph is present in the first string of characters, controlling a computing resource to take remedial action with respect to the electronic communication to improve security associated with the computing system.

2 . The computer-implemented method of claim 1 , wherein controlling the computing resource comprises controlling the computing resource to monitor a source of the homoglyph which transmits or provides content that includes the first string of characters.

3 . The computer-implemented method of claim 2 , the method further comprising:
applying a convolutional filter to the first image and the second image to obtain a first feature map corresponding to the first image and a second feature map corresponding to the second image; and the visual similarity value is further based on a distance metric between first feature vectors associated with the first feature map and second feature vectors associated with the second feature map.

4 . The computer-implemented method of claim 3 , wherein
the first image and the second image are rendered in a same font, and the method further comprises determining the homoglyph is present in the first string of characters when the visual similarity value is greater than a first threshold value and less than a second threshold value.

5 . The computer-implemented method of claim 1 , wherein controlling the computing resource comprises controlling the computing resource to update a deobfuscation library by identifying, based on the homoglyph, new visually-similar characters to add to mappings stored by the deobfuscation library.

6 . The computer-implemented method of claim 1 , wherein controlling the computing resource comprises controlling the computing resource to moderate content relating to the electronic communication which includes the first string of characters.

7 . The computer-implemented method of claim 1 , wherein the first image and the second image are rendered in a same font.

8 . The computer-implemented method of claim 1 , further comprising determining the homoglyph is present in the first string of characters when the visual similarity value is greater than a first threshold value and less than a second threshold value.

9 . The computer-implemented method of claim 1 , wherein the visual similarity value is further based on a number of characters from the first string of characters which have replaced another character in the second string of characters based on the deobfuscating.

10 . The computer-implemented method of claim 1 , wherein
based on the visual similarity value indicating the homoglyph is present in the first string of characters, the method further comprises at least one of:
providing a notification indicating the first string of characters includes the homoglyph,
classifying the electronic communication as spam or unsolicited, or
removing the first string of characters from the electronic communication.

11 . The computer-implemented method of claim 1 , wherein
the first string of characters is an input to a messaging platform, and based on the visual similarity value indicating the homoglyph is present in the first string of characters, controlling the computing resource comprises preventing the first string of characters from being presented on the messaging platform or removing the first string of characters from the messaging platform.

12 . The computer-implemented method of claim 1 , wherein
deobfuscating the first string of characters to generate the second string of characters comprises applying a mapping to each character from among the first string of characters to generate the second string of characters, and the method further comprises determining whether at least one character from among the first string of characters has replaced another character from among the second string of characters based on whether the mapping indicates at least one character from among the first string of characters is a substitute for another character from among the second string of characters.

13 . The computer-implemented method of claim 1 , further comprising:
applying an optical character recognition (OCR) process to the first image to obtain a first OCR string of characters and to the second image to obtain a second OCR string of characters; and calculating a Hamming distance between the first OCR string of characters and the second OCR string of characters, and wherein the visual similarity value is further based on the Hamming distance between the first OCR string of characters and the second OCR string of characters.

14 . The computer-implemented method of claim 13 , wherein
the first image and the second image are rendered in a same font, and the method further comprises determining the homoglyph is present in the first string of characters when the visual similarity value is greater than a first threshold value and less than a second threshold value.

15 . A computing system, comprising:
one or more processors; and one or more non-transitory computer-readable media that store instructions that, when executed by the one or more processors, cause the computing system to perform operations, the operations comprising:
receiving an electronic communication including a first string of characters,
deobfuscating the first string of characters to generate a second string of characters,
when at least one character from the first string of characters has replaced another character in the second string of characters based on the deobfuscating, determining a visual similarity value based on a weighted sum of a first visual similarity value and a second visual similarity value by:
rendering the first string of characters to obtain a first image,
rendering the second string of characters to obtain a second image,
determining a number of pixels which are different between the first image and the second image to obtain the first visual similarity value, and
measuring a structural similarity between the first image and the second image based on luminance, contrast, and structural characteristics of the first image and the second image, to obtain the second visual similarity value, and

based on the visual similarity value indicating a homoglyph is present in the first string of characters, controlling a computing resource to take remedial action with respect to the electronic communication to improve security associated with the computing system.

Assignees

• Google Llc

Inventors

• Brown Aaron Michael
• Kovuri Pranoy
• Macdermed Liam Charles

Classifications

• G06V30/19013

  Comparing pixel values or logical combinations thereof, or feature values having positional relevance, e.g. template matching (specially adapted for image segmentation G06T7/10; specially adapted for the analysis of motion G06T7/20; specially adapted for image alignment G06T7/30; specially adapted for the calculation of depth from stereo images G06T7/50; specially adapted for position determination G06T7/70) · CPC title

• G06F40/284

  Lexical analysis, e.g. tokenisation or collocates · CPC title

• G06F21/561

  Virus type analysis · CPC title

• G06F21/554

  involving event detection and direct action · CPC title

• G06V30/19093 Primary

  Proximity measures, i.e. similarity or distance measures · CPC title