• 专利附录
  • 专利说明
  • 权利要求
  • 类似技术
  • 同族专利
  • 引用文献
  • 法律状态
  • 优先权
    • 专利摘要:
    The disclosure provides a domain name recognition method and a domain name recognition device (100). The domain name recognition method includes the following steps. A first string of a first domain name and a second string of a second domain name are obtained. Multiple characters of the first string and the second string are classified into multiple clusters (C0, C1, C2, C3). Multiple vectors corresponding to the clusters (C0, C1, C2, C3) are generated, wherein each of the characters corresponds to one of the vectors. A first vector set corresponding to the first string and a second vector set corresponding to the second string are generated. A similarity of the first vector set and the second vector set is calculated.
    公开号:EP3681121A1
    申请号:EP19178790.2
    申请日:2019-06-06
    公开日:2020-07-15
    发明作者:Pin-Cyuan Lin；Yu-Chun Wu；Ming-Kung Sun；Zong-Cyuan Jhang；Yi-Chung Tseng；Chiung-Ying Huang
    申请人:Acer Cyber Security Inc；
    IPC主号:H04L63-00
    专利说明:
    [0001] The disclosure relates to a domain name recognition method and a domain name recognition device, and more particularly to a domain name recognition method and a domain name recognition device capable of recognizing a malicious website. Description of Related Art
    [0002] Many malicious websites design their domain names much like secure websites (for example, google.com) which the user often visits. These malicious websites try to trick the user into providing his or her account and password, so as to access the user's online account. Once the account is successfully accessed, the user's personal data may be used to steal identity, defraud credit card, withdraw bank account deposit, browse the user's e-mails, and even change the password so that the user can no longer log into his or her online account.
    [0003] Although we may detect these malicious websites using certain features (for example, domain name, webpage content, etc.), the degree of alertness varies with each user's understanding of the relative knowledge on information security. Most users often enter malicious websites without knowing, and when obvious abnormality is detected (for example, password being changed), relevant data are often already stolen.
    [0004] In the past, the way to prevent malicious websites is to make use of the data feedbacked by users to sort out a list of suspicious websites. Then, information security experts are invited to carefully examine these websites and finally screen out the actual high-risk websites and blacklist them. However, such a process is very time consuming, causing the inability to update the blacklist in time when new malicious websites appear. In addition, a lot of information security experts are required to be involved in the sorting process, causing wastage of a great amount of human resources. Therefore, how to effectively recognize a malicious website should be a goal for persons skilled in the art to strive for. SUMMARY
    [0005] The disclosure provides a domain name recognition method and a domain name recognition device capable of effectively recognizing a malicious website.
    [0006] The domain name recognition method of the disclosure includes the following steps. A first string of a first domain name and a second string of a second domain name are obtained. Multiple characters of the first string and the second string are classified into multiple clusters, and multiple vectors corresponding to the clusters are generated, wherein each of the characters corresponds to one of the vectors. A first vector set corresponding to the first string and a second vector set corresponding to the second string are generated. A similarity of the first vector set and the second vector set is calculated using an algorithm.
    [0007] In an embodiment of the disclosure, the lengths of the first string and the second string are not necessarily the same.
    [0008] In an embodiment of the disclosure, each of the vectors is a unit vector and different clusters correspond to different vectors.
    [0009] In an embodiment of the disclosure, the algorithm is the dynamic time warping (DTW) algorithm.
    [0010] In an embodiment of the disclosure, the algorithm generates a matrix with dimensions corresponding to the length of the first string and the length of the second string, establishes the shortest distance path from the bottom leftmost element to the top rightmost element in the matrix, calculates the distance of one of the first vector set and one of the second vector set corresponding to each of the elements on the shortest distance path, and calculates the similarity according to the sum of each of the distances on the shortest distance path.
    [0011] In an embodiment of the disclosure, the value of each of the elements of the matrix is the sum of the distance of each of the elements and the smallest value of the value of element of the left element, the bottom element, and the bottom left element of each of the elements. Also, the shortest distance path is generated by selecting the element with the smallest element value in the left element, the bottom element, and the bottom left element of the top rightmost element from the top rightmost element of the matrix.
    [0012] The disclosure provides a domain name recognition device, which includes a processor and a memory coupled to the processor. The processor obtains a first string of a first domain name and a second string of a second domain name; classifies multiple characters of the first string and the second string into multiple clusters and generates multiple vectors corresponding to the clusters, wherein each of the characters corresponds to one of the vectors; generates a first vector set corresponding to the first string and a second vector set corresponding to the second string; and calculates a similarity of the first vector set and the second vector set using an algorithm.
    [0013] In an embodiment of the disclosure, the lengths of the first string and the second string are not necessarily the same.
    [0014] In an embodiment of the disclosure, each of the vectors is a unit vector and different clusters correspond to different vectors.
    [0015] In an embodiment of the disclosure, the algorithm is the DTW algorithm.
    [0016] In an embodiment of the disclosure, the algorithm generates a matrix with dimensions corresponding to the length of the first string and the length of the second string, establishes the shortest distance path of the bottom leftmost element to the top rightmost element in the matrix, calculates the distance of one of the first vector set and one of the second vector set corresponding to each of the elements on the shortest distance path, and calculates the similarity according to the sum of each of the distances on the shortest distance path.
    [0017] In an embodiment of the disclosure, the value of each of the elements of the matrix is the sum of the distance of each of the elements and the smallest value of the value of element of the left element, the bottom element, and the bottom left element of each of the elements. Also, the shortest distance path is generated by selecting the element with the smallest element value in the left element, the bottom element, and the bottom left element of the top rightmost element from the top rightmost element of the matrix.
    [0018] Based on the above, the domain name recognition method and the domain name recognition device of the disclosure divide the characters of the domain name into multiple clusters and generate multiple vectors corresponding to the clusters, and further generate vector sets of the two domain names. Finally, the similarity of the two vector sets corresponding to the two domain names is calculated.
    [0019] To make the aforementioned and other features of the disclosure more comprehensible, several embodiments accompanied with drawings are described in detail as follows. BRIEF DESCRIPTION OF THE DRAWINGS
    [0020] FIG. 1 is a block diagram of a domain name recognition device according to an embodiment of the disclosure. FIG. 2 is a schematic diagram of clusters corresponding to vectors according to an embodiment of the disclosure. FIG. 3A to FIG. 3C are examples of calculating a similarity of two strings according to an embodiment of the disclosure. FIG. 4 is a flowchart of a domain name recognition method according to an embodiment of the disclosure. DETAILED DESCRIPTION OF DISCLOSED EMBODIMENTS
    [0021] In an embodiment, the Euclidean distance, the Hamming distance, the Edit distance, and the Cosine similarity may be used to perform the sequence similarity calculation. The Euclidean distance and the Hamming distance limit that the lengths of the two string vectors to be compared must be the same. However, in the context of domain name comparison, the lengths of various domain names are not the same most of the time. The Edit distance compares the similarity between two strings by calculating the minimum number of edit(s) required to convert one string into the other string. However, the minimum number of edit(s) does not effectively reflect the similarity of the domain names (for example, the minimum number of edit to convert "google" into "oogle" is 1 while the minimum number of edits to convert "google" into "gOOgle" is 3, but in fact the latter is a malicious website relatively more difficult to be detected by the user). The Cosine similarity requires the two strings to be first converted into the same length through a specific vectorization method. However, the intermediate process during vectorization may easily cause the order of the domain names to be distorted.
    [0022] FIG. 1 is a block diagram of a domain name recognition device according to an embodiment of the disclosure.
    [0023] Referring to FIG. 1, a domain name recognition device 100 according to an embodiment of the disclosure includes a processor 110 and a memory 120 coupled to the processor 110. The processor 110 is, for example, a central processing unit (CPU), other programmable general purpose or special purpose microprocessor, a digital signal processor (DSP), a programmable controller, an application specific integrated circuit (ASIC), other similar component, or a combination of the above components. The memory 120 is, for example, any form of fixed or movable random-access memory (RAM), a read-only memory (ROM), a flash memory, a hard disk drive (HDD), a solid-state drive (SSD), other similar component, or a combination of the above components. The domain name recognition device 100 may be an electronic device such as a personal computer, a server, a notebook computer, a tablet computer, or a smart phone.
    [0024] In an embodiment, the processor 110 can find a malicious website disguised as a normal secure website by comparing the domain names and assist the user in detecting that he or she has been directed into a high-risk website before the user is victimized. Specifically, when a list of secure domain names (for example, a list of domain names of 500 global websites or a white list) is given, the processor 110 can compare the similarity between the string of domain name of a specific website and the strings of domain names of the whitelist before the user enters the specific website. If the similarity between the string of domain name of the specific website and the strings of domain names of the whitelist is too high, but the domain name of the specific website is not a domain name in the whitelist, the processor 110 can generate a warning notification to the user to alert the user that the website being visited may be a malicious website.
    [0025] In an embodiment, the processor 110 can classify characters in the string of domain name into multiple clusters. Multiple characters, which may be mistaken from one another by human eye, may be included in each of the clusters. Table 1 is an example of classifying characters into multiple clusters and Table 1 can be recorded in the memory 120. Table 1 Cluster Character C0 other symbols C1 o, 0 C2 p, q, g, 9 C3 i, l, j, 1
    [0026] Taking goo.gl as an example, each of the characters of goo.gl will be converted into the following code under the above classification:g o o . g l C2 C1 C1 C0 C2 C3
    [0027] In addition, each of the clusters can also correspond to a unit vector, as shown in FIG. 2. In the above example, there are 4 clusters, so the unit vector corresponding to each of the clusters has 4 elements and the unit vectors corresponding to each of the clusters do not overlap with one other.
    [0028] The following will illustrate how to compare the similarity of strings of two domain names.
    [0029] FIG. 3A to FIG. 3C are examples of calculating similarity of two strings according to an embodiment of the disclosure.
    [0030] Referring to FIG. 3A, for ease of understanding, the lengths of the first string and the second string are respectively assumed to be 3 and 2; a first character, a second character, and a third character of the first string are respectively classified into clusters C0, C1 and C2; and a first character and a second character of the second string are respectively classified into clusters C1 and C2. It is worth noting that in the examples of FIG. 3A to FIG. 3C, the number of clusters is three (i.e. C0, C1, and C2). The processor 110 can perform the following operations based on the DTW algorithm.
    [0031] In particular, the processor 110 can generate a matrix 300 with dimensions corresponding to the lengths of the first string and the second string (i.e. a 2x3 matrix). In the matrix 300, each of the element values is calculated by calculating the distance of two vectors corresponding to each of the elements plus the smallest value in the left element, the bottom element, and the bottom left element of the element. For example, since an element 301 does not have a left element, a bottom element, and a bottom left element, the value of the element 301 is the distance 2 of C1 and C0 (the distance of two clusters is the sum of absolute value of subtraction of all corresponding elements of the two clusters). The value of an element 302 is the sum 2 of the distance 0 of C1 and C1 plus the left element value 2 of the element 302, as the element 302 does not have a bottom element and a bottom left element. Since the smallest value of a left element 304, the bottom element 302, and the bottom left element 301 of an element 303 is 2, and the distance of C1 and C2 corresponding to the element 303 is 2, the value of the element 303 is 2 plus 2 equals to 4. The values of other elements may be deduced so on and so forth.
    [0032] Referring to FIG. 3B, after calculating the values of all of the elements in the matrix 300, the processor 110 establishes the shortest distance path of the bottom leftmost element to the top rightmost element in the matrix. For example, the processor 110 finds the element 302 having the smallest value in the left element, the bottom element, and the bottom left element of the element 305 based on the element 305, and finds the element 301 having the smallest value in the left element, the bottom element, and the bottom left element of the element 302 (the element 302 does not have a bottom element and a bottom left element, so the element 301 is directly found). Therefore, the element 301, the element 302, and the element 305 form the shortest distance path of the matrix 300.
    [0033] Referring to FIG. 3C, the processor 110 recalculates the distance of two clusters corresponding to all of the elements on the shortest distance path. For example, the value of the element 301 is recalculated as the distance 2 of C0 and C1, the value of the element 302 is recalculated as the distance 0 of C1 and C1, and the value of the element 305 is recalculated as the distance 0 of C2 and C2.
    [0034] Finally, processor 110 sums up the recalculated values of all of the elements on the shortest distance path and divides by the sum of lengths of the first string and the second string to obtain a final value. For example, the final value = (2+0+0) / (2+3) = 0.4. The smaller the final value, the higher the similarity of the two strings. Therefore, the processor 110 can issue a warning notification to alert the user when the final value above is less than a threshold value.
    [0035] FIG. 4 is a flowchart of a domain name recognition method according to an embodiment of the disclosure.
    [0036] Referring to FIG. 4, in Step S401, a first string of a first domain name and a second string of a second domain name are obtained.
    [0037] In Step S402, multiple characters of the first string and the second string are classified into multiple clusters, and multiple vectors corresponding to the clusters are generated, wherein each of the characters corresponds to one of the vectors.
    [0038] In Step S403, a first vector set corresponding to the first string and a second vector set corresponding to the second string are generated.
    [0039] In Step S404, a similarity of the first vector set and the second vector set is calculated using an algorithm.
    [0040] In summary, the domain name recognition method and the domain name recognition device of the disclosure divide the characters of the domain name into multiple clusters and generate multiple vectors corresponding to the clusters, and further generate vector sets of the two domain names. Finally, the similarity of the two vector sets corresponding to the two domain names is calculated. When the similarity is too high, a warning notification can be issued to alert the user. The disclosure adopts the DTW algorithm for comparing the similarity of the strings. Since the algorithm is designed based on dynamic programming, the time taken for comparison can be significantly reduced. In addition, the method of the disclosure relative to the blacklist of domain names may also prevent the situation whereby the blacklist is generated after the user has been victimized from happening.
    权利要求:
    Claims (12)
    [0001] A domain name recognition method, comprising:
    obtaining a first string of a first domain name and a second string of a second domain name;
    classifying a plurality of characters of the first string and the second string into a plurality of clusters (C0, C1, C2, C3), and generating a plurality of vectors corresponding to the plurality of clusters (C0, C1, C2, C3), wherein each of the plurality of characters corresponds to one of the plurality of vectors;
    generating a first vector set corresponding to the first string and a second vector set corresponding to the second string; and
    calculating a similarity between the first vector set and the second vector set using an algorithm.
    [0002] The domain name recognition method according to claim 1, wherein lengths of the first string and the second string are not necessarily the same.
    [0003] The domain name recognition method according to claim 1 or 2, wherein each of the plurality of vectors is a unit vector and different ones of the clusters (C0, C1, C2, C3) correspond to different ones of the vectors.
    [0004] The domain name recognition method according to any one of claim 1 to 3, wherein the algorithm is a dynamic time warping (DTW) algorithm.
    [0005] The domain name recognition method according to any one of claim 1 to 4, wherein the algorithm generates a matrix (300) corresponding to a length of the first string and a length of the second string, establishes a shortest distance path of a bottom leftmost element (301) to a top rightmost element (305) in the matrix (300), calculates a distance of one of the first vector sets on and one of the second vector sets corresponding to each of the elements on the shortest distance path, and calculates a similarity according to a sum of each of the distances on the shortest distance path.
    [0006] The domain name recognition method according to claim 5, wherein a value of each of the elements of the matrix (300) is a sum of the distance of each of the elements plus a smallest value of a value of an element of a left element, a bottom element, and a bottom left element of each of the elements, and the shortest distance path is generated by selecting an element with a smallest element value in the left element, the bottom element, and the bottom left element of the top rightmost element from the top rightmost element of the matrix (300).
    [0007] A domain name recognition device (100), comprising:
    a processor (110); and
    a memory (120) coupled to the processor (110), wherein the processor (110)
    obtains a first string of a first domain name and a second string of a second domain name;
    classifies a plurality of characters of the first string and the second string into a plurality of clusters (C0, C1, C2, C3), and generates a plurality of vectors corresponding to the plurality of clusters (C0, C1, C2, C3), wherein each of the plurality of characters corresponds to one of the plurality of vectors;
    generates a first vector set corresponding to the first string and a second vector set corresponding to the second string; and
    calculates a similarity between the first vector set and the second vector set using an algorithm.
    [0008] The domain name recognition device according to claim 7, wherein lengths of the first string and the second string are not necessarily the same.
    [0009] The domain name recognition device according to claim 7 or 8, wherein each of the plurality of vectors is a unit vector and different ones of the clusters (C0, C1, C2, C3) correspond to different ones of the vectors.
    [0010] The domain name recognition device according to any one of claim 7 to 9, wherein the algorithm is a DTW algorithm.
    [0011] The domain name recognition device according to any one of claim 7 to 10, wherein the algorithm generates a matrix (300) corresponding to a length of the first string and a length of the second string, establishes a shortest distance path of a bottom leftmost element (301) to a top rightmost element (305) in the matrix (300), calculates a distance of one of the first vector sets on and one of the second vector sets corresponding to each of the elements on the shortest distance path, and calculates a similarity according to a sum of each of the distances on the shortest distance path.
    [0012] The domain name recognition device according to claim 11, wherein a value of each of the elements of the matrix (300) is a sum of the distance of each of the elements plus a smallest value of a value of an element of a left element, a bottom element, and a bottom left element of each of the elements, and the shortest distance path is generated by selecting an element with a smallest element value in the left element, the bottom element, and the bottom left element of the top rightmost element from the top rightmost element of the matrix (300).
    类似技术:
    公开号 | 公开日 | 专利标题
    JP6651565B2|2020-02-19|Biometric template security and key generation
    Bahnsen et al.2017|Classifying phishing URLs using recurrent neural networks
    US20180121640A1|2018-05-03|System, device, and method of secure utilization of fingerprints for user authentication
    CN104217160B|2017-11-28|A kind of Chinese detection method for phishing site and system
    US10270779B2|2019-04-23|Method and apparatus for determining phishing website
    US10185813B2|2019-01-22|Orientation aware authentication on mobile platforms
    US10554805B2|2020-02-04|Information processing method, terminal, and computer-readable storage medium
    US9195777B2|2015-11-24|System, method and computer program product for normalizing data obtained from a plurality of social networks
    US20160269411A1|2016-09-15|System and Method for Anonymous Biometric Access Control
    US9659158B2|2017-05-23|Technologies for determining confidence of user authentication
    US10320819B2|2019-06-11|Intelligent security management
    US9727734B2|2017-08-08|Customizing a security report using static analysis
    US8621616B2|2013-12-31|Method and system for identifying suspected phishing websites
    US8205255B2|2012-06-19|Anti-content spoofing |
    US20200012792A1|2020-01-09|System and method for statistical analysis of comparative entropy
    Afroz et al.2011|Phishzoo: Detecting phishing websites by looking at them
    US9027134B2|2015-05-05|Social threat scoring
    US20180227375A1|2018-08-09|System and method for continuously monitoring and searching social networking media
    US7581245B2|2009-08-25|Technique for evaluating computer system passwords
    US9870464B1|2018-01-16|Compromised authentication information clearing house
    US8402548B1|2013-03-19|Providing user confidence information to third-party systems
    KR102088553B1|2020-03-13|Method and apparatus of detecting weak password
    JP2017515220A|2017-06-08|Method, apparatus, and system for managing user accounts when login names conflict
    US9779236B2|2017-10-03|Risk assessment modeling
    US9674214B2|2017-06-06|Social network profile data removal
    同族专利:
    公开号 | 公开日
    TW202026904A|2020-07-16|
    US10931714B2|2021-02-23|
    US20200220897A1|2020-07-09|
    引用文献:
    公开号 | 申请日 | 公开日 | 申请人 | 专利标题
    法律状态:
    2020-06-12| PUAI| Public reference made under article 153(3) epc to a published international application that has entered the european phase|Free format text: ORIGINAL CODE: 0009012 |
    2020-06-12| STAA| Information on the status of an ep patent application or granted ep patent|Free format text: STATUS: THE APPLICATION HAS BEEN PUBLISHED |
    2020-07-15| AX| Request for extension of the european patent|Extension state: BA ME |
    2020-07-15| AK| Designated contracting states|Kind code of ref document: A1 Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR |
    2020-08-07| STAA| Information on the status of an ep patent application or granted ep patent|Free format text: STATUS: REQUEST FOR EXAMINATION WAS MADE |
    2020-09-09| 17P| Request for examination filed|Effective date: 20200730 |
    2020-09-09| RBV| Designated contracting states (corrected)|Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR |
    2021-10-29| STAA| Information on the status of an ep patent application or granted ep patent|Free format text: STATUS: EXAMINATION IS IN PROGRESS |
    2021-12-01| 17Q| First examination report despatched|Effective date: 20211028 |
    优先权:
    申请号 | 申请日 | 专利标题
    [返回顶部]