Homograph Attack Research Articles

PhishHunter: Detecting camouflaged IDN-based phishing attacks via Siamese neural network

Phishing is one of the significant threats to cybersecurity today, especially when attackers create Internationalized Domain Names (IDN) homographs to engage in phishing activities. IDN homograph takes advantage of some characters in different native languages in internationalized domain names that look similar to legitimate ones. Although researchers have proposed several enlightening detection methods, most of them focused on detecting typosquatting domain names. The ones focused on IDN homograph attack detection either need to enhance the generalization ability or improve detection performance caused by data imbalance. In this paper, we devised a Generative Adversarial Network with a Gradient Penalty (WGAN-GP) algorithm to solve the data imbalance problem. We transform domain names into images and calculate their similarity by Siamese neural networks. Our work can identify whether a domain name is IDN homograph or not effectively. We use the dataset generated based on Unicode tables, publicly available homograph tools, and the Internet traffic captured from the China Education Research Network backbone (CERNET) to evaluate the performance. Experimental results show that the proposed method improves the accuracy and reduces the false positive rate in detecting homograph domain names. In addition, it can also accurately identify typosquatting in phishing pages.

Overview of phishing landscape and homographs in Arabic domain names

AbstractIn this paper, we summarize the latest social engineering phishing attack types with the focus on domain name manipulation. Providing a fake domain is a crucial part of phishing attacks that can be carried out with different techniques such as cybersquatting, typosquattings, or homographs. We argue that homographs with special International Domain Names can be very serious threat for many users that can hardly be identified. We present the analysis of phishing attacks with Arabic domains and conclude that because of the linguistic complexity of the Arabic language and the missing support by the industrial tools expose millions of users to sophisticated domain manipulation based phishing attacks. To reduce the future risk of homograph attacks originating from Arabic internationalized domain names (IDNs) we suggest a change to the registration policy. We also present a browser extension to assist against homographs in current Arabic IDN namespace.

Adversarial Defense: DGA-Based Botnets and DNS Homographs Detection Through Integrated Deep Learning

Cybercriminals use domain generation algorithms (DGAs) to prevent their servers from being potentially blacklisted or shut down. Existing reverse engineering techniques for DGA detection is labor intensive, extremely time-consuming, prone to human errors, and have significant limitations. Hence, an automated real-time technique with a high detection rate is warranted in such applications. In this article, we present a novel technique to detect randomly generated domain names and domain name system (DNS) homograph attacks without the need for any reverse engineering or using nonexistent domain (NXDomain) inspection using deep learning. We provide an extensive evaluation of our model over four large, real-world, publicly available datasets. We further investigate the robustness of our model against three different adversarial attacks: DeepDGA, CharBot, and MaskDGA. Our evaluation demonstrates that our method is effectively able to identify DNS homograph attacks and DGAs and also is resilient to common evading cyberattacks. Promising results show that our approach provides a more effective detection rate with an accuracy of 0.99. Additionally, the performance of our model is compared against the most popular deep learning architectures. Our findings highlight the essential need for more robust detection models to counter adversarial learning.

Typosquatting for Fun and Profit: Cross-Country Analysis of Pop-Up Scam

Today, many different types of scams can be found on the internet. Online criminals are always finding new creative ways to trick internet users, be it in the form of lottery scams, downloading scam apps for smartphones or fake gambling websites. This paper presents a large-scale study on one particular delivery method of online scam: pop-up scam on typosquatting domains. Typosquatting describes the concept of registering domains which are very similar to existing ones while deliberately containing common typing errors; these domains are then used to trick online users while under the belief of browsing the intended website. Pop-up scam uses JavaScript alert boxes to present a message which attracts the user’s attention very effectively, as they are a blocking user interface element.
 Our study among typosquatting domains derived from the Majestic Million list utilising an Austrian IP address revealed on 1219 distinct typosquatting URLs a total of 2577 pop-up messages, out of which 1538 were malicious. Approximately a third of those distinct URLs (403) were targeted and displayed pop-up messages to one specific HTTP user agent only. Based on our scans, we present an in-depth analysis as well as a detailed classification of different targeting parameters (user agent and language) which triggered varying kinds of pop-up scams. Furthermore, we expound the differences of current pop-up scam characteristics in comparison with a previous scan performed in late 2018 and examine the use of IDN homograph attacks as well as the application of message localisation using additional scans with IP addresses from the United States and Japan.

An intelligent anti-phishing solution: password-transaction secure window

Current phishing attacks cause serious problems to both organisations and users. Phishing attackers try to steal the confidential information of the users such as their username, password etc. Phishing is done either by e-mails or instant messaging or by a spoofed website which is an exact replica of original one. It is very difficult to distinguish fake websites and legitimate websites. Homograph attacks help in phishing and make it more difficult for users to identify them. Some malware like key-loggers also help to steal the crucial information. A different type of malware called transaction generator (TG) is also used by attackers. Instead of passing the confidential information to attackers, a TG waits until users login into their accounts and then does the transaction illegally in the background. In this paper, we present several anti-phishing methods with their pros and cons. In addition, we propose an intelligent anti-phishing solution named Password-Transaction Secure Window (PTSW) in order to secure users and their personal information. The PTSW is a cheap and efficient solution against password and transaction attacks.

The homograph attack

article Share on The homograph attack Authors: Evgeniy Gabrilovich Technion--Israel Institute of Technology Technion--Israel Institute of TechnologyView Profile , Alex Gontmakher Technion--Israel Institute of Technology Technion--Israel Institute of TechnologyView Profile Authors Info & Claims Communications of the ACMVolume 45Issue 2February 2002 https://doi.org/10.1145/503124.503156Online:01 February 2002Publication History 73citation1,106DownloadsMetricsTotal Citations73Total Downloads1,106Last 12 Months140Last 6 weeks8 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteView all FormatsPDF