VizCheck: Enhancing Phishing Attack Detection through Visual Domain Name Homograph Analysis
Hafidh Zouahi, Chamseddine Talhi, Oussama Boudar · 2024
Phishing attacks are still one of the most devastating attacks in the cybersecurity landscape. These malicious schemes continue to threaten individuals, organizations, and even governments worldwide. Internationalized Domain Names (IDNs) made this problem even worse by allowing non-ASCII characters to be used in domain names, giving rise to domain homograph attacks, which are a type of phishing campaign where attackers trick the victims into trusting a domain name that looks visually indistinguishable from its legitimate counterpart. These domain names can be leveraged to send phishing emails seemingly coming from legitimate entities (e.g., [email protected], where the character is the Cyrillic character with the code point U+0430) to harvest credentials, or to get a foothold into an organization’s infrastructure by sending a malicious file attachment seemingly coming from a colleague, as carried out by various notorious Advanced Persistent Threat (APT) groups, allowing the threat actors to further damage the infrastructure by moving laterally inside the network. In this paper, we present a novel approach for detecting domain homograph attacks using computer vision and deep learning techniques. Our system takes two domain names as input and outputs a visual similarity score that gets translated into a class label (legitimate or homograph). Furthermore, we provide a comprehensive dataset for training and evaluation, along with detailed steps for its generation, facilitating reproducibility of our results by the research community. The proposed model achieved both a high accuracy, with a low False Positive Rate (FPR) and a low False Negative Rate (FNR). These results highlight the efficacy of our approach in accurately identifying homograph domains. We provide insights on how to apply this approach in a real world case scenario, in order to protect companies from phishing attacks.