Detection of attacks using homograph DNS names
Tiago Marques Pais · Portuguese National Funding Agency for Science, Research and Technology (RCAAP Project by FCT) · 2024
With the growing number of cyber-attacks in today’s digital landscape, there is an urgent need for effective protection measures to safeguard individuals and organizations against evolving threats. Phishing remains a major security threat in cyberspace. In phishing, attackers steal critical information from victims by presenting a fake website. The Domain Name System (DNS) is a crucial component of today’s IP networks, as it is the standard name resolution mechanism for addresses. Typosquatting stands out as an attack that targets user errors, where malicious actors exploit user mistakes by registering domains with minor spelling alterations of legitimate names, tricking them. Similarly, homograph attacks using internationalized DNS names (IDN) represent a significant threat, taking advantage of internationalized domain names to create visually similar but deceptive DNS names by exploiting the nuances of different character sets to deceive users. To mitigate these attacks, we propose a tool designed to detect and prevent such malicious activities. This tool uses a server with a SOCKS5 interface to analyze user-generated traffic in a browser. To identify typosquatting, algorithms and word comparison metrics are employed. When the algorithms flag a domain name as potentially malicious, traffic to that domain is blocked, and an application displays the flagged domain name. The user can then block or whitelist the domain, allowing future access. This approach is critical because the flagged domain may be benign and empowers the user to decide. To evaluate the effectiveness of the algorithms, we used various tools to generate typosquatting domain names and tested them against our detection mechanisms. The results demonstrated that the tool could detect typosquatting domain names with a minimum accuracy of 98.79%, highlighting its robustness in identifying and mitigating these threats.