Towards quantifying visual similarity of domain names for combating typosquatting abuse

摘要

Typosquatting becomes a speculative and serious phenomenon for both Internet users and brand owners of popular websites. Typosquatters register similar domain names of popular websites to profit from displaying advertisements, redirecting traffic to third-party pages, deploying phishing sites, or serving malware. Thus, much work have been done on measuring typosquatting in distribution, monetization and cost etc. This paper does not measure typosquatting, but tries to combat typosquatting abuse from the abnormal detection view: a domain that looks very much like one popular website is suspicious. We propose TypoPegging, a reverse lookup approach to quickly and accurately get the most similar popular website for a given domain. Specifically, we propose a novel quantitative method to measure the visual similarity of two given domains. The proposed method is based on generalized Levenshtein distance that takes insights of our novel visual characteristics. Then we give an efficient method to search the maximum visual similarity of a domain over a given popular website set. We accelerate the searching process based on the triangle inequality of our visual distance metric and the locality sensitive hashing algorithm. Preliminary results show that our work is effective in differentiating typosquatting domain names from normal ones. We can also speedup the searching process in orders of magnitude comparing with the linear searching method.