Cyber attacks deceive machines into believing something that does not exist in the first place. However, there are some to which even humans fall prey. One such famous attack that attackers have used over the years to exploit the vulnerability of vision is known to be a Homoglyph attack. It employs a primary yet effective mechanism to create illegitimate domains that are hard to differentiate from legit ones. Moreover, as the difference is pretty indistinguishable for a user to notice, they cannot stop themselves from clicking on these homoglyph domain names. In many cases, that results in either information theft or malware attack on their systems. Existing approaches use simple, string-based comparison techniques applied in primary language-based tasks. Although they are impactful to some extent, they usually fail because they are not robust to different types of homoglyphs and are computationally not feasible because of their time requirement proportional to the string length. Similarly, neural network-based approaches are employed to determine real domain strings from fake ones. Nevertheless, the problem with both methods is that they require paired sequences of real and fake domain strings to work with, which is often not the case in the real world, as the attacker only sends the illegitimate or homoglyph domain to the vulnerable user. Therefore, existing approaches are not suitable for practical scenarios in the real world. In our work, we created GlyphNet, an image dataset that contains 4M domains, both real and homoglyphs. Additionally, we introduce a baseline method for a homoglyph attack detection system using an attention-based convolutional Neural Network. We show that our model can reach state-of-the-art accuracy in detecting homoglyph attacks with a 0.93 AUC on our dataset.

翻译：网络攻击欺骗机器使其相信原本不存在的事物，然而有些攻击甚至人类也会上当。其中一种多年来攻击者利用视觉漏洞的著名攻击被称为同形攻击。该类攻击采用简单而有效的机制创建难以与合法域名区分的非法域名。此外，由于这种差异对用户而言几乎无法察觉，他们难以克制自己点击这些同形域名。在许多情况下，这会导致用户系统遭受信息窃取或恶意软件攻击。现有方法采用基于简单字符串比较的技术应用于初级语言任务中，虽然这些方法在一定程度上有效，但由于无法鲁棒应对不同类型的同形字符，且处理时间随字符串长度线性增长导致计算不可行，通常以失败告终。同样，基于神经网络的方法被用于判断真实域名与虚假域名，但两种方法均需同时处理真实与虚假域名的配对序列，而在现实场景中往往不具备此条件——攻击者仅向脆弱用户发送非法或同形域名。因此，现有方法不适用于实际场景。本文创建了GlyphNet图像数据集，包含400万个真实域名与同形域名，同时提出一种基于注意力卷积神经网络的同形攻击检测基线方法。实验表明，该模型在检测同形攻击时达到当前最优精度，在数据集上AUC值达0.93。