Typosquatting error detection analyzing DNS log

Abstract

Typosquatting is a form of internet cybersquatting generated from the mistakes (typos) made by internet users while typing a website address. It often leads the user to another unintended website. Sometimes it isexploited by cybersquatters to attract website traffic by redirecting common typos of popular websites to some other sites with malicious contents. A possible solution is defensive registration of similar domains and redirecting requests to the original site. This would be affordable for the owner of the original domain if a short list of such probable typo domain names can bepredicted. In this thesis, we present a supervised learning based typographical error detection model analyzing domain server log that would suggest such a list. The detection scheme achieves as high as 98% accuracy. Existing works on typosquatting mostly try to generate typo sites by using different heuristic rules. However, to the best of our knowledge, none of them can predict probable typo variations of a given URL at pre-registration phase. We also present TypoWriter, an RNN based error prediction tool to fill this gap. TypoWriter achieves a good performance in terms of successful predictions that match with the ground-truth. It is compared with five widely used typo generation tools and substantial improvement is observed.