VizCheck: Enhancing Phishing Attack Detection through Visual Domain Name Homograph Analysis
Bibliographic record
Abstract
Phishing attacks are still one of the most devastating attacks in the cybersecurity landscape. These malicious schemes continue to threaten individuals, organizations, and even governments worldwide. Internationalized Domain Names (IDNs) made this problem even worse by allowing non-ASCII characters to be used in domain names, giving rise to domain homograph attacks, which are a type of phishing campaign where attackers trick the victims into trusting a domain name that looks visually indistinguishable from its legitimate counterpart. These domain names can be leveraged to send phishing emails seemingly coming from legitimate entities (e.g., noreply@paypal.com, where the character is the Cyrillic character with the code point U+0430) to harvest credentials, or to get a foothold into an organization’s infrastructure by sending a malicious file attachment seemingly coming from a colleague, as carried out by various notorious Advanced Persistent Threat (APT) groups, allowing the threat actors to further damage the infrastructure by moving laterally inside the network. In this paper, we present a novel approach for detecting domain homograph attacks using computer vision and deep learning techniques. Our system takes two domain names as input and outputs a visual similarity score that gets translated into a class label (legitimate or homograph). Furthermore, we provide a comprehensive dataset for training and evaluation, along with detailed steps for its generation, facilitating reproducibility of our results by the research community. The proposed model achieved both a high accuracy, with a low False Positive Rate (FPR) and a low False Negative Rate (FNR). These results highlight the efficacy of our approach in accurately identifying homograph domains. We provide insights on how to apply this approach in a real world case scenario, in order to protect companies from phishing attacks.
Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.
How this classification was reachedexpand
Full frame distilled prediction
Teacher imitationNot calibrated prevalence, not ground truth. Human validation pending. Learned from the 10,348 direct Codex labels and 10,348 direct Gemma labels. Candidate is the union of thresholded teacher heads; consensus is their intersection. These outputs are machine_predicted_unvalidated and are not human labels or direct frontier model labels.
Codex and Gemma teacher scores by category
| Category | Codex | Gemma |
|---|---|---|
| Metaresearch | 0.001 | 0.000 |
| Meta-epidemiology (narrow) | 0.000 | 0.000 |
| Meta-epidemiology (broad) | 0.000 | 0.000 |
| Bibliometrics | 0.001 | 0.004 |
| Science and technology studies | 0.000 | 0.000 |
| Scholarly communication | 0.001 | 0.002 |
| Open science | 0.000 | 0.000 |
| Research integrity | 0.000 | 0.000 |
| Insufficient payload (model declined to judge) | 0.000 | 0.000 |
Machine scores (provisional)
The two teacher heads of the student model, read on this work. A score orders the frame for review; it never asserts a category, and the validation status ships verbatim with every row.
Baseline scores from an immature model (maturity gate not passed, 7 training rounds). Scores rank; they never assert a category.
score_only:v0-immature-baseline · verbatim from the scoring run: score_only means the number may rank works, and no category label ships from itClassification
machine, unvalidatedMachine predicted; a candidate call from one teacher head, not a consensus.
How this classification was reached, model by model and score by score, is at the end of the page under "How this classification was reached".