Fast and Accurate Typosquatting Domains Evaluation with Siamese Networks

Typosquatting is a form of cybersquatting, which is a practice of registering typosquatting domain names that closely resemble legitimate and popular ones. It has become a serious speculation, as a large number of typosquatting domains are used to seek illegal interests or illegal purposes. Thus, many researches have been made on typosquatting in recent years. Some of them actively generate possible typo-variants of legitimate domains, and measure typosquatting phenomena in distribution, monetization and cost etc. Others detect typosquatting domains observed in passive DNS traffic through string similarity calculation by edit distance and time correlation. In this paper, we follow the latter work and propose a novel approach (named TypoEval) capable of evaluating typosquatting domains fast and accurately. Concretely, we exploit siamese neural networks to learn an embedding per domain and evaluate typosquatting domains by calculating the distance between vectors in Euclidean space. We validate our TypoEval approach on a real world data set. Experimental results show that TypoEval can improve the shortcomings of edit distance which is used by most of the previous work, and it is efficient and effective in evaluating typosquatting domains.