Detection of squatting domains is disclosed. A set of new fully qualified domain names (FQDNs) is received. The set of new FQDNs is analyzed to detect domain squatting by identifying a subset of the new FQDNs as candidate squatting domains. The candidate squatting domains are distributed to a security device/service.

Some embodiments provide domain name suggestions based on a user-provided ASCII phrase translated and/or transliterated into any of a number of supported non-English language character sets. To suggest non-English-language domain names, some embodiments parse, translate, and transliterate the user-provided ASCII names into domain names that include at least one non-English language character. Moreover, some embodiments determine the DNS registration status (e.g., as a second-level domain) of the Punycode (in ASCII) corresponding to these non-English domain names and provide the user with the ability to register any that are unregistered.

Various techniques for detecting visual similarity between DNS fully qualified domain names (FQDNs) are disclosed. In some embodiments, a system, process, and/or computer program product for detecting visual similarity between DNS FQDNs includes receiving a DNS data stream, wherein the DNS data stream includes a DNS query and a DNS response for resolution of the DNS query; performing extended sequence alignment for each of the set of FQDNs to identify potential malware FQDNs for one or more target FQDNs based on a visual similarity for each domain in the DNS data stream; and classifying the set of domains as malware FQDNs or benign FQDNs based on results of the extended sequence alignment.

Methods and systems for automated language detection for domain names are disclosed. In some embodiments, a method for detecting a language of an Internationalized Domain Name (IDN) comprises receiving, by an I/O interface, a string of characters for the IDN; receiving training data, including a plurality of multi-gram analyses for a set of languages; analyzing, by a processor, the string of characters based on the training data, wherein the analyzing includes extracting a set of multi-grams from the string of characters and comparing the extracted set of multi-grams with the training data; detecting the language of the IDN based on results of the analyzing. In some embodiments, the method further comprises comparing the detected language of the IDN with a user selected language and using the IDN to generate a domain name, if the comparing indicates that the detected language of the IDN is consistent with the user selected language.

Computer systems, computer-implemented methods and computer program products that detect a homographic string against defined strings is disclosed. In one embodiment, a computer-implemented method comprises: preparing, by a device operatively coupled to a processor, a mapping function to map a character into an identifier, the mapping function defining a plurality of groups each comprising two or more characters that resemble one another assigned a same identifier, and wherein the plurality of groups are mutually exclusive; preparing, by the device, a list of identifier sequences obtained from defined strings based on the mapping function; applying, by the device, the mapping function to a queried string to obtain a queried identifier sequence; and determining, by the device, whether the queried string is a homographic string by comparing the queried identifier sequence with the list of the identifier sequences.

Some embodiments provide domain name suggestions based on a user-provided ASCII phrase translated and/or transliterated into any of a number of supported non-English language character sets. To suggest non-English-language domain names, some embodiments parse, translate, and transliterate the user-provided ASCII names into domain names that include at least one non-English language character. Moreover, some embodiments determine the DNS registration status (e.g., as a second-level domain) of the Punycode (in ASCII) corresponding to these non-English domain names and provide the user with the ability to register any that are unregistered.

Some embodiments provide domain name suggestions based on a user-provided ASCII phrase translated and/or transliterated into any of a number of supported non-English language character sets. To suggest non-English-language domain names, some embodiments parse, translate, and transliterate the user-provided ASCII names into domain names that include at least one non-English language character. Moreover, some embodiments determine the DNS registration status (e.g., as a second-level domain) of the Punycode (in ASCII) corresponding to these non-English domain names and provide the user with the ability to register any that are unregistered.

Computer systems, computer-implemented methods and computer program products that detect a homographic string against defined strings is disclosed. In one embodiment, a computer-implemented method comprises: preparing, by a device operatively coupled to a processor, a mapping function to map a character into an identifier, the mapping function defining a plurality of groups each comprising two or more characters that resemble one another assigned a same identifier, and wherein the plurality of groups are mutually exclusive; preparing, by the device, a list of identifier sequences obtained from defined strings based on the mapping function; applying, by the device, the mapping function to a queried string to obtain a queried identifier sequence; and determining, by the device, whether the queried string is a homographic string by comparing the queried identifier sequence with the list of the identifier sequences.

A service set identifier processing method and apparatus, and a terminal are provided, so as to resolve a problem that there are garbled characters when a terminal displays an SSID. The method includes: obtaining, by a terminal, an SSID in a first encoding format, where the SSID in the first encoding format is broadcast by a wireless AP; and converting, by the terminal, the SSID in the first encoding format to an SSID in a second encoding format, and displaying the SSID in the second encoding format, where the second encoding format is an encoding format used by an operating system of the terminal, and the first encoding format is an encoding format different from the second encoding format. The terminal converts the obtained SSID in the first encoding format to the SSID in the second encoding format that can be correctly processed by the terminal, so that the terminal can correctly decode the SSID in the second encoding format by using the second encoding format, to further ensure that there is no garbled character when the SSID in the second encoding format is displayed.

Various techniques for detecting visual similarity between DNS fully qualified domain names (FQDNs) are disclosed. In some embodiments, a system, process, and/or computer program product for detecting visual similarity between DNS FQDNs includes receiving a DNS data stream, wherein the DNS data stream includes a DNS query and a DNS response for resolution of the DNS query; performing extended sequence alignment for each of the set of FQDNs to identify potential malware FQDNs for one or more target FQDNs based on a visual similarity for each domain in the DNS data stream; and classifying the set of domains as malware FQDNs or benign FQDNs based on results of the extended sequence alignment.