Abstract:ABSTRACT We anticipate the widespread usage of an internationalized resource identifier (IRI) 1 1. IRI is a generalization of the uniform resource identifier (URI), which is in turn a generalization of the uniform resource locator (URL). While URIs are limited to a subset of the ASCII character set, IRIs may contain characters from the universal character set (Unicode/ISO 10646). Basically, an IRI is the internationalized version of a URI or internationalized domain name (IDN) 2 2. IDN is an Internet domain name that (potentially) contains non-ASCII characters. Such domain names could contain letters with diacritics, as required by many European languages, or characters from non-Latin scripts such as Arabic or Chinese. on the web as complement to universal resource identifier (URI). IRI/IDN is composed of characters in a subset of Unicode, such that a Unicode attack 3 3. Unicode attack is caused by the coexistence of a large number of visual/semantically similar Unicode strings. On the character level, the visually similar Unicode attack is homograph attack. to IRI/IDN could happen. Hence, visually or semantically, certain phishing IRI/IDNs may show high similarity to the real ones. The potential phishing attacks based on this strategy are very likely to happen in the near future with the boosting utilization of IRI/IDN. We invented a method to detect such phishing attack. We constructed a unicode character similarity list (UC-SimList) based on char-char visual and semantic similarities and use a nondeterministic finite automaton (NFA) 4 4. NFA is a finite state machine where for each pair of state and input symbol there may be several possible next states. We can use it to recognize a string of a certain pattern. When the last input symbol is consumed the NFA accepts if and only if there is some set of transitions it could make that will take it to an accepting state. Equivalently, it rejects if no matter what choices it makes it would not end in an accepting state. to identify the potential IRI/IDN-based phishing patterns. We implemented a phishing IRI/IDN pattern generation tool, REGAP, by which phishing IRI/IDN patterns can be generated into regular expressions (RE) for phishing IRI/IDN detection. We also address how such a tool can be applied to investigations.

Safeguard Against Unicode Attacks

The Methodology and an Application to Fight Against Unicode Attacks

UniID: Spoofing Face Authentication System by Universal Identity

Attack As Defense: Characterizing Adversarial Examples Using Robustness.

Off- Line Chinese Writer Identification Based on Character-Level Decision Combination

Exposing Homograph Obfuscation Intentions By Coloring Unicode Strings

A Unicode Based Adaptive Segmentor

Universal Defensive Underpainting Patch: Making Your Text Invisible to Optical Character Recognition

REGAP: A Tool for Unicode-Based Web Identity Fraud Detection

Randomization Techniques to Mitigate the Risk of Copyright Infringement

Cross Site Script Prevention Based on Delimiters

A machine learning attack against variable-length Chinese character CAPTCHAs

Unifying Gradients to Improve Real-world Robustness for Deep Networks

A Potential IRI based Phishing Obfuscation Strategy and Counter Measures

Dual-Mode Encryption for UC-Secure String OT from Learning with Errors

A STRING SIMILARITY CALCULATION FOR RECOGNISING KEYWORDS OF COINED PROFANITIES

Icufuzzer: Fuzzing Icu Library For Exploitable Bugs In Multiple Software

SSL-DP: A Rootkit of Network Based SSL and TLS Traffic Decryptor

An immune-based risk assessment method for digital virtual assets

Padding for orthogonality: Efficient subspace authentication for network coding

Study on Virus Signatures based on Matching in Virus-detecting Technologies