ShamFinder：一个检测IDN同形词的自动化框架
ShamFinder: An Automated Framework for Detecting IDN Homographs
摘要：
国际化域名（IDN）是一种使我们能够在域名中使用Unicode字符的机制。Unicode字符集包含视觉上彼此相同的几对字符;例如，拉丁字符“a”（U+0061）和西里尔字符“a”（U+0430）。视觉上相同的字符，如这些通常被称为homoglyphs。IDN同形异义词攻击是众所周知的，它滥用Unicode同形异义词来创建相似的URL。虽然IDN同形异义词攻击构成的威胁并不新鲜，但最近在域名注册机构和Web浏览器中IDN采用的增加导致这些攻击的威胁变得越来越普遍，导致大规模的网络钓鱼攻击，例如针对加密货币交易公司的攻击。在这项工作中，我们开发了一个名为“Shamanet”的框架，这是一个自动化的计划来检测IDN同形词。我们的主要贡献是一个homoglobular数据库，它可以用于直接对抗攻击的对策，并告知用户有关的IDN同形词的上下文的自动构建。使用Shamanet框架，我们进行了大规模的测量研究，旨在了解存在于野外的IDN同形词。在我们的方法的基础上，我们提供了一个有效的反措施，对IDN同形词攻击所造成的威胁的见解。
英文摘要：
The internationalized domain name (IDN) is a mechanism that enables us to use Unicode characters in domain names. The set of Unicode characters contains several pairs of characters that are visually identical with each other; e.g., the Latin character 'a' (U+0061) and Cyrillic character 'a' (U+0430). Visually identical characters such as these are generally known as homoglyphs. IDN homograph attacks, which are widely known, abuse Unicode homoglyphs to create lookalike URLs. Although the threat posed by IDN homograph attacks is not new, the recent rise of IDN adoption in both domain name registries and web browsers has resulted in the threat of these attacks becoming increasingly widespread, leading to large-scale phishing attacks such as those targeting cryptocurrency exchange companies. In this work, we developed a framework named "ShamFinder," which is an automated scheme to detect IDN homographs. Our key contribution is the automatic construction of a homoglyph database, which can be used for direct countermeasures against the attack and to inform users about the context of an IDN homograph. Using the ShamFinder framework, we perform a large-scale measurement study that aims to understand the IDN homographs that exist in the wild. On the basis of our approach, we provide insights into an effective counter-measure against the threats caused by the IDN homograph attack.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
