Sound-skwatter（您是指：Sound-squatter？）——用于网络钓鱼预防的AI驱动生成器
Sound-skwatter (Did You Mean: Sound-squatter?) AI-powered Generator for Phishing Prevention
AI总结：
本文提出Sound-skwatter，一种基于Transformer与声学模型多模态组合的多语言AI系统，自动生成声音蹲点候选，用于主动防御网络钓鱼攻击，实验显示约10%生成域名真实存在。
摘要：
声音蹲点（Sound-squatting）是一种网络钓鱼攻击，通过利用单词发音的相似性诱骗用户访问恶意资源。对声音蹲点候选进行主动防御是复杂的，现有解决方案依赖于人工整理的谐音词列表。我们在此介绍Sound-skwatter，一个多语言的基于AI的系统，用于生成声音蹲点候选以进行主动防御。Sound-skwatter依赖于Transformer网络与声学模型的创新多模态组合来学习声音相似性。我们表明，Sound-skwatter能够自动列出已知谐音词以及数千个高质量候选。此外，它涵盖跨语言声音蹲点，即当读者和听者使用不同语言时，支持任意语言组合。我们将Sound-skwatter应用于通过蹲点域名进行的网络中心网络钓鱼。我们发现约10%的生成域名在现实世界中存在，其中绝大多数不为防护解决方案所知。接下来，我们展示对PyPI包管理器的攻击，其中约17%的流行包至少存在一个现有候选。我们相信Sound-skwatter是主动缓解互联网上声音蹲点现象的关键资产。为了增加其影响力，我们发布了一个在线演示，并将我们的模型和代码开源。
英文摘要：
Sound-squatting is a phishing attack that tricks users into malicious resources by exploiting similarities in the pronunciation of words. Proactive defense against sound-squatting candidates is complex, and existing solutions rely on manually curated lists of homophones. We here introduce Sound-skwatter, a multi-language AI-based system that generates sound-squatting candidates for proactive defense. Sound-skwatter relies on an innovative multi-modal combination of Transformers Networks and acoustic models to learn sound similarities. We show that Sound-skwatter can automatically list known homophones and thousands of high-quality candidates. In addition, it covers cross-language sound-squatting, i.e., when the reader and the listener speak different languages, supporting any combination of languages. We apply Sound-skwatter to network-centric phishing via squatted domain names. We find ~ 10% of the generated domains exist in the wild, the vast majority unknown to protection solutions. Next, we show attacks on the PyPI package manager, where ~ 17% of the popular packages have at least one existing candidate. We believe Sound-skwatter is a crucial asset to mitigate the sound-squatting phenomenon proactively on the Internet. To increase its impact, we publish an online demo and release our models and code as open source.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
