Detecting Homoglyph Attacks with a Siamese Neural Network

### Overview Daniel Grant presents research conducted with Hiram Anderson and Jonathan Woodbridge on detecting homoglyph attacks using computer vision and Siamese neural networks. Homoglyph attacks exploit visual similarities between different characters to deceive users and security systems. These deceptive techniques appear in both domain spoofing (leveraging the Internationalized Domain Name / IDN system) and process spoofing on operating systems, such as replacing characters in system binaries like `svchost.exe` (e.g., using a zero instead of an 'O') in real-world threats like the Beta Bot trojan and SMB worm.

### Key Topics & Limitations of Prior Art Traditional approaches to identifying spoofed strings rely heavily on text-based metrics such as Levenshtein edit distance or weighted edit distances. However, standard edit distance generates significant false positives and is trivially bypassed by attackers making edits just outside the detection threshold. While weighted edit distance attempts to account for character visual similarity (such as digraphs like 'rn' mimicking 'm'), manually defining pairwise similarity across tens of thousands of Unicode characters is largely intractable. In text embeddings, accented or lookalike Unicode codepoints have numerical values completely unrelated to their ASCII counterparts, failing to capture visual closeness directly.

### Technical Details To address these challenges, the researchers convert text strings into visual images (rendered using an Arial-based font) and use deep learning to generate feature vectors where visual similarity corresponds to small Euclidean distance: - **Architecture**: A Siamese neural network composed of convolutional networks (ConvNets) with max pooling, flattening, and dense layers. Twin networks share weights and are trained on paired images. - **Training**: Pairs of potential spoof variants (e.g., `google.com` vs. a spoofed version) are labeled 0 (small target distance), while unrelated pairs (e.g., Google vs. Facebook) are labeled 1. - **Dataset & Indexing**: The pipeline ingests approximately 50,000 common domains (such as top domains from the Alexa 1M list) and 50,000 common process names. The 32-dimensional output feature vectors are indexed using KD-trees (leveraging non-deterministic/randomized trees) to perform fast approximate nearest neighbor lookups rather than brute-force search. - **Evaluation**: Dimensionality reduction via PCA demonstrated clear visual clustering of spoof variants (e.g., variations of Twitter clustering together). Area Under the ROC Curve (AUC) showed significant detection gains over standard edit distance and visual edit distance heuristics. In process spoofing, standard edit distance performed near random chance (~0.5 AUC), whereas the Siamese network achieved superior discrimination, despite a small false-positive challenge with short legitimate names that resemble each other (such as `java` and `javac`).

### Takeaways Visual representations provide an effective, automated method to capture deceptive lookalike strings without manually mapping Unicode tables. The approach is released under the Endgame Inc GitHub repository (`endgameinc/homoglyph`). Future work highlighted during the talk and audience Q&A includes diversifying font coverage (handling serif versus sans-serif fonts) and addressing collisions between short legitimate process names.