DomainLynx: Leveraging Large Language Models for Enhanced Domain Squatting Detection

TL;DR

DomainLynx is an AI system that uses Large Language Models to detect novel and less prominent domain squatting techniques more accurately and efficiently than existing methods, enhancing Internet security.

Contribution

This paper introduces DomainLynx, a novel AI system leveraging LLMs for improved detection of sophisticated and emerging domain squatting tactics, especially for less prominent brands.

Findings

Achieved 94.7% accuracy on a curated dataset of squatting domains.

Detected 34,359 squatting domains in a month-long real-world test.

Outperformed baseline methods by 2.5 times in detection performance.

Abstract

Domain squatting poses a significant threat to Internet security, with attackers employing increasingly sophisticated techniques. This study introduces DomainLynx, an innovative compound AI system leveraging Large Language Models (LLMs) for enhanced domain squatting detection. Unlike existing methods focusing on predefined patterns for top-ranked domains, DomainLynx excels in identifying novel squatting techniques and protecting less prominent brands. The system's architecture integrates advanced data processing, intelligent domain pairing, and LLM-powered threat assessment. Crucially, DomainLynx incorporates specialized components that mitigate LLM hallucinations, ensuring reliable and context-aware detection. This approach enables efficient analysis of vast security data from diverse sources, including Certificate Transparency logs, Passive DNS records, and zone files. Evaluated on a curated dataset of 1,649 squatting domains, DomainLynx achieved 94.7\% accuracy using Llama-3-70B. In a month-long real-world test, it detected 34,359 squatting domains from 2.09 million new domains, outperforming baseline methods by 2.5 times. This research advances Internet security by providing a versatile, accurate, and adaptable tool for combating evolving domain squatting threats. DomainLynx's approach paves the way for more robust, AI-driven cybersecurity solutions, enhancing protection for a broader range of online entities and contributing to a safer digital ecosystem.