detect_malicious_url/idn_homograph.py at main · doneni/detect_malicious_url · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
import re

def get_root_url(url):
    url = re.sub(r'^(https?://|www\.)', '', url)
    return url


def contains_latin(url):
    latin_pattern = re.compile(r'[A-Za-z]')

    if latin_pattern.search(url):
        return True
    return False


def contains_cyrillic(url):
    cyrillic_pattern = re.compile(r'[\u0400-\u04FF]')

    if cyrillic_pattern.search(url):
        return True
    return False


def contains_greek(url):
    greek_pattern = re.compile(r'[\u0370-\u03FF]')

    if greek_pattern.search(url):
        return True
    return False


def contains_armenian(url):
    armenian_pattern = re.compile(r'[\u0530-\u058F]')

    if armenian_pattern.search(url):
        return True
    return False


def get_used_scripts(url):
    url = get_root_url(url)
    used_scripts = []
    if(contains_latin(url)):
        used_scripts.append('latin')
    if(contains_cyrillic(url)):
        used_scripts.append('cyrillic')
    if(contains_armenian(url)):
        used_scripts.append('armenian')
    if(contains_greek(url)):
        used_scripts.append('greek')

    return used_scripts


def check_idn_homograph_attack(url):
    used_scripts = get_used_scripts(url)

    return len(used_scripts) > 1


def test():
    df = open('./domain.txt', 'r')
    domain_list = df.read().split("\n")

    for domain in domain_list :
        print("url: ", domain)
        print('used_scripts:', get_used_scripts(domain))
        print('mixed_scripts:', check_idn_homograph_attack(domain))
        print()