1. A string similarity apparatus arranged to detect a malicious domain name, the string similarity apparatus comprising: a memory configured to store a plurality of instructions; and a processor configured to execute the plurality of instructions to perform operations including: receiving a uniform resource locator (URL) having a domain name character string; comparing, using the processor, the received domain name character string to a first dataset of non-malicious domain names and a second dataset of malicious domain names, the first and second datasets having respective first dataset and second dataset domain name character strings; deriving, using the processor, compute-distance string similarity values for the received domain name character string relative to the first dataset and the second dataset, the compute-distance string similarity values based on a computational cost of a distance, from each of the first dataset and the second dataset domain name character strings, of the received domain name character string due to an insertion of a character into or a deletion of a character from the middle of the received domain name character string, including the cost of shifting characters of the received domain name character string as a result of the insertion or deletion; and detecting, using the processor, the received domain name character string as one of malicious and non-malicious based on the compute-distance string similarity values.