Fig 1.
The structure of LSTM.
Fig 2.
The structure of Attention mechanism.
Fig 3.
The structure of CNN.
Fig 4.
The structure of domain name.
Table 1.
Obtained domain name features.
Table 2.
Obtained Whois features.
Fig 5.
Substring acquisition process of N-gram (N = 4).
Table 3.
Obtained domain name whitelist substring N-gram features.
Table 4.
Obtained domain name blacklist substring N-gram features.
Fig 6.
The structure of the proposed model.
Fig 7.
The process of original DGA detection method.
Fig 8.
The process of Domain Center.
Table 5.
DGA detection results of comparison models.
Fig 9.
ROC curves of DGA detection results of comparison models.
Fig 10.
The classification Accuracy of the comparison models for 58 DGA families.
Fig 11.
The classification Precision of the comparison models for 58 DGA families.
Fig 12.
The classification Recall of the comparison models for 58 DGA families.
Fig 13.
The classification F1 of the comparison models for 58 DGA families.
Table 6.
DGA detection results of different variant models.
Fig 14.
Importance results of different features.
Table 7.
DGA detection results of different similarity methods.
Table 8.
DGA detection results of different number of samples.