{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,20]],"date-time":"2026-03-20T16:28:24Z","timestamp":1774024104476,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":116,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,9,30]],"date-time":"2024-09-30T00:00:00Z","timestamp":1727654400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,9,30]]},"DOI":"10.1145\/3678890.3678913","type":"proceedings-article","created":{"date-parts":[[2024,9,29]],"date-time":"2024-09-29T22:23:36Z","timestamp":1727648616000},"page":"147-165","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":6,"title":["Down to earth! Guidelines for DGA-based Malware Detection"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-3120-3292","authenticated-orcid":false,"given":"Bogdan Constantin","family":"Cebere","sequence":"first","affiliation":[{"name":"CISPA Helmholtz Center for Information Security, Germany"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-3069-6714","authenticated-orcid":false,"given":"Jonathan Lasse Bennet","family":"Flueren","sequence":"additional","affiliation":[{"name":"CISPA Helmholtz Center for Information Security, Germany"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7675-0535","authenticated-orcid":false,"given":"Silvia","family":"Sebasti\u00e1n","sequence":"additional","affiliation":[{"name":"CISPA Helmholtz Center for Information Security, Spain"}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-9788-4376","authenticated-orcid":false,"given":"Daniel","family":"Plohmann","sequence":"additional","affiliation":[{"name":"Fraunhofer FKIE, Germany"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2470-8444","authenticated-orcid":false,"given":"Christian","family":"Rossow","sequence":"additional","affiliation":[{"name":"CISPA Helmholtz Center for Information Security, Germany"}]}],"member":"320","published-online":{"date-parts":[[2024,9,30]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"[n. d.]. GLOBAL DNS INFRASTRUCTURE. https:\/\/www.opendns.com\/about\/global-dns-infrastructure\/."},{"key":"e_1_3_2_1_2_1","unstructured":"[n. d.]. Pi-hole reddit. https:\/\/www.reddit.com\/r\/pihole\/comments\/11ocub5\/490k_dns_queries_per_day_whats_normalaverage\/."},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/3098954.3107008"},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNSE.2022.3173591"},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCCNT49239.2020.9225357"},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.comcom.2020.04.033"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"crossref","unstructured":"Hyrum\u00a0S. Anderson Jonathan Woodbridge and Bobby Filar. 2016. DeepDGA: Adversarially-Tuned Domain Generation and Detection. http:\/\/arxiv.org\/abs\/1610.01969 arXiv:1610.01969 [cs].","DOI":"10.1145\/2996758.2996767"},{"key":"e_1_3_2_1_8_1","volume-title":"26th USENIX security symposium (USENIX Security 17). 1093\u20131110.","author":"Antonakakis Manos","unstructured":"Manos Antonakakis, Tim April, Michael Bailey, Matt Bernhard, Elie Bursztein, Jaime Cochran, Zakir Durumeric, J\u00a0Alex Halderman, Luca Invernizzi, Michalis Kallitsis, 2017. Understanding the mirai botnet. In 26th USENIX security symposium (USENIX Security 17). 1093\u20131110."},{"key":"e_1_3_2_1_9_1","volume-title":"21st USENIX Security Symposium (USENIX Security 12)","author":"Antonakakis Manos","year":"2012","unstructured":"Manos Antonakakis, Roberto Perdisci, Yacin Nadji, Nikolaos Vasiloglou, Saeed Abu-Nimeh, Wenke Lee, and David Dagon. 2012. From Throw-Away traffic to bots: Detecting the rise of DGA-Based malware. In 21st USENIX Security Symposium (USENIX Security 12). 491\u2013506."},{"key":"e_1_3_2_1_10_1","unstructured":"APNIC. [n. d.]. Measuring NXDOMAIN responses. https:\/\/blog.apnic.net\/2023\/07\/12\/measuring-nxdomain-responses\/."},{"key":"e_1_3_2_1_11_1","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Arp Daniel","year":"2022","unstructured":"Daniel Arp, Erwin Quiring, Feargus Pendlebury, Alexander Warnecke, Fabio Pierazzi, Christian Wressnegger, Lorenzo Cavallaro, and Konrad Rieck. 2022. Dos and don\u2019ts of machine learning in computer security. In 31st USENIX Security Symposium (USENIX Security 22). 3971\u20133988."},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/CSCloud-EdgeCom52276.2021.00024"},{"key":"e_1_3_2_1_13_1","unstructured":"Johannes Bader. [n. d.]. bumblebee report. https:\/\/bin.re\/blog\/the-dga-of-bumblebee\/."},{"key":"e_1_3_2_1_14_1","volume-title":"Domain generation algorithm detection using machine learning methods. Cyber security: power and technology","author":"Baruch Moran","year":"2018","unstructured":"Moran Baruch and Gil David. 2018. Domain generation algorithm detection using machine learning methods. Cyber security: power and technology (2018), 133\u2013161."},{"key":"e_1_3_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/VizSec51108.2020.00010"},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.3390\/info10050157"},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/2584679"},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1109\/CCST.2017.8167790"},{"key":"e_1_3_2_1_19_1","volume-title":"Random forests. Machine learning 45","author":"Breiman Leo","year":"2001","unstructured":"Leo Breiman. 2001. Random forests. Machine learning 45 (2001), 5\u201332."},{"key":"e_1_3_2_1_20_1","volume-title":"Classification and regression trees","author":"Breiman Leo","unstructured":"Leo Breiman. 2017. Classification and regression trees. Routledge."},{"key":"e_1_3_2_1_21_1","unstructured":"Broadcom. [n. d.]. bamital report. https:\/\/docs.broadcom.com\/doc\/trojan-bamital-13-en."},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/2939672.2939785"},{"key":"e_1_3_2_1_23_1","volume-title":"The advantages of the Matthews correlation coefficient (MCC) over F1 score and accuracy in binary classification evaluation. BMC genomics 21","author":"Chicco Davide","year":"2020","unstructured":"Davide Chicco and Giuseppe Jurman. 2020. The advantages of the Matthews correlation coefficient (MCC) over F1 score and accuracy in binary classification evaluation. BMC genomics 21 (2020), 1\u201313."},{"key":"e_1_3_2_1_24_1","unstructured":"Cloudflare. [n. d.]. Delegated and NXDOMAIN requests through Cloudflare DNS. https:\/\/stats.labs.apnic.net\/cfnxdata\/."},{"key":"e_1_3_2_1_25_1","volume-title":"Support-vector networks. Machine learning 20","author":"Cortes Corinna","year":"1995","unstructured":"Corinna Cortes and Vladimir Vapnik. 1995. Support-vector networks. Machine learning 20 (1995), 273\u2013297."},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.2517-6161.1958.tb00292.x"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"crossref","unstructured":"Ryan\u00a0R. Curtin Andrew\u00a0B. Gardner Slawomir Grzonkowski Alexey Kleymenov and Alejandro Mosquera. 2019. Detecting DGA domains with recurrent neural networks and side information. http:\/\/arxiv.org\/abs\/1810.02023 arXiv:1810.02023 [cs].","DOI":"10.1145\/3339252.3339258"},{"key":"e_1_3_2_1_28_1","unstructured":"Darby Wise. [n. d.]. [RDGAs: The New Face of DGAs. https:\/\/blogs.infoblox.com\/cyber-threat-intelligence\/rdgas-the-new-face-of-dgas\/."},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/3465481.3465749"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1109\/PST52912.2021.9647755"},{"key":"e_1_3_2_1_32_1","volume-title":"Towards Robust Domain Generation Algorithm Classification. arXiv preprint arXiv:2404.06236","author":"Drichel Arthur","year":"2024","unstructured":"Arthur Drichel, Marc Meyer, and Ulrike Meyer. 2024. Towards Robust Domain Generation Algorithm Classification. arXiv preprint arXiv:2404.06236 (2024)."},{"key":"e_1_3_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1145\/3607199.3607231"},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/3407023.3407030"},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/3407023.3409190"},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1145\/3538969.3538990"},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"crossref","unstructured":"Xin Fang Xiaoqing Sun Jiahai Yang and Xinran Liu. 2020. Domain-Embeddings Based DGA Detection with Incremental Training Method. http:\/\/arxiv.org\/abs\/2009.09959 arXiv:2009.09959 [cs].","DOI":"10.1109\/ISCC50000.2020.9219664"},{"key":"e_1_3_2_1_38_1","volume-title":"The 22nd International Conference on Artificial Intelligence and Statistics. 2681\u20132690","author":"Feydy Jean","year":"2019","unstructured":"Jean Feydy, Thibault S\u00e9journ\u00e9, Fran\u00e7ois-Xavier Vialard, Shun-ichi Amari, Alain Trouve, and Gabriel Peyr\u00e9. 2019. Interpolating between Optimal Transport and MMD using Sinkhorn Divergences. In The 22nd International Conference on Artificial Intelligence and Statistics. 2681\u20132690."},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2017.2668361"},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1109\/SYNASC.2016.053"},{"key":"e_1_3_2_1_41_1","volume-title":"Learning to forget: Continual prediction with LSTM. Neural computation 12, 10","author":"Gers A","year":"2000","unstructured":"Felix\u00a0A Gers, J\u00fcrgen Schmidhuber, and Fred Cummins. 2000. Learning to forget: Continual prediction with LSTM. Neural computation 12, 10 (2000), 2451\u20132471."},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1109\/INM.2015.7140486"},{"key":"e_1_3_2_1_43_1","volume-title":"Botminer: Clustering analysis of network traffic for protocol-and structure-independent botnet detection.","author":"Gu Guofei","year":"2008","unstructured":"Guofei Gu, Roberto Perdisci, Junjie Zhang, and Wenke Lee. 2008. Botminer: Clustering analysis of network traffic for protocol-and structure-independent botnet detection. (2008)."},{"key":"e_1_3_2_1_44_1","volume-title":"USENIX Security Symposium, Vol.\u00a07. 1\u201316","author":"Gu Guofei","year":"2007","unstructured":"Guofei Gu, Phillip\u00a0A Porras, Vinod Yegneswaran, Martin\u00a0W Fong, and Wenke Lee. 2007. Bothunter: Detecting malware infection through ids-driven dialog correlation.. In USENIX Security Symposium, Vol.\u00a07. 1\u201316."},{"key":"e_1_3_2_1_45_1","unstructured":"Guofei Gu Junjie Zhang and Wenke Lee. 2008. BotSniffer: Detecting botnet command and control channels in network traffic. (2008)."},{"key":"e_1_3_2_1_46_1","volume-title":"Neural networks: a comprehensive foundation","author":"Haykin Simon","unstructured":"Simon Haykin. 1994. Neural networks: a comprehensive foundation. Prentice Hall PTR."},{"key":"e_1_3_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2016.90"},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1007\/s42979-021-00507-w"},{"key":"e_1_3_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2015.2457491"},{"key":"e_1_3_2_1_50_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3293956"},{"key":"e_1_3_2_1_51_1","volume-title":"Designing machine learning systems. \" O\u2019Reilly Media","author":"Huyen Chip","unstructured":"Chip Huyen. 2022. Designing machine learning systems. \" O\u2019Reilly Media, Inc.\"."},{"key":"e_1_3_2_1_52_1","unstructured":"ICANN. [n. d.]. M3: DNS Root Traffic Analysis. https:\/\/ithi.research.icann.org\/graph-m3.html."},{"key":"e_1_3_2_1_53_1","unstructured":"Infoblox. [n. d.]. Infoblox. Prolific Puma: Shadowy Link Shortening Service Enables Cybercrime. https:\/\/blogs.infoblox.com\/threat-intelligence\/prolific-puma-shadowy-link-shortening-service-enables-cybercrime\/."},{"key":"e_1_3_2_1_54_1","unstructured":"Infoblox. [n. d.]. Infoblox. VexTrio Operates Massive Criminal Affiliate Program. https:\/\/blogs.infoblox.com\/threat-intelligence\/cybercrime-central-vextrio-operates-massive-criminal-affiliate-program\/."},{"key":"e_1_3_2_1_55_1","unstructured":"Infoblox. [n. d.]. Phishers Weather the Storm: The DNS Landscape of U.S. Postal Smishing Attacks. https:\/\/blogs.infoblox.com\/threat-intelligence\/phishers-weather-the-storm-the-dns-landscape-of-us-postal-smishing-attacks\/."},{"key":"e_1_3_2_1_56_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCCN54977.2022.9868932"},{"key":"e_1_3_2_1_57_1","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2015.2459015"},{"key":"e_1_3_2_1_58_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2020.107699"},{"key":"e_1_3_2_1_59_1","doi-asserted-by":"publisher","DOI":"10.1109\/BigData.2018.8622066"},{"key":"e_1_3_2_1_60_1","volume-title":"International conference on machine learning. PMLR, 5637\u20135664","author":"Koh Pang\u00a0Wei","year":"2021","unstructured":"Pang\u00a0Wei Koh, Shiori Sagawa, Henrik Marklund, Sang\u00a0Michael Xie, Marvin Zhang, Akshay Balsubramani, Weihua Hu, Michihiro Yasunaga, Richard\u00a0Lanas Phillips, Irena Gao, 2021. Wilds: A benchmark of in-the-wild distribution shifts. In International conference on machine learning. PMLR, 5637\u20135664."},{"key":"e_1_3_2_1_61_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2023.3286313"},{"key":"e_1_3_2_1_62_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISCAS.2010.5537907"},{"key":"e_1_3_2_1_63_1","doi-asserted-by":"publisher","DOI":"10.4108\/eai.18-2-2021.168723"},{"key":"e_1_3_2_1_64_1","unstructured":"media.blackhat.com. [n. d.]. suppobox report. https:\/\/media.blackhat.com\/us-13\/US-13-Geffner-End-To-End-Analysis-of-a-Domain-Generating-Algorithm-Malware-Family-WP.pdf."},{"key":"e_1_3_2_1_65_1","doi-asserted-by":"publisher","DOI":"10.1155\/2021"},{"key":"e_1_3_2_1_66_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNSE.2023.3308126"},{"key":"e_1_3_2_1_67_1","volume-title":"d.]. Global DNS Traffic Report Insights into the Health of Networks","year":"2023","unstructured":"NS1. [n. d.]. Global DNS Traffic Report Insights into the Health of Networks in 2023. https:\/\/ns1.com\/writable\/resources\/ns1_Global_DNS_Traffic_Report_2023.pdf."},{"key":"e_1_3_2_1_68_1","unstructured":"nsfocusglobal.com. [n. d.]. banjori report. https:\/\/nsfocusglobal.com\/banking-trojan-banjori-analysis-report\/."},{"key":"e_1_3_2_1_69_1","volume-title":"Malware capability development patterns respond to defenses: Two case studies. White Paper","author":"O\u2019Meara Kyle","year":"2016","unstructured":"Kyle O\u2019Meara, Deana Shick, Jonathan Spring, and Edward Stoner. 2016. Malware capability development patterns respond to defenses: Two case studies. White Paper, Software Engineering Institute, Carnegie Mellon University (2016), 1\u201311."},{"key":"e_1_3_2_1_70_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jisa.2020.102725"},{"key":"e_1_3_2_1_71_1","doi-asserted-by":"crossref","unstructured":"Jonathan Peck Claire Nie Raaghavi Sivaguru Charles Grumer Femi Olumofin Bin Yu Anderson Nascimento and Martine De\u00a0Cock. 2019. CharBot: A Simple and Effective Method for Evading DGA Classifiers. http:\/\/arxiv.org\/abs\/1905.01078 arXiv:1905.01078 [cs stat].","DOI":"10.1109\/ACCESS.2019.2927075"},{"key":"e_1_3_2_1_72_1","volume-title":"RAID 2018, Heraklion, Crete, Greece, September 10-12, 2018, Proceedings 21","author":"Pereira Mayana","year":"2018","unstructured":"Mayana Pereira, Shaun Coleman, Bin Yu, Martine DeCock, and Anderson Nascimento. 2018. Dictionary extraction and detection of algorithmically generated domain names in passive DNS traffic. In Research in Attacks, Intrusions, and Defenses: 21st International Symposium, RAID 2018, Heraklion, Crete, Greece, September 10-12, 2018, Proceedings 21. Springer, 295\u2013314."},{"key":"e_1_3_2_1_73_1","doi-asserted-by":"publisher","DOI":"10.4249\/scholarpedia.1883"},{"key":"e_1_3_2_1_74_1","volume-title":"25th USENIX Security Symposium (USENIX Security 16)","author":"Plohmann Daniel","year":"2016","unstructured":"Daniel Plohmann, Khaled Yakdan, Michael Klatt, Johannes Bader, and Elmar Gerhards-Padilla. 2016. A comprehensive measurement study of domain generating malware. In 25th USENIX Security Symposium (USENIX Security 16). 263\u2013278."},{"key":"e_1_3_2_1_75_1","volume-title":"25th USENIX Security Symposium (USENIX Security 16)","author":"Plohmann Daniel","year":"2016","unstructured":"Daniel Plohmann, Khaled Yakdan, Michael Klatt, Johannes Bader, and Elmar Gerhards-Padilla. 2016. A comprehensive measurement study of domain generating malware. In 25th USENIX Security Symposium (USENIX Security 16). 263\u2013278."},{"key":"e_1_3_2_1_76_1","volume-title":"Tranco: A research-oriented top sites ranking hardened against manipulation. arXiv preprint arXiv:1806.01156","author":"Pochat Victor\u00a0Le","year":"2018","unstructured":"Victor\u00a0Le Pochat, Tom Van\u00a0Goethem, Samaneh Tajalizadehkhoob, Maciej Korczy\u0144ski, and Wouter Joosen. 2018. Tranco: A research-oriented top sites ranking hardened against manipulation. arXiv preprint arXiv:1806.01156 (2018)."},{"key":"e_1_3_2_1_77_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2023.103123"},{"key":"e_1_3_2_1_78_1","volume-title":"Dataset shift in machine learning","author":"Qui\u00f1onero-Candela Joaquin","unstructured":"Joaquin Qui\u00f1onero-Candela, Masashi Sugiyama, Anton Schwaighofer, and Neil\u00a0D Lawrence. 2008. Dataset shift in machine learning. Mit Press."},{"key":"e_1_3_2_1_79_1","doi-asserted-by":"publisher","DOI":"10.1109\/TEM.2021.3059664"},{"key":"e_1_3_2_1_80_1","doi-asserted-by":"publisher","DOI":"10.1186\/s42400-020-00046-6"},{"key":"e_1_3_2_1_81_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2013.17"},{"key":"e_1_3_2_1_82_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2012.14"},{"key":"e_1_3_2_1_83_1","doi-asserted-by":"publisher","DOI":"10.1109\/OJCOMS.2020.3038704"},{"key":"e_1_3_2_1_84_1","doi-asserted-by":"publisher","DOI":"10.3390\/electronics10091039"},{"key":"e_1_3_2_1_85_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-08509-8_11"},{"key":"e_1_3_2_1_86_1","volume-title":"27th USENIX Security Symposium (USENIX Security 18)","author":"Sch\u00fcppen Samuel","year":"2018","unstructured":"Samuel Sch\u00fcppen, Dominik Teubert, Patrick Herrmann, and Ulrike Meyer. 2018. FANCI: Feature-based automated NXDomain classification and intelligence. In 27th USENIX Security Symposium (USENIX Security 18). 1165\u20131181."},{"key":"e_1_3_2_1_87_1","unstructured":"securityaffairs.com. [n. d.]. gozi report. https:\/\/securityaffairs.com\/51744\/malware\/goznym-botnet-profiling.html."},{"key":"e_1_3_2_1_88_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2021.3111307"},{"key":"e_1_3_2_1_89_1","doi-asserted-by":"publisher","DOI":"10.1007\/s11063-017-9666-7"},{"key":"e_1_3_2_1_90_1","doi-asserted-by":"publisher","DOI":"10.1145\/3340531.3416022"},{"key":"e_1_3_2_1_91_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.3020964"},{"key":"e_1_3_2_1_92_1","doi-asserted-by":"publisher","DOI":"10.1109\/BigData.2018.8621875"},{"key":"e_1_3_2_1_93_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.3013494"},{"key":"e_1_3_2_1_94_1","doi-asserted-by":"publisher","DOI":"10.1145\/3297280.3297467"},{"key":"e_1_3_2_1_95_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2022.3162588"},{"key":"e_1_3_2_1_96_1","unstructured":"threatpost.com. [n. d.]. matsnu report. https:\/\/threatpost.com\/matsnu-botnet-dga-discovers-power-of-words\/109426\/."},{"key":"e_1_3_2_1_97_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2017.11.018"},{"key":"e_1_3_2_1_98_1","volume-title":"Visualizing data using t-SNE.Journal of machine learning research 9, 11","author":"Maaten Laurens Van\u00a0der","year":"2008","unstructured":"Laurens Van\u00a0der Maaten and Geoffrey Hinton. 2008. Visualizing data using t-SNE.Journal of machine learning research 9, 11 (2008)."},{"key":"e_1_3_2_1_99_1","volume-title":"Attention is all you need. Advances in neural information processing systems 30","author":"Vaswani Ashish","year":"2017","unstructured":"Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan\u00a0N Gomez, \u0141ukasz Kaiser, and Illia Polosukhin. 2017. Attention is all you need. Advances in neural information processing systems 30 (2017)."},{"key":"e_1_3_2_1_100_1","doi-asserted-by":"crossref","unstructured":"R Vinayakumar KP Soman Prabaharan Poornachandran Mamoun Alazab and Sabu\u00a0M Thampi. 2019. Amritadga: a comprehensive data set for domain generation algorithms (dgas) based domain name detection systems and application of deep learning. In Big Data Recommender Systems: Application Paradigms. Institution of Engineering and Technology 455\u2013485.","DOI":"10.1049\/PBPC035G_ch22"},{"key":"e_1_3_2_1_101_1","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2017.2749442"},{"key":"e_1_3_2_1_102_1","doi-asserted-by":"publisher","DOI":"10.3390\/electronics11030414"},{"key":"e_1_3_2_1_103_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2016.10.001"},{"key":"e_1_3_2_1_104_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICEIEC58029.2023.10200702"},{"key":"e_1_3_2_1_105_1","unstructured":"Jonathan Woodbridge Hyrum\u00a0S. Anderson Anjum Ahuja and Daniel Grant. 2016. Predicting Domain Generation Algorithms with Long Short-Term Memory Networks. http:\/\/arxiv.org\/abs\/1611.00791 arXiv:1611.00791 [cs]."},{"key":"e_1_3_2_1_106_1","volume-title":"International Conference on Security and Privacy in Communication Systems. Springer, 446\u2013459","author":"Yadav Sandeep","year":"2011","unstructured":"Sandeep Yadav and AL\u00a0Narasimha Reddy. 2011. Winning with DNS failures: Strategies for faster botnet detection. In International Conference on Security and Privacy in Communication Systems. Springer, 446\u2013459."},{"key":"e_1_3_2_1_107_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2020.2988877"},{"key":"e_1_3_2_1_108_1","doi-asserted-by":"publisher","DOI":"10.3390\/sym11020176"},{"key":"e_1_3_2_1_109_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDMW.2017.96"},{"key":"e_1_3_2_1_110_1","doi-asserted-by":"publisher","DOI":"10.1109\/IJCNN.2018.8489147"},{"key":"e_1_3_2_1_111_1","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2019.2960647"},{"key":"e_1_3_2_1_112_1","doi-asserted-by":"publisher","DOI":"10.1109\/WCNC49053.2021.9417570"},{"key":"e_1_3_2_1_113_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2022.3204051"},{"key":"e_1_3_2_1_114_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2021.3127913"},{"key":"e_1_3_2_1_115_1","doi-asserted-by":"publisher","DOI":"10.1109\/ISI.2019.8823200"},{"key":"e_1_3_2_1_116_1","first-page":"116","article-title":"DGA-Based Botnet Detection Using DNS Traffic.J","volume":"3","author":"Zhou Yonglin","year":"2013","unstructured":"Yonglin Zhou, Qing-shan Li, Qidi Miao, and Kangbin Yim. 2013. DGA-Based Botnet Detection Using DNS Traffic.J. Internet Serv. Inf. Secur. 3, 3\/4 (2013), 116\u2013123.","journal-title":"Internet Serv. Inf. Secur."}],"event":{"name":"RAID '24: The 27th International Symposium on Research in Attacks, Intrusions and Defenses","location":"Padua Italy","acronym":"RAID '24"},"container-title":["The 27th International Symposium on Research in Attacks, Intrusions and Defenses"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3678890.3678913","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3678890.3678913","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T01:18:00Z","timestamp":1750295880000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3678890.3678913"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,9,30]]},"references-count":116,"alternative-id":["10.1145\/3678890.3678913","10.1145\/3678890"],"URL":"https:\/\/doi.org\/10.1145\/3678890.3678913","relation":{},"subject":[],"published":{"date-parts":[[2024,9,30]]},"assertion":[{"value":"2024-09-30","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}