{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,19]],"date-time":"2026-05-19T03:39:11Z","timestamp":1779161951020,"version":"3.51.4"},"reference-count":44,"publisher":"SAGE Publications","issue":"1","license":[{"start":{"date-parts":[[2022,6,6]],"date-time":"2022-06-06T00:00:00Z","timestamp":1654473600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/journals.sagepub.com\/page\/policies\/text-and-data-mining-license"}],"content-domain":{"domain":["journals.sagepub.com"],"crossmark-restriction":true},"short-container-title":["Journal of Computer Security"],"published-print":{"date-parts":[[2023,1,26]]},"abstract":"<jats:p>The use of command and control (C2) servers in cyberattacks has risen considerably, attackers frequently employ the domain generated algorithm (DGA) technique to conceal their C2 servers. Various machine learning models have been suggested for binary identification of domain names as either benign or DGA domain. The Existing techniques are inefficient and have real-time detection issues and are also very data hypersensitive, therefore, they can be circumvented by the attackers. The main problem this article addresses is how to automatically detect DGA in a way that does not rely solely on reverse engineering, not strongly affected by data size, and allows detection of this DGA in real time. This paper presents DTFS-DGA model that combine neural networks models with traditional machine learning models and maintains its performance even if the data size changes to detect DGA in real time. The model uses 15 linguistics and networks features with the features extracted by long short-term memory and convolutional neural network to classify domain names using random forest and support vector machines. The comprehensive experimental findings confirm the suggested model\u2019s accuracy. To be precise, the model achieve an average accuracy of [Formula: see text] for the classification.<\/jats:p>","DOI":"10.3233\/jcs-210139","type":"journal-article","created":{"date-parts":[[2022,6,7]],"date-time":"2022-06-07T12:42:12Z","timestamp":1654605732000},"page":"85-105","update-policy":"https:\/\/doi.org\/10.1177\/sage-journals-update-policy","source":"Crossref","is-referenced-by-count":10,"title":["Domain generated algorithms detection applying a combination of a deep feature selection and traditional machine learning models"],"prefix":"10.1177","volume":"31","author":[{"given":"Mohamed","family":"Hassaoui","sequence":"first","affiliation":[{"name":"Computer, Networks, Mobility and Modeling laboratory, Hassan First University of settat, Faculty of Sciences and Techniques, Settat, Morocco"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Mohamed","family":"Hanini","sequence":"additional","affiliation":[{"name":"Computer, Networks, Mobility and Modeling laboratory, Hassan First University, Faculty of Sciences and Techniques, Settat, Morocco"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Said","family":"El Kafhali","sequence":"additional","affiliation":[{"name":"Computer, Networks, Mobility and Modeling laboratory, Hassan First University, Faculty of Sciences and Techniques, Settat, Morocco"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"179","published-online":{"date-parts":[[2022,6,6]]},"reference":[{"key":"ref001","doi-asserted-by":"publisher","DOI":"10.1007\/s10489-018-1349-1"},{"key":"ref002","doi-asserted-by":"publisher","DOI":"10.1145\/3407023.3407030"},{"key":"ref003","unstructured":"A.\u00a0Aviv, J.\u00a0Adam and A.\u00a0Haeberlen, Challenges in experimenting with botnet detection systems, in: 4th Workshop on Cyber Security Experimentation and Test, 2011, pp.\u00a06\u20136."},{"key":"ref004","doi-asserted-by":"publisher","DOI":"10.1016\/j.isprsjprs.2016.01.011"},{"key":"ref005","doi-asserted-by":"publisher","DOI":"10.1109\/52.43044"},{"key":"ref006","doi-asserted-by":"publisher","DOI":"10.1109\/81.222795"},{"key":"ref007","unstructured":"T.\u00a0Drabas and D.\u00a0Lee, Learning PySpark, Packt Publishing Ltd, 2017."},{"key":"ref008","doi-asserted-by":"publisher","DOI":"10.1109\/HRI.2013.6483609"},{"key":"ref009","unstructured":"A.\u00a0Gulli and S.\u00a0Pal, Deep Learning with Keras, Packt Publishing Ltd, 2017."},{"key":"ref010","doi-asserted-by":"publisher","DOI":"10.1145\/2815675.2815706"},{"key":"ref011","doi-asserted-by":"publisher","DOI":"10.3389\/fnhum.2013.00279"},{"key":"ref012","doi-asserted-by":"publisher","DOI":"10.1162\/neco.1997.9.8.1735"},{"key":"ref013","first-page":"1","author":"Kancherla D.","year":"2019","journal-title":"Int. J. Recent Technol."},{"key":"ref014","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-01244-0_27"},{"key":"ref015","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2891588"},{"key":"ref016","doi-asserted-by":"publisher","DOI":"10.1145\/2815675.2815693"},{"key":"ref017","unstructured":"D.\u00a0Luz and P.\u00a0Marques, Botnet Detection Using Passive DNS, Radboud University, Nijmegen, The Netherlands, 2014."},{"key":"ref018","doi-asserted-by":"publisher","DOI":"10.4236\/jcc.2015.35021"},{"key":"ref019","unstructured":"W.\u00a0McKinneypandas, A foundational Python library for data analysis and statistics,\n                      Python for high performance and scientific computing\n                      (2011), 1\u20139."},{"key":"ref020","first-page":"1235","volume":"17","author":"Meng X.","year":"2016","journal-title":"The Journal of Machine Learning Research"},{"key":"ref021","doi-asserted-by":"publisher","DOI":"10.2139\/ssrn.3415956"},{"key":"ref022","doi-asserted-by":"publisher","DOI":"10.1016\/j.ress.2021.108048"},{"key":"ref023","doi-asserted-by":"publisher","DOI":"10.1155\/2021\/4832864"},{"key":"ref024","doi-asserted-by":"publisher","DOI":"10.1038\/nbt1206-1565"},{"key":"ref025","unstructured":"P.\u00a0Porras, H.\u00a0Saidi and V.\u00a0Yegneswaran, An Analysis of Conficker\u2019s Logic and Rendezvous Points, Computer Science Laboratory, SRI International, Tech, 2009, p.\u00a036."},{"key":"ref026","doi-asserted-by":"publisher","DOI":"10.1016\/S0020-7373(87)80053-6"},{"key":"ref027","doi-asserted-by":"publisher","DOI":"10.1016\/j.isprsjprs.2011.11.002"},{"key":"ref028","doi-asserted-by":"publisher","DOI":"10.1007\/0-387-25465-X-9"},{"key":"ref029","doi-asserted-by":"publisher","DOI":"10.1007\/s42979-021-00815-1"},{"key":"ref030","unstructured":"J.\u00a0Saxe and K.\u00a0Berlin, A character-level convolutional neural network with embeddings for detecting malicious urls, file paths and registry keys, 2017, arXiv preprint."},{"key":"ref031","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-08509-8_11"},{"key":"ref032","first-page":"1165","volume":"18","author":"Sch\u00fcppen S.","year":"2018","journal-title":"In 27th USENIX Security Symposium (USENIX Security"},{"key":"ref033","doi-asserted-by":"publisher","DOI":"10.1155\/2021\/4767388"},{"key":"ref034","unstructured":"A.\u00a0Spark, \u201cApache spark.\u201d Retrieved January 17 2018, 2018."},{"key":"ref035","doi-asserted-by":"publisher","DOI":"10.1145\/2786984.2786995"},{"key":"ref036","doi-asserted-by":"publisher","DOI":"10.1016\/j.cie.2021.107174"},{"key":"ref037","unstructured":"J.\u00a0Woodbridge, H.S.\u00a0Anderson, A.\u00a0Ahuja and D.\u00a0Grant, Predicting domain generation algorithms with long short-term memory networks, 2016, arXiv preprint."},{"key":"ref038","doi-asserted-by":"publisher","DOI":"10.1109\/ICDMW.2017.96"},{"key":"ref039","doi-asserted-by":"publisher","DOI":"10.1145\/956750.956786"},{"key":"ref040","doi-asserted-by":"publisher","DOI":"10.1007\/s12665-009-0292-1"},{"key":"ref041","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2020.101719"},{"key":"ref042","doi-asserted-by":"publisher","DOI":"10.1145\/3357223.3365870"},{"key":"ref043","doi-asserted-by":"publisher","DOI":"10.1155\/2014\/376950"},{"key":"ref044","first-page":"327","author":"Zupan J.","year":"1994","journal-title":"Acta Chimica Slovenica"}],"container-title":["Journal of Computer Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/journals.sagepub.com\/doi\/pdf\/10.3233\/JCS-210139","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/journals.sagepub.com\/doi\/full-xml\/10.3233\/JCS-210139","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/journals.sagepub.com\/doi\/pdf\/10.3233\/JCS-210139","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,4,29]],"date-time":"2026-04-29T20:45:42Z","timestamp":1777495542000},"score":1,"resource":{"primary":{"URL":"https:\/\/journals.sagepub.com\/doi\/10.3233\/JCS-210139"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,6,6]]},"references-count":44,"journal-issue":{"issue":"1","published-print":{"date-parts":[[2023,1,26]]}},"alternative-id":["10.3233\/JCS-210139"],"URL":"https:\/\/doi.org\/10.3233\/jcs-210139","relation":{},"ISSN":["0926-227X","1875-8924"],"issn-type":[{"value":"0926-227X","type":"print"},{"value":"1875-8924","type":"electronic"}],"subject":[],"published":{"date-parts":[[2022,6,6]]}}}