{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,23]],"date-time":"2025-12-23T10:44:49Z","timestamp":1766486689521,"version":"build-2065373602"},"reference-count":39,"publisher":"MDPI AG","issue":"9","license":[{"start":{"date-parts":[[2020,9,22]],"date-time":"2020-09-22T00:00:00Z","timestamp":1600732800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100001809","name":"The National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61672158, 61672159, 61502104, 61502105"],"award-info":[{"award-number":["61672158, 61672159, 61502104, 61502105"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"name":"The Industry-Academy Cooperation Project of Fujian Province","award":["2018H6010"],"award-info":[{"award-number":["2018H6010"]}]},{"name":"The Technology Guidance Project of Fujian Province","award":["2017H0015"],"award-info":[{"award-number":["2017H0015"]}]},{"name":"The Fujian Collaborative Innovation Center for Big Data Application in Governments","award":["-"],"award-info":[{"award-number":["-"]}]},{"name":"The Foundation of the Education Department of Fujian Province, China","award":["JAT190025"],"award-info":[{"award-number":["JAT190025"]}]},{"name":"Fujian Province High-level Talents and Young Talents Visiting and Training Subsidy Program","award":["-"],"award-info":[{"award-number":["-"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Entropy"],"abstract":"<jats:p>Domain generation algorithms (DGAs) use specific parameters as random seeds to generate a large number of random domain names to prevent malicious domain name detection. This greatly increases the difficulty of detecting and defending against botnets and malware. Traditional models for detecting algorithmically generated domain names generally rely on manually extracting statistical characteristics from the domain names or network traffic and then employing classifiers to distinguish the algorithmically generated domain names. These models always require labor intensive manual feature engineering. In contrast, most state-of-the-art models based on deep neural networks are sensitive to imbalance in the sample distribution and cannot fully exploit the discriminative class features in domain names or network traffic, leading to decreased detection accuracy. To address these issues, we employ the borderline synthetic minority over-sampling algorithm (SMOTE) to improve sample balance. We also propose a recurrent convolutional neural network with spatial pyramid pooling (RCNN-SPP) to extract discriminative and distinctive class features. The recurrent convolutional neural network combines a convolutional neural network (CNN) and a bi-directional long short-term memory network (Bi-LSTM) to extract both the semantic and contextual information from domain names. We then employ the spatial pyramid pooling strategy to refine the contextual representation by capturing multi-scale contextual information from domain names. The experimental results from different domain name datasets demonstrate that our model can achieve 92.36% accuracy, an 89.55% recall rate, a 90.46% F1-score, and 95.39% AUC in identifying DGA and legitimate domain names, and it can achieve 92.45% accuracy rate, a 90.12% recall rate, a 90.86% F1-score, and 96.59% AUC in multi-classification problems. It achieves significant improvement over existing models in terms of accuracy and robustness.<\/jats:p>","DOI":"10.3390\/e22091058","type":"journal-article","created":{"date-parts":[[2020,9,22]],"date-time":"2020-09-22T09:40:56Z","timestamp":1600767656000},"page":"1058","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":12,"title":["Detection of Algorithmically Generated Domain Names Using the Recurrent Convolutional Neural Network with Spatial Pyramid Pooling"],"prefix":"10.3390","volume":"22","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-5913-3647","authenticated-orcid":false,"given":"Zhanghui","family":"Liu","sequence":"first","affiliation":[{"name":"Fujian Key Laboratory of Network Computing and Intelligent Information Processing, College of Mathematics and Computer Science, Fuzhou University, Fuzhou 350116, China"},{"name":"Key Laboratory of Spatial Data Mining &amp; Information Sharing, Ministry of Education, Fuzhou 350116, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yudong","family":"Zhang","sequence":"additional","affiliation":[{"name":"Fujian Key Laboratory of Network Computing and Intelligent Information Processing, College of Mathematics and Computer Science, Fuzhou University, Fuzhou 350116, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7408-2684","authenticated-orcid":false,"given":"Yuzhong","family":"Chen","sequence":"additional","affiliation":[{"name":"Fujian Key Laboratory of Network Computing and Intelligent Information Processing, College of Mathematics and Computer Science, Fuzhou University, Fuzhou 350116, China"},{"name":"Key Laboratory of Spatial Data Mining &amp; Information Sharing, Ministry of Education, Fuzhou 350116, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4334-1844","authenticated-orcid":false,"given":"Xinwen","family":"Fan","sequence":"additional","affiliation":[{"name":"Fujian Key Laboratory of Network Computing and Intelligent Information Processing, College of Mathematics and Computer Science, Fuzhou University, Fuzhou 350116, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7546-3403","authenticated-orcid":false,"given":"Chen","family":"Dong","sequence":"additional","affiliation":[{"name":"Fujian Key Laboratory of Network Computing and Intelligent Information Processing, College of Mathematics and Computer Science, Fuzhou University, Fuzhou 350116, China"},{"name":"Key Laboratory of Spatial Data Mining &amp; Information Sharing, Ministry of Education, Fuzhou 350116, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2020,9,22]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","first-page":"14","DOI":"10.1145\/2584679","article-title":"Exposure: A Passive DNS Analysis Service to Detect and Report Malicious Domains","volume":"16","author":"Bilge","year":"2014","journal-title":"ACM Trans. Inf. Syst. Secur."},{"key":"ref_2","doi-asserted-by":"crossref","unstructured":"Schiavoni, S., Maggi, F., Cavallaro, L., and Zanero, S. (2014, January 10\u201311). Phoenix: DGA-Based Botnet Tracking and Intelligence. Proceedings of the 11th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, Egham, UK.","DOI":"10.1007\/978-3-319-08509-8_11"},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Choi, H., Lee, H., Lee, H., and Kim, H. (2007, January 16\u201319). Botnet Detection by Monitoring Group Activities in DNS Traffic. Proceedings of the 7th IEEE International Conference on Computer and Information Technology (CIT 2007), Aizu-Wakamatsu, Japan.","DOI":"10.1109\/CIT.2007.90"},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"82","DOI":"10.3724\/SP.J.1001.2012.04101","article-title":"Research on Botnet Mechanisms and Defenses","volume":"23","author":"Jiang","year":"2012","journal-title":"J. Softw."},{"key":"ref_5","first-page":"841","article-title":"Effectively Mining Network Traffic Intelligence to Detect Malicious Stealthy Port Scanning to Cloud Servers","volume":"15","author":"Qu","year":"2014","journal-title":"J. Internet Technol."},{"key":"ref_6","first-page":"405","article-title":"An Automatic Extraction Approach of Worm Signatures Based on Behavioral Footprint Analysis","volume":"15","author":"Zhou","year":"2014","journal-title":"J. Internet Technol."},{"key":"ref_7","doi-asserted-by":"crossref","unstructured":"Shibahara, T., Yagi, T., Akiyama, M., Chiba, D., and Yada, T. (2016, January 4\u20138). Efficient Dynamic Malware Analysis Based on Network Behavior Using Deep Learning. Proceedings of the IEEE Global Communications Conference, Washington, DC, USA.","DOI":"10.1109\/GLOCOM.2016.7841778"},{"key":"ref_8","first-page":"2269","article-title":"A Comparative and Comprehensive Analysis of Perinatal and Neonatal Death Using Repeated Measurement: A Malaysia Case Study","volume":"8","author":"Ahmad","year":"2014","journal-title":"Appl. Math. Sci."},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Kuhrer, M., Rossow, C., and Holz, T. (2014). Paint It Black: Evaluating the Effectiveness of Malware Blacklists. Research in Attacks, Intrusions, and Defenses, Springer.","DOI":"10.1007\/978-3-319-11379-1_1"},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1016\/j.cose.2016.10.001","article-title":"DBod: Clustering and detecting DGA-based botnets using DNS traffic analysis","volume":"64","author":"Wang","year":"2017","journal-title":"Comput. Secur."},{"key":"ref_11","first-page":"217","article-title":"Detecting DGA-Based Botnet with DNS Traffic Analysis in Monitored Network","volume":"17","author":"Truong","year":"2016","journal-title":"J. Internet Technol."},{"key":"ref_12","unstructured":"Schuppen, S., Teubert, D., Herrmann, P., and Meyer, U. (2018, January 15\u201317). FANCI: Feature-based Automated NXDomain Classification and Intelligence. Proceedings of the 27th USENIX Security Symposium (USENIX Security 18), Baltimore, MD, USA."},{"key":"ref_13","first-page":"15","article-title":"Detecting malicious domain names based on AGD","volume":"39","author":"Zang","year":"2018","journal-title":"J. Commun."},{"key":"ref_14","unstructured":"Antonakakis, M., Perdisci, R., Nadji, Y., Vasiloglou, N., and Dagon, D. (2012, January 8\u201310). From Throw-Away Traffic to Bots: Detecting the Rise of DGA-Based Malware. Proceedings of the 21st USENIX Security Symposium, Bellevue, WA, USA."},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Yadav, S., Reddy, A.K.K., Reddy, A.N., and Ranjan, S. (2010, January 1\u20133). Detecting Algorithmically Generated Malicious Domain Names. Proceedings of the 10th ACM SIGCOMM Conference on Internet Measurement, Melbourne, Australia.","DOI":"10.1145\/1879141.1879148"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"79","DOI":"10.1214\/aoms\/1177729694","article-title":"On Information and Sufficiency","volume":"22","author":"Kullback","year":"1951","journal-title":"Ann. Math. Stat."},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"37","DOI":"10.1111\/j.1469-8137.1912.tb05611.x","article-title":"The Distribution of the Flora in The Alpine Zone.1","volume":"11","author":"Jaccard","year":"1912","journal-title":"New Phytol."},{"key":"ref_18","first-page":"8","article-title":"Binary codes capable of correcting spurious insertions and deletions of ones","volume":"1","author":"Levenshtein","year":"1965","journal-title":"Probl. Inf. Transm."},{"key":"ref_19","doi-asserted-by":"crossref","unstructured":"Yang, L., Zhai, J., Liu, W., Ji, X., Bai, H., Liu, G., and Dai, Y. (2019). Detecting Word-Based Algorithmically Generated Domains Using Semantic Analysis. Symmetry, 11.","DOI":"10.3390\/sym11020176"},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"32765","DOI":"10.1109\/ACCESS.2019.2891588","article-title":"A Machine Learning Framework for Domain Generation Algorithm (DGA)-Based Malware Detection","volume":"7","author":"Li","year":"2019","journal-title":"IEEE Access"},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"423","DOI":"10.1016\/j.jare.2014.01.001","article-title":"Unsupervised, low latency anomaly detection of algorithmically generated domain names by generative probabilistic modeling","volume":"5","author":"Raghuram","year":"2014","journal-title":"J. Adv. Res."},{"key":"ref_22","unstructured":"Woodbridge, J., Anderson, H.S., Ahuja, A., and Grant, D. (2016). Predicting Domain Generation Algorithms with Long Short-Term Memory Networks. Cryptogr. Secur., Available online: https:\/\/arxiv.org\/abs\/1611.00791."},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Curtin, R., Gardner, A., Grzonkowski, S., Kleymenov, A., and Mosquera, A. (2019, January 26\u201329). Detecting DGA domains with recurrent neural networks and side information. Proceedings of the 14th International Conference on Availability, Reliability and Security, Canterbury, UK.","DOI":"10.1145\/3339252.3339258"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Yu, B., Gray, D.L., Jie, P., Cock, M.D., and Nascimento, A.C.A. (2017, January 18\u201321). Inline DGA Detection with Deep Networks. Proceedings of the IEEE International Conference on Data Mining Workshops (ICDMW), New Orleans, LA, USA.","DOI":"10.1109\/ICDMW.2017.96"},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"51542","DOI":"10.1109\/ACCESS.2019.2911522","article-title":"Weakly Supervised Deep Learning for the Detection of Domain Generation Algorithms","volume":"7","author":"Yu","year":"2019","journal-title":"IEEE Access"},{"key":"ref_26","first-page":"67","article-title":"Classification for DGA-Based Malicious Domain Names with Deep Learning Architectures","volume":"6","author":"Zeng","year":"2017","journal-title":"Int. J. Intell. Inf. Syst."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"249","DOI":"10.1016\/j.neunet.2018.07.011","article-title":"A systematic study of the class imbalance problem in convolutional neural networks","volume":"106","author":"Buda","year":"2018","journal-title":"Neural Netw."},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Han, H., Wang, W.Y., and Mao, B.H. (2005, January 23\u201326). Borderline-SMOTE: A New Over-Sampling Method in Imbalanced Data Sets Learning. Proceedings of the International Conference on Intelligent Computing, Hefei, China.","DOI":"10.1007\/11538059_91"},{"key":"ref_29","first-page":"801","article-title":"Dynamic Pooling and Unfolding Recursive Autoencoders for Paraphrase Detection","volume":"24","author":"Socher","year":"2011","journal-title":"Adv. Neural Inf. Process. Syst."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Lai, S., Xu, L., Liu, K., and Zhao, J. (2015, January 25\u201330). Recurrent convolutional neural networks for text classification. Proceedings of the 29th AAAI Conference on Artificial Intelligence and the 27th Innovative Applications of Artificial Intelligence Conference, Austin, TX, USA.","DOI":"10.1609\/aaai.v29i1.9513"},{"key":"ref_31","unstructured":"Zhou, Z. (2016). Machine Learning, Tsinghua University Press."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"19","DOI":"10.1007\/s10479-005-5724-z","article-title":"A Tutorial on the Cross-Entropy Method","volume":"134","author":"Kroese","year":"2005","journal-title":"Ann. Oper. Res."},{"key":"ref_33","unstructured":"(2020, August 27). 360DGA Page. Available online: https:\/\/data.netlab.360.com\/dga."},{"key":"ref_34","unstructured":"(2016, April 06). Bambenek-Consulting-Master-Feeds. Available online: http:\/\/osint.bambenekconsultin.com\/feeds\/."},{"key":"ref_35","unstructured":"(2020, August 17). Does Alexa Have a List of Its Top-Ranked Websites?. Available online: https:\/\/support.alexa.com\/hc\/enus\/articles\/200449834-Does-Alexa-have-a-list-of-its-top-ranked-websites."},{"key":"ref_36","unstructured":"Chollet, F. (2020, June 25). Keras. Available online: https:\/\/github.com\/fchollet\/keras."},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"4","DOI":"10.1186\/s42400-020-00046-6","article-title":"A DGA domain names detection modeling method based on integrating an attention mechanism and deep neural network","volume":"3","author":"Ren","year":"2020","journal-title":"Cybersecurity"},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Zhou, S., Lin, L., Yuan, J., Wang, F., Ling, Z., and Cui, J. (2019, January 1\u20133). CNN-based DGA Detection with High Coverage. Proceedings of the 2019 IEEE International Conference on Intelligence and Security Informatics (ISI), Shenzhen, China.","DOI":"10.1109\/ISI.2019.8823200"},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"Highnam, K., Puzio, D., Luo, S., and Jennings, N.R. (2020). Real-Time Detection of Dictionary DGA Network Traffic using Deep Learning. Comput. Sci., Available online: https:\/\/arxiv.org\/abs\/2003.12805.","DOI":"10.1007\/s42979-021-00507-w"}],"container-title":["Entropy"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1099-4300\/22\/9\/1058\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T10:12:15Z","timestamp":1760177535000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1099-4300\/22\/9\/1058"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2020,9,22]]},"references-count":39,"journal-issue":{"issue":"9","published-online":{"date-parts":[[2020,9]]}},"alternative-id":["e22091058"],"URL":"https:\/\/doi.org\/10.3390\/e22091058","relation":{},"ISSN":["1099-4300"],"issn-type":[{"type":"electronic","value":"1099-4300"}],"subject":[],"published":{"date-parts":[[2020,9,22]]}}}