{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,2]],"date-time":"2026-01-02T07:44:49Z","timestamp":1767339889306,"version":"build-2065373602"},"reference-count":23,"publisher":"MDPI AG","issue":"7","license":[{"start":{"date-parts":[[2022,7,13]],"date-time":"2022-07-13T00:00:00Z","timestamp":1657670400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"2020 Fundamental Research Funds for the National Key R&amp;D Program","award":["2020AAA0107700","2020JKF101"],"award-info":[{"award-number":["2020AAA0107700","2020JKF101"]}]},{"name":"2020 Fundamental Research Funds for the Central Universities of PPSUC","award":["2020AAA0107700","2020JKF101"],"award-info":[{"award-number":["2020AAA0107700","2020JKF101"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Future Internet"],"abstract":"<jats:p>Domain name generation algorithms are widely used in malware, such as botnet binaries, to generate large sequences of domain names of which some are registered by cybercriminals. Accurate detection of malicious domains can effectively defend against cyber attacks. The detection of such malicious domain names by the use of traditional machine learning algorithms has been explored by many researchers, but still is not perfect. To further improve on this, we propose a novel parallel detection model named N-Trans that is based on the N-gram algorithm with the Transformer model. First, we add flag bits to the first and last positions of the domain name for the parallel combination of the N-gram algorithm and Transformer framework to detect a domain name. The model can effectively extract the letter combination features and capture the position features of letters in the domain name. It can capture features such as the first and last letters in the domain name and the position relationship between letters. In addition, it can accurately distinguish between legitimate and malicious domain names. In the experiment, the dataset is the legal domain name of Alexa and the malicious domain name collected by the 360 Security Lab. The experimental results show that the parallel detection model based on N-gram and Transformer achieves 96.97% accuracy for DGA malicious domain name detection. It can effectively and accurately identify malicious domain names and outperforms the mainstream malicious domain name detection algorithms.<\/jats:p>","DOI":"10.3390\/fi14070209","type":"journal-article","created":{"date-parts":[[2022,7,13]],"date-time":"2022-07-13T22:06:00Z","timestamp":1657749960000},"page":"209","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":13,"title":["N-Trans: Parallel Detection Algorithm for DGA Domain Names"],"prefix":"10.3390","volume":"14","author":[{"given":"Cheng","family":"Yang","sequence":"first","affiliation":[{"name":"College of Information and Cyber Security, People\u2019s Public Security University of China, Beijing 100038, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Tianliang","family":"Lu","sequence":"additional","affiliation":[{"name":"College of Information and Cyber Security, People\u2019s Public Security University of China, Beijing 100038, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Shangyi","family":"Yan","sequence":"additional","affiliation":[{"name":"College of Information and Cyber Security, People\u2019s Public Security University of China, Beijing 100038, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jianling","family":"Zhang","sequence":"additional","affiliation":[{"name":"College of Information and Cyber Security, People\u2019s Public Security University of China, Beijing 100038, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Xingzhan","family":"Yu","sequence":"additional","affiliation":[{"name":"College of Information and Cyber Security, People\u2019s Public Security University of China, Beijing 100038, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2022,7,13]]},"reference":[{"key":"ref_1","unstructured":"China Internet Network Information Center (2022, April 01). The 47th Statistical Report on the Development Status of the Internet in China, Available online: http:\/\/www.cnnic.cn\/hlwfzyj\/hlwxzbg\/hlwtjbg\/202202\/P020220407403488048001.pdf."},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"82","DOI":"10.3724\/SP.J.1001.2012.04101","article-title":"Research on botnet mechanisms and defenses","volume":"23","author":"Jiang","year":"2012","journal-title":"J. Softw."},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Li, K., Yu, X., and Wang, J. (2021, January 19\u201323). A Review: How to Detect Malicious Domains. Proceedings of the International Conference on Artificial Intelligence and Security, Dublin, Ireland.","DOI":"10.1007\/978-3-030-78621-2_12"},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Yadav, S., Reddy, A.K.K., Reddy, A.N., and Ranjan, S. (2010, January 1\u201330). Detecting algorithmically generated malicious domain name names. Proceedings of the 10th ACM SIGCOMM Conference on Internet Measurement, Melbourne Australia.","DOI":"10.1145\/1879141.1879148"},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Agyepong, E., Buchanan, W.J., and Jones, K. (2017, January 24\u201325). Detection of algorithmically generated malicious domain name. Proceedings of the 6th International Conference of Advanced Computer Science and Information Technology, Zurich, Switzerland.","DOI":"10.5121\/csit.2018.80802"},{"key":"ref_6","unstructured":"Wang, H.K., Zhang, X.D., Yang, W.Y., Ma, Z.C., Liao, P., Huang, Y.B., Yu, X.W., Zhang, D., Xia, W., and Song, W.J. (2016). Random Forest Based DGA Domain Name Name Detection Method: China. (CN105577660A)."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"1347","DOI":"10.1007\/s11063-017-9666-7","article-title":"Malicious domain name name detection based on extreme machine learning","volume":"48","author":"Shi","year":"2018","journal-title":"Neural Process. Lett."},{"key":"ref_8","first-page":"30","article-title":"Deep model for DGA botnet detection based on word-hashing","volume":"47","author":"Zhao","year":"2017","journal-title":"J. Southeast Univ. Nat. Sci. Ed."},{"key":"ref_9","unstructured":"Huang, P.S., He, X., Gao, J., Deng, L., Acero, A., and Heck, L. (November, January 27). Learning deep structured semantic models for web search using clickthrough data. Proceedings of the 22nd ACM International Conference on Information and Knowledge Management, San Francisco, CA, USA."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"2946","DOI":"10.1109\/TNSE.2021.3055762","article-title":"Hierarchical bidirectional RNN for safety-enhanced b5g heterogeneous networks","volume":"8","author":"Xu","year":"2021","journal-title":"IEEE Trans. Netw. Sci. Eng."},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Ghosh, I., Kumar, S., Bhatia, A., and Vishwakarma, D.K. (2021, January 13\u201316). Using auxiliary inputs in deep learning models for detecting DGA-based domain name names. Proceedings of the 2021 International Conference on Information Networking, Jeju Island, Korea.","DOI":"10.1109\/ICOIN50884.2021.9333979"},{"key":"ref_12","unstructured":"Rudd, E.M., Ducau, F.N., Wild, C., Berlin, K., and Harang, R. (2019, January 14\u201316). ALOHA: Auxiliary Loss Optimization for Hypothesis Augmentation. Proceedings of the 28th USENIX Security Symposium, Santa Clara, CA, USA."},{"key":"ref_13","first-page":"41","article-title":"DGA malicious domain name name detection method based on fusion of CNN and LSTM","volume":"21","author":"Xu","year":"2021","journal-title":"Netinfo Secur."},{"key":"ref_14","first-page":"2944","article-title":"Malicious domain name name detection model based on CNN and LSTM","volume":"43","author":"Zhang","year":"2021","journal-title":"J. Electron. Inf. Technol."},{"key":"ref_15","unstructured":"Wang, T.T., and Liu, X.F. (2021). A Phased Malicious Domain Name Detection Algorithm. J. Chin. Comput. Syst., 1\u20136. Available online: http:\/\/kns.cnki.net\/kcms\/detail\/21.1106.TP.20210818.1358.051.html."},{"key":"ref_16","first-page":"411","article-title":"A DGA domain name name detection method based on Transformer","volume":"42","author":"Zhang","year":"2020","journal-title":"Comput. Eng. Sci."},{"key":"ref_17","unstructured":"Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A.N., Kaiser, \u0141., and Polosukhin, I. (2017). Attention is all you need. Advances in Neural Information Processing Systems, MIT Press."},{"key":"ref_18","unstructured":"Amazon Web Services, Inc. (2021, December 10). AWS\u2013Alexa Top Sites\u2014Up-to-Date Lists of the Top Sites on the Web. Available online: https:\/\/aws.amazon.com\/alexa-top-sites\/."},{"key":"ref_19","unstructured":"(2021, December 10). DGA\u2013Netlab OpenData Project. Available online: https:\/\/data.netlab.360.com\/dga\/."},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Vranken, H., and Alizadeh, H. (2022). Detection of DGA-Generated Domain Names with TF-IDF. Electronics, 11.","DOI":"10.3390\/electronics11030414"},{"key":"ref_21","unstructured":"Chailytko, A., and Trafimchuk, A. (2015). DGA clustering and analysis: Mastering modern, evolving threats. J. Cybercrime Digit. Investig., 1."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"463","DOI":"10.1142\/S0219622021500619","article-title":"Pointer-based item-to-item collaborative filtering recommendation system using a machine learning model","volume":"21","author":"Iwendi","year":"2022","journal-title":"Int. J. Inf. Technol. Decis. Mak."},{"key":"ref_23","first-page":"6","article-title":"Generation of malicious domain name training data based on improved Char-RNN model","volume":"20","author":"Wu","year":"2020","journal-title":"Netinfo Secur."}],"container-title":["Future Internet"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1999-5903\/14\/7\/209\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T23:49:46Z","timestamp":1760140186000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1999-5903\/14\/7\/209"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,7,13]]},"references-count":23,"journal-issue":{"issue":"7","published-online":{"date-parts":[[2022,7]]}},"alternative-id":["fi14070209"],"URL":"https:\/\/doi.org\/10.3390\/fi14070209","relation":{},"ISSN":["1999-5903"],"issn-type":[{"type":"electronic","value":"1999-5903"}],"subject":[],"published":{"date-parts":[[2022,7,13]]}}}