{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,24]],"date-time":"2026-04-24T21:07:41Z","timestamp":1777064861524,"version":"3.51.4"},"reference-count":32,"publisher":"MDPI AG","issue":"5","license":[{"start":{"date-parts":[[2019,4,27]],"date-time":"2019-04-27T00:00:00Z","timestamp":1556323200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Information"],"abstract":"<jats:p>Domain generation algorithms (DGAs) represent a class of malware used to generate large numbers of new domain names to achieve command-and-control (C2) communication between the malware program and its C2 server to avoid detection by cybersecurity measures. Deep learning has proven successful in serving as a mechanism to implement real-time DGA detection, specifically through the use of recurrent neural networks (RNNs) and convolutional neural networks (CNNs). This paper compares several state-of-the-art deep-learning implementations of DGA detection found in the literature with two novel models: a deeper CNN model and a one-dimensional (1D) Capsule Networks (CapsNet) model. The comparison shows that the 1D CapsNet model performs as well as the best-performing model from the literature.<\/jats:p>","DOI":"10.3390\/info10050157","type":"journal-article","created":{"date-parts":[[2019,4,29]],"date-time":"2019-04-29T02:57:32Z","timestamp":1556506652000},"page":"157","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":32,"title":["DGA CapsNet: 1D Application of Capsule Networks to DGA Detection"],"prefix":"10.3390","volume":"10","author":[{"given":"Daniel S.","family":"Berman","sequence":"first","affiliation":[{"name":"Johns Hopkins University Applied Physics Laboratory (JHU\/APL1), Laurel, MD 20723, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2019,4,27]]},"reference":[{"key":"ref_1","unstructured":"(2019, April 23). Domain Generation Algorithm (DGA). Available online: https:\/\/searchsecurity.techtarget.com\/definition\/domain-generation-algorithm-DGA."},{"key":"ref_2","unstructured":"McGrath, D.K., and Gupta, M. (2008, January 15). Behind Phishing: An Examination of Phisher Modi Operandi. Proceedings of the First USENIX Workshop on Large-Scale Exploits and Emergent Threats, LEET \u201808, San Francisco, CA, USA."},{"key":"ref_3","unstructured":"Bilge, L., Kirda, E., Kruegel, C., and Balduzzi, M. (2011, January 6\u20139). EXPOSURE: Finding Malicious Domains Using Passive DNS Analysis. Proceedings of the Network and Distributed System Security Symposium, NDSS 2011, San Diego, CA, USA."},{"key":"ref_4","unstructured":"Ma, J., Saul, L.K., Savage, S., and Voelker, G.M. (July, January 28). Beyond blacklists: Learning to detect malicious web sites from suspicious URLs. Proceedings of the 15th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, Paris, France."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"1663","DOI":"10.1109\/TNET.2012.2184552","article-title":"Detecting algorithmically generated domain-flux attacks with DNS traffic analysis","volume":"20","author":"Yadav","year":"2012","journal-title":"IEEE\/ACM Trans. Netw."},{"key":"ref_6","unstructured":"Antonakakis, M., Perdisci, R., Nadji, Y., Vasiloglou, N., Abu-Nimeh, S., Lee, W., and Dagon, D. (2012, January 8\u201310). From Throw-Away Traffic to Bots: Detecting the Rise of DGA-Based Malware. Proceedings of the 21st USENIX Security Symposium, Bellevue, WA, USA."},{"key":"ref_7","first-page":"51","article-title":"Classification of malicious domain names using support vector machine and bi-gram method","volume":"7","author":"Nhauo","year":"2013","journal-title":"J. Secur. Appl."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Demertzis, K., and Iliadis, L. (2015). Evolving smart URL filter in a zone-based policy firewall for detecting algorithmically generated malicious domains. International Symposium on Statistical Learning and Data Sciences, Springer.","DOI":"10.1007\/978-3-319-17091-6_17"},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Shibahara, T., Yamanishi, K., Takata, Y., Chiba, D., Akiyama, M., Yagi, T., Ohsita, Y., and Murata, M. (2017, January 21\u201325). Malicious URL sequence detection using event de-noising convolutional neural network. Proceedings of the 2017 IEEE International Conference on Communications, Paris, France.","DOI":"10.1109\/ICC.2017.7996831"},{"key":"ref_10","unstructured":"Woodbridge, J., Anderson, H.S., Ahuja, A., and Grant, D. (2016). Predicting domain generation algorithms with long short-term memory networks. arXiv preprint."},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Mac, H., Tran, D., Tong, V., Nguyen, L.G., and Tran, H.A. (2017, January 7\u20138). DGA Botnet Detection Using Supervised Learning Methods. Proceedings of the Eighth Symposium on Information and Communication Technology (SoICT 2017), Nha Trang, Vietnam.","DOI":"10.1145\/3155133.3155166"},{"key":"ref_12","unstructured":"Lison, P., and Mavroeidis, V. (2017). Automatic Detection of Malware-Generated Domains with Recurrent Neural Models. arXiv preprint."},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Yu, B., Gray, D.L., Pan, J., De Cock, M., and Nascimento, A.C.A. (2017, January 18\u201321). Inline DGA detection with deep networks. Proceedings of the 2017 IEEE International Conference on Data Mining Workshops (ICDMW), New Orleans, LA, USA.","DOI":"10.1109\/ICDMW.2017.96"},{"key":"ref_14","first-page":"67","article-title":"Classification for DGA-Based Malicious Domain Names with Deep Learning Architectures","volume":"6","author":"Zeng","year":"2017","journal-title":"Int. J. Intell. Inf. Syst."},{"key":"ref_15","unstructured":"Saxe, J., and Berlin, K. (2017). eXpose: A character-level convolutional neural network with embeddings for detecting malicious URLs, file paths and registry keys. arXiv preprint."},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"2401","DOI":"10.1016\/j.neucom.2017.11.018","article-title":"A LSTM based framework for handling multiclass imbalance in DGA botnet detection","volume":"275","author":"Tran","year":"2018","journal-title":"Neurocomputing"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Yu, B., Pan, J., Hu, J., Nascimento, A., and De Cock, M. (2018, January 8\u201313). Character level based detection of DGA domain names. Proceedings of the 2018 International Joint Conference on Neural Networks (IJCNN), Rio, Brazil.","DOI":"10.1109\/IJCNN.2018.8489147"},{"key":"ref_18","unstructured":"Zhao, W., Ye, J., Yang, M., Lei, Z., Zhang, S., and Zhao, Z. (2018). Investigating capsule networks with dynamic routing for text classification. arXiv preprint."},{"key":"ref_19","first-page":"1137","article-title":"A neural probabilistic language model","volume":"3","author":"Bengio","year":"2003","journal-title":"J. Mach. Learn. Res."},{"key":"ref_20","unstructured":"LeCun, Y., Boser, B.E., Denker, J.S., Henderson, D., Howard, R.E., Hubbard, W.E., and Jackel, L.D. (1990, January 26\u201329). Handwritten digit recognition with a back-propagation network. Proceedings of the Advances in Neural Information Processing Systems, Denver, CO, USA."},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"2278","DOI":"10.1109\/5.726791","article-title":"Gradient-based learning applied to document recognition","volume":"86","author":"LeCun","year":"1998","journal-title":"Proc. IEEE"},{"key":"ref_22","doi-asserted-by":"crossref","unstructured":"Kim, Y. (2014). Convolutional neural networks for sentence classification. arXiv.","DOI":"10.3115\/v1\/D14-1181"},{"key":"ref_23","first-page":"1929","article-title":"Dropout: A simple way to prevent neural networks from overfitting","volume":"15","author":"Srivastava","year":"2014","journal-title":"J. Mach. Learn. Res."},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Tompson, J., Goroshin, R., Jain, A., LeCun, Y., and Bregler, C. (2015, January 7\u201312). Efficient object localization using convolutional networks. Proceedings of the 28th IEEE Conference on Computer Vision and Pattern Recognition, Boston, MA, USA.","DOI":"10.1109\/CVPR.2015.7298664"},{"key":"ref_25","unstructured":"Sabour, S., Frosst, N., and Hinton, G.E. (2017, January 4\u20139). Dynamic routing between capsules. Proceedings of the Annual Conference on Neural Information Processing Systems 2017, Long Beach, CA, USA."},{"key":"ref_26","doi-asserted-by":"crossref","first-page":"1735","DOI":"10.1162\/neco.1997.9.8.1735","article-title":"Long short-term memory","volume":"9","author":"Hochreiter","year":"1997","journal-title":"Neural Comput."},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"157","DOI":"10.1109\/72.279181","article-title":"Learning long-term dependencies with gradient descent is difficult","volume":"5","author":"Bengio","year":"1994","journal-title":"IEEE Trans. Neural Netw."},{"key":"ref_28","unstructured":"(2019, April 24). CapsNet-Keras. Available online: https:\/\/github.com\/XifengGuo\/CapsNet-Keras."},{"key":"ref_29","unstructured":"Kingma, D.P., and Ba, J. (2014). Adam: A method for stochastic optimization. arXiv preprint."},{"key":"ref_30","unstructured":"(2018, May 25). Does Alexa have a list of its top-ranked websites?. Available online: https:\/\/support.alexa.com\/hc\/en-us\/articles\/200449834-Does-Alexa-have-a-list-of-its-top-ranked-websites."},{"key":"ref_31","unstructured":"(2018, May 22). Bambenek Consulting\u2014Master Feeds. Available online: http:\/\/osint.bambenekconsulting.com\/feeds\/."},{"key":"ref_32","doi-asserted-by":"crossref","unstructured":"Berman, D.S., Buczak, A.L., Chavis, J.S., and Corbett, C.L. (2019). A survey of Deep Learning Methods for Cyber Security. Information, 10.","DOI":"10.3390\/info10040122"}],"container-title":["Information"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2078-2489\/10\/5\/157\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T12:47:35Z","timestamp":1760186855000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2078-2489\/10\/5\/157"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019,4,27]]},"references-count":32,"journal-issue":{"issue":"5","published-online":{"date-parts":[[2019,5]]}},"alternative-id":["info10050157"],"URL":"https:\/\/doi.org\/10.3390\/info10050157","relation":{},"ISSN":["2078-2489"],"issn-type":[{"value":"2078-2489","type":"electronic"}],"subject":[],"published":{"date-parts":[[2019,4,27]]}}}