{"id":"https://openalex.org/W4380686105","doi":"https://doi.org/10.1109/access.2023.3286313","title":"SHAP Interpretations of Tree and Neural Network DNS Classifiers for Analyzing DGA Family Characteristics","display_name":"SHAP Interpretations of Tree and Neural Network DNS Classifiers for Analyzing DGA Family Characteristics","publication_year":2023,"publication_date":"2023-01-01","ids":{"openalex":"https://openalex.org/W4380686105","doi":"https://doi.org/10.1109/access.2023.3286313"},"language":"en","primary_location":{"id":"doi:10.1109/access.2023.3286313","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2023.3286313","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/10005208/10151849.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://ieeexplore.ieee.org/ielx7/6287639/10005208/10151849.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5016272268","display_name":"Nikos Kostopoulos","orcid":"https://orcid.org/0009-0003-6033-0191"},"institutions":[{"id":"https://openalex.org/I174458059","display_name":"National Technical University of Athens","ror":"https://ror.org/03cx6bg69","country_code":"GR","type":"education","lineage":["https://openalex.org/I174458059"]}],"countries":["GR"],"is_corresponding":true,"raw_author_name":"Nikos Kostopoulos","raw_affiliation_strings":["School of Electrical and Computer Engineering, National Technical University of Athens, Athens, Greece"],"raw_orcid":"https://orcid.org/0009-0003-6033-0191","affiliations":[{"raw_affiliation_string":"School of Electrical and Computer Engineering, National Technical University of Athens, Athens, Greece","institution_ids":["https://openalex.org/I174458059"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5023077279","display_name":"Dimitris Kalogeras","orcid":"https://orcid.org/0000-0002-9550-0088"},"institutions":[{"id":"https://openalex.org/I174458059","display_name":"National Technical University of Athens","ror":"https://ror.org/03cx6bg69","country_code":"GR","type":"education","lineage":["https://openalex.org/I174458059"]},{"id":"https://openalex.org/I4210144519","display_name":"Institute of Communication and Computer Systems","ror":"https://ror.org/0483fn738","country_code":"GR","type":"nonprofit","lineage":["https://openalex.org/I4210144519"]}],"countries":["GR"],"is_corresponding":false,"raw_author_name":"Dimitris Kalogeras","raw_affiliation_strings":["Institute of Communication and Computer Systems, National Technical University of Athens, Athens, Greece"],"raw_orcid":"https://orcid.org/0000-0002-9550-0088","affiliations":[{"raw_affiliation_string":"Institute of Communication and Computer Systems, National Technical University of Athens, Athens, Greece","institution_ids":["https://openalex.org/I4210144519","https://openalex.org/I174458059"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5068713239","display_name":"Dimitris Pantazatos","orcid":"https://orcid.org/0000-0002-0924-1260"},"institutions":[{"id":"https://openalex.org/I174458059","display_name":"National Technical University of Athens","ror":"https://ror.org/03cx6bg69","country_code":"GR","type":"education","lineage":["https://openalex.org/I174458059"]}],"countries":["GR"],"is_corresponding":false,"raw_author_name":"Dimitris Pantazatos","raw_affiliation_strings":["School of Electrical and Computer Engineering, National Technical University of Athens, Athens, Greece"],"raw_orcid":"https://orcid.org/0000-0002-0924-1260","affiliations":[{"raw_affiliation_string":"School of Electrical and Computer Engineering, National Technical University of Athens, Athens, Greece","institution_ids":["https://openalex.org/I174458059"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5028540494","display_name":"M. Grammatikou","orcid":"https://orcid.org/0000-0002-8673-4739"},"institutions":[{"id":"https://openalex.org/I174458059","display_name":"National Technical University of Athens","ror":"https://ror.org/03cx6bg69","country_code":"GR","type":"education","lineage":["https://openalex.org/I174458059"]}],"countries":["GR"],"is_corresponding":false,"raw_author_name":"Maria Grammatikou","raw_affiliation_strings":["School of Electrical and Computer Engineering, National Technical University of Athens, Athens, Greece"],"raw_orcid":"https://orcid.org/0000-0002-8673-4739","affiliations":[{"raw_affiliation_string":"School of Electrical and Computer Engineering, National Technical University of Athens, Athens, Greece","institution_ids":["https://openalex.org/I174458059"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5072274800","display_name":"Vasilis Maglaris","orcid":"https://orcid.org/0000-0002-0352-5713"},"institutions":[{"id":"https://openalex.org/I174458059","display_name":"National Technical University of Athens","ror":"https://ror.org/03cx6bg69","country_code":"GR","type":"education","lineage":["https://openalex.org/I174458059"]}],"countries":["GR"],"is_corresponding":false,"raw_author_name":"Vasilis Maglaris","raw_affiliation_strings":["School of Electrical and Computer Engineering, National Technical University of Athens, Athens, Greece"],"raw_orcid":"https://orcid.org/0000-0002-0352-5713","affiliations":[{"raw_affiliation_string":"School of Electrical and Computer Engineering, National Technical University of Athens, Athens, Greece","institution_ids":["https://openalex.org/I174458059"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":5,"corresponding_author_ids":["https://openalex.org/A5016272268"],"corresponding_institution_ids":["https://openalex.org/I174458059"],"apc_list":{"value":1850,"currency":"USD","value_usd":1850},"apc_paid":{"value":1850,"currency":"USD","value_usd":1850},"fwci":5.4228,"has_fulltext":true,"cited_by_count":28,"citation_normalized_percentile":{"value":0.96116589,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":94,"max":100},"biblio":{"volume":"11","issue":null,"first_page":"61144","last_page":"61160"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9973999857902527,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9973999857902527,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.9948999881744385,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.9911999702453613,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8001327514648438},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.7011720538139343},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.6503646373748779},{"id":"https://openalex.org/keywords/perceptron","display_name":"Perceptron","score":0.5427764058113098},{"id":"https://openalex.org/keywords/artificial-neural-network","display_name":"Artificial neural network","score":0.5171784162521362},{"id":"https://openalex.org/keywords/domain","display_name":"Domain (mathematical analysis)","score":0.5133582949638367},{"id":"https://openalex.org/keywords/multilayer-perceptron","display_name":"Multilayer perceptron","score":0.43682897090911865},{"id":"https://openalex.org/keywords/tree","display_name":"Tree (set theory)","score":0.4343792796134949},{"id":"https://openalex.org/keywords/boosting","display_name":"Boosting (machine learning)","score":0.4238438904285431},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.39835137128829956}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8001327514648438},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.7011720538139343},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.6503646373748779},{"id":"https://openalex.org/C60908668","wikidata":"https://www.wikidata.org/wiki/Q690207","display_name":"Perceptron","level":3,"score":0.5427764058113098},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.5171784162521362},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.5133582949638367},{"id":"https://openalex.org/C179717631","wikidata":"https://www.wikidata.org/wiki/Q2991667","display_name":"Multilayer perceptron","level":3,"score":0.43682897090911865},{"id":"https://openalex.org/C113174947","wikidata":"https://www.wikidata.org/wiki/Q2859736","display_name":"Tree (set theory)","level":2,"score":0.4343792796134949},{"id":"https://openalex.org/C46686674","wikidata":"https://www.wikidata.org/wiki/Q466303","display_name":"Boosting (machine learning)","level":2,"score":0.4238438904285431},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.39835137128829956},{"id":"https://openalex.org/C134306372","wikidata":"https://www.wikidata.org/wiki/Q7754","display_name":"Mathematical analysis","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/access.2023.3286313","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2023.3286313","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/10005208/10151849.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:f0b8e316cc3c4ae8807983cada45fb47","is_oa":true,"landing_page_url":"https://doaj.org/article/f0b8e316cc3c4ae8807983cada45fb47","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Access, Vol 11, Pp 61144-61160 (2023)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1109/access.2023.3286313","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2023.3286313","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/10005208/10151849.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[{"score":0.6899999976158142,"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16"}],"awards":[{"id":"https://openalex.org/G1197815105","display_name":"Horizon 2020: H2020-SGA-INFRA-GEANT-2018 (Topic [a] Research and Education Networking)","funder_award_id":"856726","funder_id":"https://openalex.org/F4320320300","funder_display_name":"European Commission"},{"id":"https://openalex.org/G4937468798","display_name":null,"funder_award_id":"H2020","funder_id":"https://openalex.org/F4320320300","funder_display_name":"European Commission"},{"id":"https://openalex.org/G5480248503","display_name":null,"funder_award_id":"101017151","funder_id":"https://openalex.org/F4320320300","funder_display_name":"European Commission"},{"id":"https://openalex.org/G6161857907","display_name":null,"funder_award_id":"101094901","funder_id":"https://openalex.org/F4320320300","funder_display_name":"European Commission"}],"funders":[{"id":"https://openalex.org/F4320320300","display_name":"European Commission","ror":"https://ror.org/00k4n6c32"},{"id":"https://openalex.org/F4320323149","display_name":"National and Kapodistrian University of Athens","ror":"https://ror.org/04gnjpq42"},{"id":"https://openalex.org/F4320330142","display_name":"National Technical University of Athens","ror":"https://ror.org/03cx6bg69"},{"id":"https://openalex.org/F4320332999","display_name":"Horizon 2020 Framework Programme","ror":"https://ror.org/00k4n6c32"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4380686105.pdf","grobid_xml":"https://content.openalex.org/works/W4380686105.grobid-xml"},"referenced_works_count":59,"referenced_works":["https://openalex.org/W155384935","https://openalex.org/W1561983441","https://openalex.org/W2082550445","https://openalex.org/W2101234009","https://openalex.org/W2148143831","https://openalex.org/W2282821441","https://openalex.org/W2295598076","https://openalex.org/W2464432954","https://openalex.org/W2498359591","https://openalex.org/W2546910111","https://openalex.org/W2786906486","https://openalex.org/W2889547652","https://openalex.org/W2900892325","https://openalex.org/W2904027722","https://openalex.org/W2913504480","https://openalex.org/W2940958568","https://openalex.org/W2962862931","https://openalex.org/W2962940036","https://openalex.org/W2963125461","https://openalex.org/W2973385958","https://openalex.org/W2994857929","https://openalex.org/W2995179471","https://openalex.org/W3009719328","https://openalex.org/W3011866104","https://openalex.org/W3019675698","https://openalex.org/W3120836831","https://openalex.org/W3122189786","https://openalex.org/W3126690668","https://openalex.org/W3158842640","https://openalex.org/W3173684417","https://openalex.org/W3195826529","https://openalex.org/W3202776774","https://openalex.org/W4200140155","https://openalex.org/W4213056122","https://openalex.org/W4281856661","https://openalex.org/W4283170759","https://openalex.org/W4285184946","https://openalex.org/W4285815124","https://openalex.org/W4290856933","https://openalex.org/W4293192745","https://openalex.org/W4295313945","https://openalex.org/W4297944103","https://openalex.org/W4309269926","https://openalex.org/W4311923138","https://openalex.org/W4318619660","https://openalex.org/W6606342502","https://openalex.org/W6633578641","https://openalex.org/W6675354045","https://openalex.org/W6719105664","https://openalex.org/W6723978441","https://openalex.org/W6728757088","https://openalex.org/W6729497825","https://openalex.org/W6737947904","https://openalex.org/W6745730051","https://openalex.org/W6748281036","https://openalex.org/W6754281715","https://openalex.org/W6767173058","https://openalex.org/W6771658506","https://openalex.org/W6841493919"],"related_works":["https://openalex.org/W4239608116","https://openalex.org/W2002382339","https://openalex.org/W2076543106","https://openalex.org/W2019891950","https://openalex.org/W2085842814","https://openalex.org/W4286643620","https://openalex.org/W2523437662","https://openalex.org/W4387048144","https://openalex.org/W2492135063","https://openalex.org/W2362514456"],"abstract_inverted_index":{"Domain":[0,168],"Generation":[1],"Algorithms":[2],"(DGA\u2019s)":[3],"have":[4],"been":[5],"employed":[6,213],"by":[7,18],"botnet":[8],"orchestrators":[9],"for":[10,24,42,133,161,165,232],"controlling":[11],"infected":[12],"hosts":[13],"(bots),":[14],"while":[15],"evading":[16],"detection":[17,45],"performing":[19],"multiple":[20],"DNS":[21],"requests,":[22],"mostly":[23],"non-existing":[25],"domain":[26,103],"names.":[27,167],"With":[28],"blacklists":[29],"ineffective,":[30],"modern":[31],"DGA":[32,75,139,210],"filtering":[33],"methods":[34,222],"rely":[35],"on":[36,74,122,155,183],"Machine":[37],"Learning":[38,150],"(ML).":[39],"Emerging":[40],"needs":[41],"higher":[43],"intrusion":[44],"accuracy":[46],"lead":[47],"to":[48,69,82,101,116,137,142],"complex,":[49],"non-interpretable":[50],"black-box":[51,233],"classifiers,":[52],"thus":[53,176],"requiring":[54],"eXplainable":[55],"Artificial":[56],"Intelligence":[57],"(XAI)":[58],"techniques.":[59],"In":[60,216],"this":[61],"paper,":[62],"we":[63,218],"utilize":[64],"SHapley":[65],"Additive":[66],"exPlanation":[67],"(SHAP)":[68],"derive":[70],"model-agnostic,":[71],"post-hoc":[72],"interpretations":[73,130,152],"name":[76,104,169],"classifiers.":[77],"This":[78],"method":[79],"is":[80],"applied":[81],"binary":[83],"supervised":[84],"tree-based":[85,199],"classifiers":[86,203],"(e.g.":[87],"eXtreme":[88],"Gradient":[89],"Boosting":[90],"-":[91,99],"XGBoost)":[92],"and":[93,125,146,151,163,179,201,204],"deep":[94],"neural":[95],"networks":[96],"(Multi-Layer":[97],"Perceptron":[98],"MLP)":[100],"assess":[102],"feature":[105],"importance.":[106],"SHAP":[107,191],"visualization":[108],"tools":[109],"(summary,":[110],"dependence,":[111],"force":[112],"plots)":[113],"are":[114,131,153,171,235],"used":[115],"rank":[117],"features,":[118],"investigate":[119],"their":[120,127],"effect":[121],"model":[123],"decisions":[124],"determine":[126],"interactions.":[128],"Specific":[129],"detailed":[132],"identifying":[134],"names":[135],"belonging":[136],"common":[138],"families":[140],"pertaining":[141],"arithmetic,":[143],"wordlist,":[144],"hash":[145],"permutation":[147],"based":[148,154],"schemes.":[149],"up-to-date":[156],"datasets,":[157],"such":[158],"as":[159],"Tranco":[160],"benign":[162],"DGArchive":[164],"malicious":[166],"features":[170],"extracted":[172],"from":[173],"dataset":[174],"instances,":[175],"limiting":[177],"time-consuming":[178],"privacy-invasive":[180],"database":[181],"operations":[182],"historical":[184],"data.":[185],"Our":[186],"experimental":[187],"results":[188],"demonstrate":[189],"that":[190,220],"enables":[192],"explanations":[193],"of":[194,208],"XGBoost":[195],"(the":[196],"most":[197],"accurate":[198],"model)":[200],"MLP":[202],"indicates":[205],"the":[206],"characteristics":[207],"specific":[209],"schemes,":[211],"commonly":[212],"in":[214,227],"attacks.":[215],"conclusion,":[217],"envision":[219],"XAI":[221],"will":[223],"expedite":[224],"ML":[225],"deployment":[226],"networking":[228],"environments":[229],"where":[230],"justifications":[231],"models":[234],"required.":[236]},"counts_by_year":[{"year":2025,"cited_by_count":17},{"year":2024,"cited_by_count":9},{"year":2023,"cited_by_count":2}],"updated_date":"2026-05-13T08:25:38.343686","created_date":"2025-10-10T00:00:00"}