{"id":"https://openalex.org/W4414110644","doi":"https://doi.org/10.1109/access.2025.3608450","title":"Real-Time Detection and Multi-Class Classification of DGAs With HybridBERT","display_name":"Real-Time Detection and Multi-Class Classification of DGAs With HybridBERT","publication_year":2025,"publication_date":"2025-01-01","ids":{"openalex":"https://openalex.org/W4414110644","doi":"https://doi.org/10.1109/access.2025.3608450"},"language":"en","primary_location":{"id":"doi:10.1109/access.2025.3608450","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2025.3608450","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1109/access.2025.3608450","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5023931087","display_name":"Aimen Mahmood","orcid":"https://orcid.org/0009-0006-3270-7731"},"institutions":[{"id":"https://openalex.org/I929597975","display_name":"National University of Sciences and Technology","ror":"https://ror.org/03w2j5y17","country_code":"PK","type":"education","lineage":["https://openalex.org/I929597975"]}],"countries":["PK"],"is_corresponding":false,"raw_author_name":"Aimen Mahmood","raw_affiliation_strings":["National University of Sciences and Technology, Islamabad, Pakistan"],"raw_orcid":"https://orcid.org/0009-0006-3270-7731","affiliations":[{"raw_affiliation_string":"National University of Sciences and Technology, Islamabad, Pakistan","institution_ids":["https://openalex.org/I929597975"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100777102","display_name":"Haider Abbas","orcid":"https://orcid.org/0000-0002-2437-4870"},"institutions":[{"id":"https://openalex.org/I86987016","display_name":"KTH Royal Institute of Technology","ror":"https://ror.org/026vcq606","country_code":"SE","type":"education","lineage":["https://openalex.org/I86987016"]},{"id":"https://openalex.org/I929597975","display_name":"National University of Sciences and Technology","ror":"https://ror.org/03w2j5y17","country_code":"PK","type":"education","lineage":["https://openalex.org/I929597975"]}],"countries":["PK","SE"],"is_corresponding":false,"raw_author_name":"Haider Abbas","raw_affiliation_strings":["National University of Sciences and Technology, Islamabad, Pakistan","KTH-Royal Institute of Technology, Stockholm, Sweden"],"raw_orcid":"https://orcid.org/0000-0002-2437-4870","affiliations":[{"raw_affiliation_string":"National University of Sciences and Technology, Islamabad, Pakistan","institution_ids":["https://openalex.org/I929597975"]},{"raw_affiliation_string":"KTH-Royal Institute of Technology, Stockholm, Sweden","institution_ids":["https://openalex.org/I86987016"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5104074832","display_name":"Faisal Amjad","orcid":null},"institutions":[{"id":"https://openalex.org/I929597975","display_name":"National University of Sciences and Technology","ror":"https://ror.org/03w2j5y17","country_code":"PK","type":"education","lineage":["https://openalex.org/I929597975"]}],"countries":["PK"],"is_corresponding":false,"raw_author_name":"Muhammad Faisal Amjad","raw_affiliation_strings":["National University of Sciences and Technology, Islamabad, Pakistan"],"raw_orcid":"https://orcid.org/0000-0003-4912-6168","affiliations":[{"raw_affiliation_string":"National University of Sciences and Technology, Islamabad, Pakistan","institution_ids":["https://openalex.org/I929597975"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5015512084","display_name":"Waleed Bin Shahid","orcid":"https://orcid.org/0000-0001-9113-4490"},"institutions":[{"id":"https://openalex.org/I184558857","display_name":"Royal Holloway University of London","ror":"https://ror.org/04g2vpn86","country_code":"GB","type":"education","lineage":["https://openalex.org/I124357947","https://openalex.org/I184558857"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Waleed Bin Shahid","raw_affiliation_strings":["Royal Holloway, University of London, London, U.K","Royal Holloway, University of London, UK"],"raw_orcid":"https://orcid.org/0000-0001-9113-4490","affiliations":[{"raw_affiliation_string":"Royal Holloway, University of London, London, U.K","institution_ids":["https://openalex.org/I184558857"]},{"raw_affiliation_string":"Royal Holloway, University of London, UK","institution_ids":["https://openalex.org/I184558857"]}]},{"author_position":"last","author":{"id":null,"display_name":"Sayed Qaiser Ali Shah","orcid":"https://orcid.org/0009-0004-9370-8506"},"institutions":[{"id":"https://openalex.org/I201384688","display_name":"National University of Computer and Emerging Sciences","ror":"https://ror.org/003eyb898","country_code":"PK","type":"education","lineage":["https://openalex.org/I201384688"]}],"countries":["PK"],"is_corresponding":false,"raw_author_name":"Sayed Qaiser Ali Shah","raw_affiliation_strings":["National University of Computer and Emerging Sciences, Islamabad, Pakistan"],"raw_orcid":"https://orcid.org/0009-0004-9370-8506","affiliations":[{"raw_affiliation_string":"National University of Computer and Emerging Sciences, Islamabad, Pakistan","institution_ids":["https://openalex.org/I201384688"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":{"value":1850,"currency":"USD","value_usd":1850},"apc_paid":{"value":1850,"currency":"USD","value_usd":1850},"fwci":1.809,"has_fulltext":false,"cited_by_count":2,"citation_normalized_percentile":{"value":0.87540272,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":98,"max":99},"biblio":{"volume":"13","issue":null,"first_page":"160393","last_page":"160410"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12111","display_name":"Industrial Vision Systems and Defect Detection","score":0.8899000287055969,"subfield":{"id":"https://openalex.org/subfields/2209","display_name":"Industrial and Manufacturing Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12111","display_name":"Industrial Vision Systems and Defect Detection","score":0.8899000287055969,"subfield":{"id":"https://openalex.org/subfields/2209","display_name":"Industrial and Manufacturing Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.5902000069618225},{"id":"https://openalex.org/keywords/scalability","display_name":"Scalability","score":0.5734999775886536},{"id":"https://openalex.org/keywords/domain","display_name":"Domain (mathematical analysis)","score":0.49540001153945923},{"id":"https://openalex.org/keywords/encoder","display_name":"Encoder","score":0.44359999895095825},{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.3528999984264374},{"id":"https://openalex.org/keywords/feature-extraction","display_name":"Feature extraction","score":0.3490999937057495},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.34209999442100525},{"id":"https://openalex.org/keywords/class","display_name":"Class (philosophy)","score":0.3409999907016754}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8105000257492065},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.5902000069618225},{"id":"https://openalex.org/C48044578","wikidata":"https://www.wikidata.org/wiki/Q727490","display_name":"Scalability","level":2,"score":0.5734999775886536},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.49540001153945923},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4754999876022339},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4702000021934509},{"id":"https://openalex.org/C118505674","wikidata":"https://www.wikidata.org/wiki/Q42586063","display_name":"Encoder","level":2,"score":0.44359999895095825},{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.3528999984264374},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.3490999937057495},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.34209999442100525},{"id":"https://openalex.org/C2777212361","wikidata":"https://www.wikidata.org/wiki/Q5127848","display_name":"Class (philosophy)","level":2,"score":0.3409999907016754},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3330000042915344},{"id":"https://openalex.org/C2986587452","wikidata":"https://www.wikidata.org/wiki/Q938438","display_name":"Statistical analysis","level":2,"score":0.3328000009059906},{"id":"https://openalex.org/C110083411","wikidata":"https://www.wikidata.org/wiki/Q1744628","display_name":"Statistical classification","level":2,"score":0.3183000087738037},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.3183000087738037},{"id":"https://openalex.org/C1009929","wikidata":"https://www.wikidata.org/wiki/Q179550","display_name":"Software bug","level":3,"score":0.31619998812675476},{"id":"https://openalex.org/C140642157","wikidata":"https://www.wikidata.org/wiki/Q1623338","display_name":"Pseudorandom number generator","level":2,"score":0.314300000667572},{"id":"https://openalex.org/C87007009","wikidata":"https://www.wikidata.org/wiki/Q210832","display_name":"Statistical hypothesis testing","level":2,"score":0.29809999465942383},{"id":"https://openalex.org/C93996380","wikidata":"https://www.wikidata.org/wiki/Q44127","display_name":"Server","level":2,"score":0.2833000123500824},{"id":"https://openalex.org/C506615639","wikidata":"https://www.wikidata.org/wiki/Q21662260","display_name":"Command and control","level":2,"score":0.27129998803138733},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.2696000039577484},{"id":"https://openalex.org/C114289077","wikidata":"https://www.wikidata.org/wiki/Q3284399","display_name":"Statistical model","level":2,"score":0.2667999863624573},{"id":"https://openalex.org/C2988987868","wikidata":"https://www.wikidata.org/wiki/Q32635","display_name":"Domain name","level":3,"score":0.2578999996185303},{"id":"https://openalex.org/C3020028006","wikidata":"https://www.wikidata.org/wiki/Q9158","display_name":"Electronic mail","level":2,"score":0.25200000405311584}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/access.2025.3608450","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2025.3608450","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:3345f55b262047a284c8309467c5304c","is_oa":true,"landing_page_url":"https://doaj.org/article/3345f55b262047a284c8309467c5304c","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Access, Vol 13, Pp 160393-160410 (2025)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1109/access.2025.3608450","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2025.3608450","pdf_url":null,"source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":23,"referenced_works":["https://openalex.org/W1595868485","https://openalex.org/W2529207922","https://openalex.org/W2564705125","https://openalex.org/W2773625629","https://openalex.org/W2801201033","https://openalex.org/W2890928763","https://openalex.org/W2913504480","https://openalex.org/W2942245271","https://openalex.org/W2971890500","https://openalex.org/W3011860454","https://openalex.org/W3011866104","https://openalex.org/W3034138874","https://openalex.org/W3087131353","https://openalex.org/W3130303772","https://openalex.org/W3196382900","https://openalex.org/W4213457406","https://openalex.org/W4290378809","https://openalex.org/W4309675595","https://openalex.org/W4318250072","https://openalex.org/W4376130356","https://openalex.org/W4384210043","https://openalex.org/W4384945880","https://openalex.org/W4404796749"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W2390279801","https://openalex.org/W4391913857","https://openalex.org/W2358668433","https://openalex.org/W4396701345","https://openalex.org/W2376932109","https://openalex.org/W2033914206","https://openalex.org/W2042327336"],"abstract_inverted_index":{"Domain":[0,23],"fluxing,":[1],"a":[2,15,40,53,72,121,174,192],"technique":[3,21],"employed":[4],"by":[5,129],"attackers":[6],"to":[7,27,58,102,186],"evade":[8],"conventional":[9],"Command":[10],"and":[11,51,86,111,117,135,161,171,190],"Control":[12],"detection,":[13],"presents":[14,39],"significant":[16,150],"challenge":[17],"for":[18,195],"cybersecurity.":[19],"This":[20],"leverages":[22],"Generation":[24],"Algorithms":[25],"(DGAs)":[26],"dynamically":[28],"generate":[29],"domain":[30,49],"names,":[31],"often":[32],"producing":[33],"non-sensical":[34],"sequences.":[35],"The":[36,62,89,124,177],"proposed":[37,178],"framework":[38,44,154,179],"real-time":[41,196],"DGA":[42,197],"detection":[43,56],"that":[45],"analyzes":[46],"Non-existent":[47],"(NX)":[48],"responses":[50],"applies":[52],"statistical":[54,87],"anomaly":[55],"approach":[57],"identify":[59],"malicious":[60],"activity.":[61],"detected":[63],"DGAs":[64,189],"are":[65],"further":[66],"classified":[67],"into":[68,114],"56":[69],"families":[70],"using":[71],"HybridBERT":[73],"framework,":[74],"integrating":[75],"Bidirectional":[76],"Encoder":[77],"Representations":[78],"from":[79,96],"Transformer":[80],"(BERT)":[81],"with":[82,140,164],"an":[83,144],"attention":[84],"mechanism":[85],"characteristics.":[88],"dataset,":[90],"comprising":[91],"approximately":[92,106],"0.3":[93],"million":[94],"samples":[95],"various":[97],"online":[98],"sources,":[99],"was":[100,127],"pre-processed":[101],"remove":[103],"redundant":[104],"data,":[105],"25%":[107],"of":[108,147,183],"the":[109,131,153,181],"total,":[110],"then":[112],"divided":[113],"training,":[115],"validation,":[116],"testing":[118],"sets":[119],"in":[120,158],"60:20:20":[122],"ratio.":[123],"BERT":[125],"model":[126],"fine-tuned":[128],"freezing":[130],"first":[132],"five":[133],"layers":[134],"trained":[136],"over":[137],"20":[138],"epochs":[139],"early":[141],"stopping,":[142],"achieving":[143],"overall":[145],"precision":[146],"96%.":[148],"Despite":[149],"class":[151],"imbalance,":[152],"demonstrated":[155],"robust":[156],"performance":[157],"both":[159],"word-based":[160],"pseudorandom":[162],"DGAs,":[163],"detailed":[165],"metrics":[166],"such":[167],"as":[168],"precision,":[169],"recall,":[170],"F1-score":[172],"providing":[173],"comprehensive":[175],"evaluation.":[176],"improves":[180],"ability":[182],"cybersecurity":[184],"systems":[185],"detect":[187],"zero-day":[188],"offers":[191],"scalable":[193],"solution":[194],"classification.":[198]},"counts_by_year":[{"year":2026,"cited_by_count":2}],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2025-10-10T00:00:00"}