{"id":"https://openalex.org/W3093481824","doi":"https://doi.org/10.1109/iscc50000.2020.9219664","title":"Domain-Embeddings Based DGA Detection with Incremental Training Method","display_name":"Domain-Embeddings Based DGA Detection with Incremental Training Method","publication_year":2020,"publication_date":"2020-07-01","ids":{"openalex":"https://openalex.org/W3093481824","doi":"https://doi.org/10.1109/iscc50000.2020.9219664","mag":"3093481824"},"language":"en","primary_location":{"id":"doi:10.1109/iscc50000.2020.9219664","is_oa":false,"landing_page_url":"https://doi.org/10.1109/iscc50000.2020.9219664","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2020 IEEE Symposium on Computers and Communications (ISCC)","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5046409305","display_name":"Xin Fang","orcid":"https://orcid.org/0000-0002-8098-5625"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":true,"raw_author_name":"Xin Fang","raw_affiliation_strings":["Beijing National Research Center for Information Science and Technology, Institute for Network Sciences and Cyberspace Tsinghua University, Beijing, China"],"affiliations":[{"raw_affiliation_string":"Beijing National Research Center for Information Science and Technology, Institute for Network Sciences and Cyberspace Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101866940","display_name":"Xiaoqing Sun","orcid":"https://orcid.org/0000-0002-6263-9569"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiaoqing Sun","raw_affiliation_strings":["Beijing National Research Center for Information Science and Technology, Institute for Network Sciences and Cyberspace Tsinghua University, Beijing, China"],"affiliations":[{"raw_affiliation_string":"Beijing National Research Center for Information Science and Technology, Institute for Network Sciences and Cyberspace Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5023416195","display_name":"Jiahai Yang","orcid":"https://orcid.org/0000-0001-6109-6737"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jiahai Yang","raw_affiliation_strings":["Beijing National Research Center for Information Science and Technology, Institute for Network Sciences and Cyberspace Tsinghua University, Beijing, China"],"affiliations":[{"raw_affiliation_string":"Beijing National Research Center for Information Science and Technology, Institute for Network Sciences and Cyberspace Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100782683","display_name":"Xinran Liu","orcid":"https://orcid.org/0009-0003-1245-9273"},"institutions":[{"id":"https://openalex.org/I4210087772","display_name":"National Computer Network Emergency Response Technical Team/Coordination Center of Chinar","ror":"https://ror.org/00247dh76","country_code":"CN","type":"nonprofit","lineage":["https://openalex.org/I4210087772"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xinran Liu","raw_affiliation_strings":["National Computer Network Emergency Response Technical, Team/Coordination Center, Beijing, China"],"affiliations":[{"raw_affiliation_string":"National Computer Network Emergency Response Technical, Team/Coordination Center, Beijing, China","institution_ids":["https://openalex.org/I4210087772"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5046409305"],"corresponding_institution_ids":["https://openalex.org/I99065089"],"apc_list":null,"apc_paid":null,"fwci":1.3876,"has_fulltext":false,"cited_by_count":13,"citation_normalized_percentile":{"value":0.83102823,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":91,"max":97},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"6"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.9987000226974487,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9984999895095825,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8261086940765381},{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.8075350522994995},{"id":"https://openalex.org/keywords/word2vec","display_name":"Word2vec","score":0.764747679233551},{"id":"https://openalex.org/keywords/leverage","display_name":"Leverage (statistics)","score":0.7021622061729431},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.6488595008850098},{"id":"https://openalex.org/keywords/discriminative-model","display_name":"Discriminative model","score":0.6278620958328247},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.5662822723388672},{"id":"https://openalex.org/keywords/classifier","display_name":"Classifier (UML)","score":0.5456382632255554},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.5097207427024841},{"id":"https://openalex.org/keywords/domain","display_name":"Domain (mathematical analysis)","score":0.49147331714630127},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.4554526209831238},{"id":"https://openalex.org/keywords/big-data","display_name":"Big data","score":0.43013471364974976},{"id":"https://openalex.org/keywords/margin","display_name":"Margin (machine learning)","score":0.41843000054359436},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.4154749810695648},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.4027162194252014},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.13609939813613892}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8261086940765381},{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.8075350522994995},{"id":"https://openalex.org/C2776461190","wikidata":"https://www.wikidata.org/wiki/Q22673982","display_name":"Word2vec","level":3,"score":0.764747679233551},{"id":"https://openalex.org/C153083717","wikidata":"https://www.wikidata.org/wiki/Q6535263","display_name":"Leverage (statistics)","level":2,"score":0.7021622061729431},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.6488595008850098},{"id":"https://openalex.org/C97931131","wikidata":"https://www.wikidata.org/wiki/Q5282087","display_name":"Discriminative model","level":2,"score":0.6278620958328247},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.5662822723388672},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.5456382632255554},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.5097207427024841},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.49147331714630127},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.4554526209831238},{"id":"https://openalex.org/C75684735","wikidata":"https://www.wikidata.org/wiki/Q858810","display_name":"Big data","level":2,"score":0.43013471364974976},{"id":"https://openalex.org/C774472","wikidata":"https://www.wikidata.org/wiki/Q6760393","display_name":"Margin (machine learning)","level":2,"score":0.41843000054359436},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.4154749810695648},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.4027162194252014},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.13609939813613892},{"id":"https://openalex.org/C41608201","wikidata":"https://www.wikidata.org/wiki/Q980509","display_name":"Embedding","level":2,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C134306372","wikidata":"https://www.wikidata.org/wiki/Q7754","display_name":"Mathematical analysis","level":1,"score":0.0},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/iscc50000.2020.9219664","is_oa":false,"landing_page_url":"https://doi.org/10.1109/iscc50000.2020.9219664","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2020 IEEE Symposium on Computers and Communications (ISCC)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"score":0.6700000166893005,"display_name":"Reduced inequalities","id":"https://metadata.un.org/sdg/10"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":32,"referenced_works":["https://openalex.org/W145476170","https://openalex.org/W1561983441","https://openalex.org/W1614298861","https://openalex.org/W2119885577","https://openalex.org/W2136495567","https://openalex.org/W2146502635","https://openalex.org/W2153579005","https://openalex.org/W2187089797","https://openalex.org/W2464432954","https://openalex.org/W2606372327","https://openalex.org/W2608460891","https://openalex.org/W2759618680","https://openalex.org/W2768793959","https://openalex.org/W2778785804","https://openalex.org/W2801201033","https://openalex.org/W2805267134","https://openalex.org/W2889547652","https://openalex.org/W2900892325","https://openalex.org/W2963586458","https://openalex.org/W2964095667","https://openalex.org/W2969333022","https://openalex.org/W4294170691","https://openalex.org/W6605963037","https://openalex.org/W6633578641","https://openalex.org/W6636510571","https://openalex.org/W6681435938","https://openalex.org/W6682691769","https://openalex.org/W6719105664","https://openalex.org/W6736922809","https://openalex.org/W6744821220","https://openalex.org/W6746044177","https://openalex.org/W6766604595"],"related_works":["https://openalex.org/W2294483539","https://openalex.org/W2378449000","https://openalex.org/W2901835651","https://openalex.org/W2883616266","https://openalex.org/W186576250","https://openalex.org/W2002178493","https://openalex.org/W2372254325","https://openalex.org/W2929621094","https://openalex.org/W1996006176","https://openalex.org/W4285325964"],"abstract_inverted_index":{"DGA-based":[0],"botnet,":[1],"which":[2,96],"uses":[3],"Domain":[4],"Generation":[5],"Algorithms":[6],"(DGAs)":[7],"to":[8,20,38,52,83,102,137,165,183],"evade":[9],"supervision,":[10],"has":[11],"become":[12],"a":[13,27,46,91,213,230,239],"part":[14],"of":[15,29,57,114,169,189],"the":[16,24,40,53,61,65,71,77,104,131,160,163,175,179,184,199,226],"most":[17],"destructive":[18],"threats":[19],"network":[21,216],"security.":[22],"Over":[23],"past":[25],"decades,":[26],"wealth":[28],"defense":[30],"mechanisms":[31],"focusing":[32],"on":[33,233,242],"domain":[34,72],"features":[35,67],"have":[36],"emerged":[37],"address":[39,120],"problem.":[41],"Nonetheless,":[42],"DGA":[43,93,190],"detection":[44,94],"remains":[45],"daunting":[47],"and":[48,60,76,109,121,134,141,150,171,186,196,203,208,236],"challenging":[49],"task":[50],"due":[51],"big":[54],"data":[55,211],"nature":[56],"Internet":[58],"traffic":[59],"potential":[62],"fact":[63],"that":[64,222],"linguistic":[66],"extracted":[68],"only":[69],"from":[70,159,212],"names":[73],"are":[74],"insufficient":[75],"enemies":[78],"could":[79],"easily":[80],"forge":[81],"them":[82],"disturb":[84],"detection.":[85],"In":[86],"this":[87],"paper,":[88],"we":[89],"propose":[90],"novel":[92],"system":[95,193,201,224],"employs":[97],"an":[98,152],"incremental":[99],"word-embeddings":[100],"method":[101],"capture":[103],"interactions":[105],"between":[106,126],"end":[107],"hosts":[108],"domains,":[110,149],"characterize":[111],"time-series":[112],"patterns":[113,168],"DNS":[115],"queries":[116],"for":[117,145,155],"each":[118],"IP":[119],"therefore":[122],"explore":[123],"temporal":[124,167],"similarities":[125],"domains.":[127,191],"We":[128],"carefully":[129],"modify":[130],"Word2Vec":[132],"algorithm":[133],"leverage":[135],"it":[136],"automatically":[138],"learn":[139],"dynamic":[140],"discriminative":[142],"feature":[143],"representations":[144],"over":[146],"1.9":[147],"million":[148],"develop":[151],"simple":[153],"classifier":[154],"distinguishing":[156],"malicious":[157],"domains":[158,170],"benign.":[161],"Given":[162],"ability":[164],"identify":[166],"update":[172],"models":[173],"incrementally,":[174],"proposed":[176],"scheme":[177],"makes":[178],"progress":[180],"towards":[181],"adapting":[182],"changing":[185],"evolving":[187],"strategies":[188],"Our":[192],"is":[194],"evaluated":[195],"compared":[197],"with":[198,210],"state-of-art":[200],"FANCI":[202],"two":[204],"deep-learning":[205],"methods":[206],"CNN":[207],"LSTM,":[209],"large":[214,231],"university\u2019s":[215],"named":[217],"TUNET.":[218],"The":[219],"results":[220],"suggest":[221],"our":[223],"outperforms":[225],"strong":[227],"competitors":[228],"by":[229],"margin":[232],"multiple":[234],"metrics":[235],"meanwhile":[237],"achieves":[238],"remarkable":[240],"speed-up":[241],"model":[243],"updating.":[244]},"counts_by_year":[{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":3},{"year":2023,"cited_by_count":4},{"year":2022,"cited_by_count":2},{"year":2021,"cited_by_count":3}],"updated_date":"2025-11-06T03:46:38.306776","created_date":"2025-10-10T00:00:00"}