{"id":"https://openalex.org/W7116676855","doi":"https://doi.org/10.23919/cnsm67658.2025.11297537","title":"Malicious Domain Names Detection with DeepDGA, a Hybrid Character and Word Embeddings Deep Learning Architecture","display_name":"Malicious Domain Names Detection with DeepDGA, a Hybrid Character and Word Embeddings Deep Learning Architecture","publication_year":2025,"publication_date":"2025-10-27","ids":{"openalex":"https://openalex.org/W7116676855","doi":"https://doi.org/10.23919/cnsm67658.2025.11297537"},"language":null,"primary_location":{"id":"doi:10.23919/cnsm67658.2025.11297537","is_oa":false,"landing_page_url":"https://doi.org/10.23919/cnsm67658.2025.11297537","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 21st International Conference on Network and Service Management (CNSM)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5030894737","display_name":"Lucas Torrealba Aravena","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Lucas Torrealba Aravena","raw_affiliation_strings":["NIC Chile Research Labs"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"NIC Chile Research Labs","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5081556750","display_name":"Pedro Casas","orcid":"https://orcid.org/0000-0002-0951-2331"},"institutions":[{"id":"https://openalex.org/I132118926","display_name":"Austrian Institute of Technology","ror":"https://ror.org/04knbh022","country_code":"AT","type":"facility","lineage":["https://openalex.org/I132118926"]}],"countries":["AT"],"is_corresponding":false,"raw_author_name":"Pedro Casas","raw_affiliation_strings":["AIT Austrian Institute of Technology"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"AIT Austrian Institute of Technology","institution_ids":["https://openalex.org/I132118926"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5016053108","display_name":"Diego Aineto Garc\u00eda","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Diego Garc\u00eda","raw_affiliation_strings":["NIC Chile Research Labs"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"NIC Chile Research Labs","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5062341453","display_name":"Javier Bustos-Jim\u00e9nez","orcid":"https://orcid.org/0000-0003-0036-2004"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Javier Bustos-Jim\u00e9nez","raw_affiliation_strings":["NIC Chile Research Labs"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"NIC Chile Research Labs","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5053887016","display_name":"Ivana Bachmann","orcid":"https://orcid.org/0000-0002-3189-1796"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ivana Bachmann","raw_affiliation_strings":["NIC Chile Research Labs"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"NIC Chile Research Labs","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.9246,"has_fulltext":false,"cited_by_count":1,"citation_normalized_percentile":{"value":0.89568731,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":94,"max":97},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"6"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.40610000491142273,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.40610000491142273,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.2919999957084656,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.09109999984502792,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.7268999814987183},{"id":"https://openalex.org/keywords/word2vec","display_name":"Word2vec","score":0.715499997138977},{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.6211000084877014},{"id":"https://openalex.org/keywords/domain","display_name":"Domain (mathematical analysis)","score":0.5317999720573425},{"id":"https://openalex.org/keywords/heuristic","display_name":"Heuristic","score":0.511900007724762},{"id":"https://openalex.org/keywords/benchmark","display_name":"Benchmark (surveying)","score":0.4903999865055084},{"id":"https://openalex.org/keywords/word-embedding","display_name":"Word embedding","score":0.4683000147342682},{"id":"https://openalex.org/keywords/word","display_name":"Word (group theory)","score":0.46700000762939453},{"id":"https://openalex.org/keywords/lexical-analysis","display_name":"Lexical analysis","score":0.4284999966621399}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7958999872207642},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.7268999814987183},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.7188000082969666},{"id":"https://openalex.org/C2776461190","wikidata":"https://www.wikidata.org/wiki/Q22673982","display_name":"Word2vec","level":3,"score":0.715499997138977},{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.6211000084877014},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.5317999720573425},{"id":"https://openalex.org/C173801870","wikidata":"https://www.wikidata.org/wiki/Q201413","display_name":"Heuristic","level":2,"score":0.511900007724762},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.4903999865055084},{"id":"https://openalex.org/C2777462759","wikidata":"https://www.wikidata.org/wiki/Q18395344","display_name":"Word embedding","level":3,"score":0.4683000147342682},{"id":"https://openalex.org/C90805587","wikidata":"https://www.wikidata.org/wiki/Q10944557","display_name":"Word (group theory)","level":2,"score":0.46700000762939453},{"id":"https://openalex.org/C176982825","wikidata":"https://www.wikidata.org/wiki/Q835922","display_name":"Lexical analysis","level":2,"score":0.4284999966621399},{"id":"https://openalex.org/C83860907","wikidata":"https://www.wikidata.org/wiki/Q135005","display_name":"Phishing","level":3,"score":0.42419999837875366},{"id":"https://openalex.org/C123657996","wikidata":"https://www.wikidata.org/wiki/Q12271","display_name":"Architecture","level":2,"score":0.42089998722076416},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.40869998931884766},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.40720000863075256},{"id":"https://openalex.org/C126831891","wikidata":"https://www.wikidata.org/wiki/Q221673","display_name":"Host (biology)","level":2,"score":0.4032999873161316},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.38960000872612},{"id":"https://openalex.org/C2780861071","wikidata":"https://www.wikidata.org/wiki/Q1062934","display_name":"Character (mathematics)","level":2,"score":0.3479999899864197},{"id":"https://openalex.org/C41608201","wikidata":"https://www.wikidata.org/wiki/Q980509","display_name":"Embedding","level":2,"score":0.34380000829696655},{"id":"https://openalex.org/C59404180","wikidata":"https://www.wikidata.org/wiki/Q17013334","display_name":"Feature learning","level":2,"score":0.3231000006198883},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.31700000166893005},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.3138999938964844},{"id":"https://openalex.org/C2779804580","wikidata":"https://www.wikidata.org/wiki/Q102047","display_name":"Suffix","level":2,"score":0.3018999993801117},{"id":"https://openalex.org/C2984842247","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep neural networks","level":3,"score":0.2727999985218048},{"id":"https://openalex.org/C189430467","wikidata":"https://www.wikidata.org/wiki/Q7293293","display_name":"Ranking (information retrieval)","level":2,"score":0.25279998779296875},{"id":"https://openalex.org/C81669768","wikidata":"https://www.wikidata.org/wiki/Q2359161","display_name":"Precision and recall","level":2,"score":0.25220000743865967}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.23919/cnsm67658.2025.11297537","is_oa":false,"landing_page_url":"https://doi.org/10.23919/cnsm67658.2025.11297537","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 21st International Conference on Network and Service Management (CNSM)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions","score":0.5251205563545227}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":16,"referenced_works":["https://openalex.org/W2008066750","https://openalex.org/W2768793959","https://openalex.org/W2773270814","https://openalex.org/W2913504480","https://openalex.org/W2914448461","https://openalex.org/W2945157258","https://openalex.org/W3011866104","https://openalex.org/W3019675698","https://openalex.org/W3087131353","https://openalex.org/W3114681532","https://openalex.org/W3153065797","https://openalex.org/W3198971113","https://openalex.org/W3203444100","https://openalex.org/W4214888010","https://openalex.org/W4389057501","https://openalex.org/W4389077640"],"related_works":[],"abstract_inverted_index":{"The":[0,128],"rapid":[1],"expansion":[2],"of":[3,19,126,167],"the":[4,17,124,159,165,173],"Internet":[5],"has":[6],"enabled":[7],"cybercriminal":[8],"operations":[9],"at":[10],"unprecedented":[11],"scale.":[12],"A":[13],"recurring":[14],"tactic":[15],"is":[16],"use":[18],"algorithmically":[20],"generated":[21],"domains":[22,52],"(AGDs)":[23],"created":[24],"by":[25,81,102],"domain":[26],"generation":[27],"algorithms":[28],"(DGAs)":[29],"to":[30,71],"orchestrate":[31],"botnet":[32],"command-and-control,":[33],"host":[34],"phishing":[35],"content,":[36],"and":[37,45,53,68,75,87,96,119,132,139],"distribute":[38],"malware.":[39],"Traditional":[40],"defenses":[41],"such":[42],"as":[43],"blocklists":[44],"heuristic":[46],"rules":[47],"are":[48],"brittle":[49],"against":[50],"new":[51],"evolving":[54],"attacker":[55],"strategies.":[56],"We":[57],"present":[58],"DeepDGA,":[59],"a":[60,82,93,107],"hybrid":[61],"deep":[62,175],"learning":[63,176],"architecture":[64],"that":[65],"fuses":[66],"character-level":[67],"word-level":[69,89],"representations":[70],"detect":[72],"both":[73],"pseudo-random":[74,145],"dictionary-based":[76,103,137,162],"DGAs.":[77,104],"Character-level":[78],"embeddings":[79,90],"processed":[80],"BiLSTM":[83],"capture":[84,98],"subword":[85],"patterns":[86],"entropy;":[88],"derived":[91],"from":[92],"dom2words":[94],"tokenization":[95],"Word2Vec":[97],"linguistic":[99],"regularities":[100],"exploited":[101],"Evaluations":[105],"on":[106],"public":[108],"benchmark":[109],"with":[110],"more":[111,160],"than":[112],"670,000":[113],"domains,":[114,122],"including":[115],"25":[116],"DGA":[117],"families":[118],"benign":[120],"top-popular":[121],"demonstrate":[123],"superiority":[125],"DeepDGA.":[127],"model":[129],"achieves":[130],"precision":[131],"recall":[133],"above":[134],"0.97":[135],"for":[136,144],"DGAs,":[138,146,163],"even":[140],"higher":[141],"(above":[142],"0.98)":[143],"consistently":[147],"outperforming":[148],"state-of-the-art":[149],"methods":[150],"across":[151],"multiple":[152],"metrics.":[153],"DeepDGA\u2019s":[154],"effectiveness,":[155],"particularly":[156],"in":[157],"detecting":[158],"challenging":[161],"highlights":[164],"benefit":[166],"combining":[168],"diverse":[169],"embedding":[170],"strategies":[171],"into":[172],"same":[174],"architecture.":[177]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-12-22T00:00:00"}