{"id":"https://openalex.org/W7135203594","doi":"https://doi.org/10.48550/arxiv.2603.11200","title":"DNS-GT: A Graph-based Transformer Approach to Learn Embeddings of Domain Names from DNS Queries","display_name":"DNS-GT: A Graph-based Transformer Approach to Learn Embeddings of Domain Names from DNS Queries","publication_year":2026,"publication_date":"2026-03-11","ids":{"openalex":"https://openalex.org/W7135203594","doi":"https://doi.org/10.48550/arxiv.2603.11200"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2603.11200","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.11200","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2603.11200","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5068992876","display_name":"Massimiliano Altieri","orcid":"https://orcid.org/0000-0002-7226-8036"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Altieri, Massimiliano","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5045975965","display_name":"Ronan Hamon","orcid":"https://orcid.org/0000-0003-1987-5707"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Hamon, Ronan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5010914442","display_name":"Roberto Corizzo","orcid":"https://orcid.org/0000-0001-8366-6059"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Corizzo, Roberto","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5073750332","display_name":"Michelangelo Ceci","orcid":"https://orcid.org/0000-0002-6690-7583"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ceci, Michelangelo","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5101579730","display_name":"Ignacio Sanchez","orcid":"https://orcid.org/0000-0003-3619-6175"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Sanchez, Ignacio","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.8669000267982483,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.8669000267982483,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11644","display_name":"Spam and Phishing Detection","score":0.028300000354647636,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.027400000020861626,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.6837000250816345},{"id":"https://openalex.org/keywords/anomaly-detection","display_name":"Anomaly detection","score":0.5354999899864197},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.5303000211715698},{"id":"https://openalex.org/keywords/domain-name-system","display_name":"Domain Name System","score":0.5123999714851379},{"id":"https://openalex.org/keywords/generalization","display_name":"Generalization","score":0.5110999941825867},{"id":"https://openalex.org/keywords/domain","display_name":"Domain (mathematical analysis)","score":0.5052000284194946},{"id":"https://openalex.org/keywords/transformer","display_name":"Transformer","score":0.4293000102043152},{"id":"https://openalex.org/keywords/network-security","display_name":"Network security","score":0.35249999165534973}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8597000241279602},{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.6837000250816345},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.5354999899864197},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.5303000211715698},{"id":"https://openalex.org/C35026560","wikidata":"https://www.wikidata.org/wiki/Q8767","display_name":"Domain Name System","level":3,"score":0.5123999714851379},{"id":"https://openalex.org/C177148314","wikidata":"https://www.wikidata.org/wiki/Q170084","display_name":"Generalization","level":2,"score":0.5110999941825867},{"id":"https://openalex.org/C36503486","wikidata":"https://www.wikidata.org/wiki/Q11235244","display_name":"Domain (mathematical analysis)","level":2,"score":0.5052000284194946},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.46799999475479126},{"id":"https://openalex.org/C66322947","wikidata":"https://www.wikidata.org/wiki/Q11658","display_name":"Transformer","level":3,"score":0.4293000102043152},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4050000011920929},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.38269999623298645},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.35249999165534973},{"id":"https://openalex.org/C5655090","wikidata":"https://www.wikidata.org/wiki/Q192588","display_name":"Relational database","level":2,"score":0.32739999890327454},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.3264000117778778},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.3181000053882599},{"id":"https://openalex.org/C2776973144","wikidata":"https://www.wikidata.org/wiki/Q6880649","display_name":"Misuse detection","level":4,"score":0.305400013923645},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.3052999973297119},{"id":"https://openalex.org/C2780741293","wikidata":"https://www.wikidata.org/wiki/Q4818019","display_name":"Attack patterns","level":3,"score":0.30480000376701355},{"id":"https://openalex.org/C59404180","wikidata":"https://www.wikidata.org/wiki/Q17013334","display_name":"Feature learning","level":2,"score":0.2745000123977661},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.27250000834465027},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.2687000036239624},{"id":"https://openalex.org/C51632099","wikidata":"https://www.wikidata.org/wiki/Q3985153","display_name":"Training set","level":2,"score":0.26750001311302185},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.26750001311302185},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.26159998774528503}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2603.11200","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.11200","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2603.11200","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.11200","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.626682460308075,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Network":[0],"intrusion":[1,212],"detection":[2,25,29,189,213],"systems":[3,21],"play":[4],"a":[5,109,130,159],"crucial":[6],"role":[7],"in":[8,129,133,158],"the":[9,37,137,169],"security":[10],"strategy":[11],"employed":[12],"by":[13,32,106],"organisations":[14],"to":[15,64,76,83,135,174,199],"detect":[16],"and":[17,51,187],"prevent":[18],"cyberattacks.":[19],"Such":[20],"usually":[22],"combine":[23],"pattern":[24],"signatures":[26],"with":[27,154,164],"anomaly":[28],"techniques":[30],"powered":[31],"machine":[33,40],"learning":[34,41],"methods.":[35],"However,":[36,87],"commonly":[38],"proposed":[39],"methods":[42,60],"present":[43],"drawbacks":[44],"such":[45,70],"as":[46,71],"over-reliance":[47],"on":[48,148,183],"labeled":[49],"data":[50,167],"limited":[52],"generalization":[53],"capabilities.":[54],"To":[55],"address":[56],"these":[57],"issues,":[58],"embedding-based":[59],"have":[61],"been":[62],"introduced":[63],"learn":[65,136,175],"representations":[66],"from":[67,119],"network":[68],"data,":[69],"DNS":[72,97,122,141,166],"traffic,":[73],"mainly":[74],"due":[75],"its":[77],"large":[78],"availability,":[79],"that":[80,113,192],"generalise":[81],"effectively":[82],"many":[84],"downstream":[85,150],"tasks.":[86],"current":[88],"approaches":[89],"do":[90],"not":[91],"properly":[92],"consider":[93],"contextual":[94],"information":[95],"among":[96],"queries.":[98,123],"In":[99],"this":[100,104],"paper,":[101],"we":[102],"tackle":[103],"issue":[105],"proposing":[107],"DNS-GT,":[108],"novel":[110],"Transformer-based":[111],"model":[112,125],"learns":[114],"embeddings":[115],"for":[116,204,211],"domain":[117,177,184],"names":[118],"sequences":[120],"of":[121,140,171,207],"The":[124],"is":[126,217],"first":[127],"pre-trained":[128],"self-supervised":[131],"fashion":[132],"order":[134],"general":[138],"behavior":[139],"activity.":[142],"Then,":[143],"it":[144],"can":[145],"be":[146],"finetuned":[147],"specific":[149],"tasks,":[151],"exploiting":[152],"interactions":[153],"other":[155],"relevant":[156,200],"queries":[157],"given":[160],"sequence.":[161],"Our":[162,215],"experiments":[163],"real-world":[165],"showcase":[168],"ability":[170],"our":[172,193],"method":[173],"effective":[176],"name":[178,185],"representations.":[179],"A":[180],"quantitative":[181],"evaluation":[182],"classification":[186],"botnet":[188],"tasks":[190],"shows":[191],"approach":[194],"achieves":[195],"better":[196],"results":[197],"compared":[198],"baselines,":[201],"creating":[202],"opportunities":[203],"further":[205],"exploration":[206],"large-scale":[208],"language":[209],"models":[210],"systems.":[214],"code":[216],"available":[218],"at:":[219],"https://github.com/m-altieri/DNS-GT.":[220]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-03-14T00:00:00"}