arXiv CSopen access

DRIFT: Drift-Resilient Invariant-Feature Transformer for DGA Detection

DRIFT: Drift-Resilient Invariant-Feature Transformer for DGA Detection Chaeyoung Lee∗ , Chaeri Jung∗ , and Seonghoon Jeong

arXiv:2605.10436v1 [cs.CR] 11 May 2026

Division of Artificial Intelligence Engineering Sookmyung Women’s University Seoul, Republic of Korea {amy8985, chaerry502, seonghoon}@sookmyung.ac.kr Abstract—Domain Generation Algorithms (DGAs) evolve continuously to evade botnet detection, posing a persistent challenge for dependable network defense. While deep learning-based detectors achieve strong performance under static conditions, they suffer severe degradation when facing temporal drift. Through a 9-year longitudinal study (2017–2025), we empirically show that state-of-the-art character- and word-based DGA classifiers rapidly lose effectiveness as new DGA variants emerge. To address this problem, we propose a drift-resilient Transformer-based framework that learns invariant representations through a hybrid tokenization strategy and multi-task self-supervised pre-training. The model integrates (i) characterlevel encoding to capture stochastic morphological patterns and (ii) subword-level encoding for word-based DGAs. Three pretraining tasks enable the model to learn robust structural and contextual features prior to supervised fine-tuning. Comprehensive evaluations demonstrate that our method significantly mitigates temporal degradation and consistently outperforms state-of-the-art baselines in forward-chaining experiments. The proposed approach offers a dependable foundation for long-term DGA defense in evolving threat landscapes. Our code is available at: https://github.com/snsec-net/2026-DSN-DRIFT. Index Terms—DGA Detection, Concept Drift, Pre-training, Self-supervised Learning, Botnet, Temporal Robustness

I. I NTRODUCTION Domain Generation Algorithms (DGAs) are a core mechanism used by modern botnets to maintain resilient Command and Control (C&C) communications [2]. By continuously generating large numbers of pseudo-random domain names, malware can evade static blacklists and preserve connectivity even when individual rendezvous points are taken down [1]. Consequently, the timely and accurate identification of algorithmically generated domains remains an essential component of network defense [3]. While early solutions relied heavily on manually crafted lexical or statistical features [4], deep learning (DL)-based approaches have become the de facto ∗ These authors contributed equally to this work. We gratefully acknowledge the Cyber Analysis & Defense department of Fraunhofer FKIE for granting us access to DGArchive [1]. Accepted to appear in the Proceedings of the 56th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN 2026). This is the author’s accepted manuscript; the final version of record will be published by IEEE. © 2026 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.

standard [5], [6], typically operating on character-level or word-level representations of domain strings. Despite the short length of domain names, the DGA detection landscape is highly dynamic [1]. The assumption that short strings limit variability has been disproven by recent studies [7]. Instead, the ecosystem is shaped by two opposing yet simultaneous forces: (i) attackers continually modifying generation logic to evade filters [8], and (ii) legitimate domains exhibiting increasing diversity due to new services, naming conventions, and branding trends (see §II.1). Together, these trends introduce substantial concept drift, undermining the static distribution assumptions underpinning most DGA datasets and detection models. As a result, although state-of-the-art DL models report high accuracy under static evaluations [9], [10], their robustness degrades sharply over time. Through a 9-year longitudinal evaluation (2017–2025), we show that the performance of existing models deteriorates rapidly as the temporal gap between training and deployment widens (see §II.2). Specifically, False Negative Rates (FNRs) surge as previously unseen DGAs emerge, while False Positive Rates (FPRs) for benign domains also increase due to evolving legitimate naming practices. This dual degradation indicates that current supervised models overfit to transient lexical features rather than learning the invariant structural cues required for long-term resilience. To address these limitations, we propose DRIFT, a driftresilient DGA detection framework that explicitly targets temporal robustness. Our method employs a dual-branch Transformer architecture that processes domain names through a hybrid tokenization strategy: one branch encodes characterlevel information to capture stochastic morphological patterns, while the other encodes subword-level information to model word-based DGAs. Complementing this architecture, we introduce a multi-task self-supervised pre-training phase based on three auxiliary objectives—Masked Token Prediction (MTP), Token Position Prediction (TPP), and Token Order Verification (TOV) (see §III.2.2). This pre-training step enables the model to learn structural regularities and contextual semantics before supervised fine-tuning, producing representations that are robust to distribution shifts. The contributions of this paper are summarized as follows: • We conduct a 9-year longitudinal study (2017–2025) demonstrating the severity of temporal performance

degradation in state-of-the-art character-based and wordbased DGA detectors. Our dataset is available at [11]. • We introduce a drift-resilient detection framework that combines hybrid tokenization with multi-task selfsupervised pre-training to learn invariant structural features of domain names. • Through extensive evaluations, we show that our framework significantly outperforms baseline models particularly in FNR over time, offering a dependable solution for long-term DGA defense. The remainder of this paper is organized as follows. §II describes the longitudinal dataset and reviews related work, motivating the need for robust DGA detection. §III presents the proposed hybrid tokenization and dual-branch Transformer architecture. §IV provides a detailed experimental analysis and comparison against state-of-the-art baselines. Finally, §V concludes the paper and outlines future research directions. II. P RELIMINARIES AND P ROBLEM S TATEMENT This section provides the foundational background for our study. We first describe the construction of the large-scale longitudinal dataset covering a 9-year period (2017–2025). Using this dataset, we then examine the temporal robustness of existing DGA detectors, highlighting the severity of concept drift and motivating the need for a drift-resilient detection framework. II.1 Domain Name Dataset A key requirement for evaluating temporal robustness is the availability of a longitudinal dataset in which benign and malicious domains are temporally aligned. To this end, we curate domain names from multiple historical sources and aggregate them into a 9-year dataset. 1) Benign Domains: We source benign domains from two widely used popularity rankings: (1) the Alexa Top 1M list and (2) the Tranco Top 1M list. Historical Alexa snapshots were retrieved using the Internet Archive’s Wayback Machine [12], while historical Tranco lists were obtained through the Tranco API [13], [14]. This allows us to reconstruct year-specific benign domain distributions from 2017 to 2025. Alexa Top 1M. Alexa historically served as a de facto benchmark for web popularity based on browser-extension telemetry. Although discontinued in 2022, its archived lists remain essential for reconstructing historical benign domain distributions. Tranco Top 1M. To mitigate manipulation and sampling biases inherent in single-source rankings, we incorporate Tranco, which aggregates rankings from multiple providers (e.g., Alexa, Majestic, Umbrella) using a manipulation-resistant methodology [13]. This offers a more stable and reliable view of real-world benign domain trends. Although both lists are intended to represent legitimate domains, prior work has shown that Top 1M datasets may contain a small proportion of malicious or parked domains [8], [13]. Given the scale of our dataset and the practical challenges of large-scale sanitization, we follow standard practice and treat these lists as benign.

2) Malicious Domains: Malicious domains are collected from DGArchive, a comprehensive repository of DGAgenerated domain names curated by the Fraunhofer Institute. This platform is built upon the foundational reverseengineering methodology established in the seminal work by Plohmann et al. [1], which has largely defined the academic standards for DGA analysis. Rather than merely aggregating suspicious domains, DGArchive provides deterministic outputs derived directly from malware algorithms and seeds. Due to its high data transparency, a vast body of research utilizes its DGA studies and datasets as the ground truth [8], [15]. While many other DGA sources only provide domain names, we chose DGArchive because it offers precise temporal metadata required for longitudinal experiments on concept drift. Specifically, unlike passive traffic logs, DGArchive enumerates the full domain space for each malware family with per-domain timestamps, from which we extract all DGA domains active from 2017 to 2025, ensuring temporal alignment with our benign dataset. Any DGA domain names that also appeared in the Alexa or Tranco 1M lists were removed from the benign set to prevent cross-contamination. 3) Dataset Characteristics: Table I reports cumulative statistics for benign and DGA domains across 2017–2025. Although each Top 1M list contains one million entries per snapshot, the cumulative number of unique benign domains reaches approximately 49.4 million due to high churn in popular domains. This highlights a key challenge: a single-year snapshot is insufficient to represent benign naming patterns. Over a one-year period, approximately 33.13% of the entries are replaced by new ones (cf. Fig. 6 in [13]). This is because domain names are inherently tied to real-world trends and shifting naming landscapes (e.g., the ChatGPT surge), and relying on such a snapshot risks introducing sampling bias and overfitting. This high volatility suggests that a static model trained on a single snapshot of benign data may fail to generalize as the underlying distribution of popular domains evolves over time. The DGA dataset exhibits even larger scale, accumulating over 149 million unique malicious domains across 2017–2025. This diversity provides a comprehensive ground truth, enabling models to learn the wide spectrum of algorithmic generation strategies and their evolution over time. We collected 147 DGA families from the 151 provided by DGArchive, selecting those best suited for longitudinal analysis. Based on previous work [1], [16], [17] and the metadata from DGArchive, we classified them into character-based and word-based types, yielding 132 and 15 families, respectively. Despite the relatively low frequency of word-based DGAs in real-world traffic, this dataset contains a significant number of word-based DGA families. Moreover, the continuous emergence of new DGA families designed for detection evasion makes shifts in data distribution and concept drift inherently inevitable. Together, the longitudinal benign and malicious datasets allow for controlled evaluation of temporal robustness and enable the forward-chaining experiments described in §IV.3.

2017–2019

2020–2022

2023–2025

❾

100

❽

50

d1 = 86 .5 <latexit

❿

sha1_base64="xD4Mvk3r/rI1Rt7qv+QsmyiTQ5E=">AAACzXicjVHLSsNAFD2Nr1pfVTeCm2ARuiqJYO1GLLhxZwX7wFpKkk5raF4kE6FU3foDbnXtd/gT4heoHyF4Z5qCWkQnJDlz7jln5s6YgWNHXNNeUsrU9MzsXHo+s7C4tLySXV2rRX4cWqxq+Y4fNkwjYo7tsSq3ucMaQcgM13RY3ewfinr9koWR7XunfBCwlmv0PLtrWwYn6qzT1tV9tVQs7LazOa2gyaFOAj0BuYOPJ/9149Gt+NlnnKMDHxZiuGDwwAk7MBDR04QODQFxLQyJCwnZss5wjQx5Y1IxUhjE9unbo1kzYT2ai8xIui1axaE3JKeKbfL4pAsJi9VUWY9lsmB/yx7KTLG3Af3NJMslluOC2L98Y+V/faIXji5KsgebegokI7qzkpRYnorYufqlK04JAXECd6geErakc3zOqvREsndxtoasv0mlYMXcSrQx3sUu6YL1n9c5CWo7Bb1YKJ7ouXIeo5HGJraQp/vcQxlHqKBK2R7ucI8H5ViJlSvlZiRVUolnHd+GcvsJ9YaWEA==</latexit>

<latexit sha1_base64="yrJq2amreg9Q91+4Bhn/3ZdpHP0=">AAACzXicjVHLSsNAFD2Nr1pfVTeCm2ARuipJF60uxIIbd1awD6ylJOm0BvMimQil6tYfcKtrv8OfEL9A/QjBO9MU1CI6IcmZc885M3fGDBw74pr2klKmpmdm59LzmYXFpeWV7OpaPfLj0GI1y3f8sGkaEXNsj9W4zR3WDEJmuKbDGubFgag3LlkY2b53wgcBa7tG37N7tmVwok67naK6p5Z3C8VONqcVNDnUSaAnILf/8eS/bjy6VT/7jDN04cNCDBcMHjhhBwYielrQoSEgro0hcSEhW9YZrpEhb0wqRgqD2Av69mnWSliP5iIzkm6LVnHoDcmpYps8PulCwmI1VdZjmSzY37KHMlPsbUB/M8lyieU4J/Yv31j5X5/ohaOHHdmDTT0FkhHdWUlKLE9F7Fz90hWnhIA4gbtUDwlb0jk+Z1V6Itm7OFtD1t+kUrBibiXaGO9il3TB+s/rnAT1YkEvFUrHeq6Sx2iksYkt5Ok+y6jgEFXUKNvDHe7xoBwpsXKl3IykSirxrOPbUG4/AfWQlhA=</latexit>

d2 = 79.2

0

❹ ❺

❶ °50

❷

°100 °100

°50

0

50

100

°100

❸ °50

0

50

100

d3 = 76 .8 <latexit

sha1_base64="ec/3UPnJSe0HEhElwo1byPghT9Q=">AAACzXicjVHLSsNAFD2Nr1pfVTeCm2ARuiqJQtuNWHDjzgr2gVVKkk5raF4kE6FU3foDbnXtd/gT4heoHyF4Z5qCWkQnJDlz7jln5s6YgWNHXNNeUsrU9MzsXHo+s7C4tLySXV2rR34cWqxm+Y4fNk0jYo7tsRq3ucOaQcgM13RYw+wfiHrjkoWR7XsnfBCwc9foeXbXtgxO1GmnvavuqaViodzO5rSCJoc6CfQE5PY/nvzXjUe36mefcYYOfFiI4YLBAyfswEBETws6NATEnWNIXEjIlnWGa2TIG5OKkcIgtk/fHs1aCevRXGRG0m3RKg69ITlVbJPHJ11IWKymynoskwX7W/ZQZoq9DehvJlkusRwXxP7lGyv/6xO9cHRRlj3Y1FMgGdGdlaTE8lTEztUvXXFKCIgTuEP1kLAlneNzVqUnkr2LszVk/U0qBSvmVqKN8S52SRes/7zOSVDfKejFQvFYz1XyGI00NrGFPN1nCRUcoooaZXu4wz0elCMlVq6Um5FUSSWedXwbyu0n/xGWFA==</latexit>

❻ °100

❼ °50

0

50

100

Fig. 1. Longitudinal t-SNE analysis of the 1024-dimensional fused latent vector vfusion , applied jointly to 25,000 randomly sampled domains. Each point is a domain embedding, color-coded by prediction outcome— TP, TN, FP, and FN. The symbol marks the per-class centroid (benign, DGA), and d denotes the Euclidean distance between the benign and DGA centroids. To emphasize significant temporal shifts while suppressing negligible ones, we partition the 9-year dataset into three 3-year periods: 2017–2019 (train set), 2020–2022, and 2023–2025.

4) Longitudinal Dual-sided Concept Drift: Fig. 1 illustrates the dual-sided concept drift—both benign and DGA distributions shift over time and gradually converge to each other in the latent space—observed across our 9-year dataset. The classification outcomes shown in the figure are produced by our proposed model (detailed in §III). Concept Drift Over Time. The decreasing centroid distance—d1 = 86.5 > d2 = 79.2 > d3 = 76.8—indicates that the benign and DGA latent spaces are converging, with each period extending further into the other’s territory and raising both False Negative (FN) and False Positive (FP) cases. ❶–❸ and ❾ exhibit a substantial increase and wider spread of DGA data points. Specifically, samples in ❶ (e.g., vutotoid) emerged, filling the gap between the DGA and benign clusters, visibly narrowing the margin, while ❾ (e.g., heehwaes.ddns) shows DGA points scattered across the upper territory of the benign cluster. Both ❶ and ❾ often consist of pronounceable n-grams, appearing designed to mimic human-readable benign domains and evade detection. Benign Misclassified as DGA. ❶ also presents interesting FP cases: a domain such as hexieshaanxi—a legitimate Chinese domain—is misclassified due to its unfamiliar n-gram distribution to English-centric models. Non-English domains romanized from languages whose character patterns diverge from English are inherently susceptible to such FP cases [18], and longer domain lengths further push these features toward DGA-like characteristics. Acronyms in ❹–❻ also trigger FP cases—e.g., jgpnis, which stands for Javni Gradski Prevoz in Niš, Serbia. Such domains exhibit low pronounceability and sometimes contain numbers; the model misinterprets these domains due to their structural similarity to certain DGA families. Finally, in ❼, FP cases are triggered by extremely short domain names consisting of only three characters— e.g., mbm, ord, and hat—which lack sufficient features for reliable classification. DGA Mimicking Benign. Regarding FN cases, ❽ and ❿ demonstrate structural characteristics of evolving DGA families that can lead to misclassification. ❽ lies between DGA samples of mixed long alphanumeric strings and benign samples of long, readable word sequences; it contains partially pronounceable mixed alphanumeric examples

TABLE I S TATISTICS OF THE C OLLECTED DATASET (C UMULATIVE FROM 2017) 걀

Period

Benign domains

DGA domains

Total domains Uniq. domains Total domains Uniq. domains 2017–2017 2017–2018 2017–2019 2017–2020 2017–2021 2017–2022 2017–2023 2017–2024 2017–2025

1,913,418 18,729,906 40,508,820 58,149,929 72,679,722 88,262,644 92,962,312 94,833,375 96,849,575

1,913,418 17,129,997 29,359,365 36,796,092 41,856,865 47,358,571 48,190,058 48,805,692 49,433,110

14,888,780 30,004,459 46,423,032 65,116,780 84,661,350 104,424,484 124,186,047 144,981,221 165,824,441

14,888,780 29,305,992 44,940,295 62,272,656 79,752,910 97,107,537 114,189,860 132,177,150 149,405,584

Uniq. DGA families 58 62 65 71 77 80 81 147 147

(e.g., jozzdd2jhftgiht). ❿ further highlights DGAs (e.g., osizi-deguq, elanat-amys) mostly from the Gazavat family, whose structure appears to mimic nearby benign domains (e.g., ginza-nagano). II.2 Temporal Performance Degradation To quantify the impact of concept drift on existing DGA detectors, we perform a longitudinal analysis using three representative supervised models: MIT [19], NYU [19], and the Hybrid Modified Transformer (HMT) [9]. We follow a forward-chaining evaluation strategy where a model trained on data from year Ytrain is evaluated on test sets from subsequent years Ytest (Ytrain ≤ Ytest ≤ 2025). Moreover, to mitigate potential biases arising from variations in dataset size and class distribution, we standardized the training set for each year. Each dataset comprises 3.0 million samples, consisting of an equal split of 1.5 million benign domains and 1.5 million DGA domains. This mirrors realistic deployment scenarios in which models must operate on continuously evolving domain distributions without immediate retraining. Fig. 2 summarizes the temporal evolution of both FNR and FPR. The results highlight several systematic vulnerabilities in current approaches: Rapid Feature Obsolescence. All models exhibit a sharp increase in FNR as the temporal gap ∆t = Ytest − Ytrain widens. For example, models trained on 2017 data fail to detect a substantial portion of DGAs introduced in later years, producing widely diverging FNR curves. This indicates that the lexical and structural cues learned during training become obsolete as DGA families evolve.

MIT

NYU

HMT

FNR

0.20 0.15 0.10 0.05 0.150

FPR

0.125 0.100 0.075 0.050 0.025 ’17

’18

’19

’20

’21 ’22 Test Year

’23

’17

’18

’24

’25

’17

’18

’19

’20

’21 ’22 Test Year

’23

’24

’25

’17

’18

’19

’20

’21 ’22 Test Year

’23

’24

’25

Training Data Year ’19

’20

’21

’22

’23

’24

’25

Fig. 2. Longitudinal evaluation of DGA detection performance across three baseline models (MIT [19], NYU [19], and HMT [9]) over a 9-year period. The top row shows the FNR, and the bottom row shows the FPR. Each line corresponds to a model trained on a specific year and evaluated on all subsequent years, illustrating the temporal decay in detection performance caused by concept drift.

Limited Benefit of Retraining. Models trained on more recent data (e.g., Ytrain = 2023) begin with relatively low error rates but degrade rapidly when evaluated only one or two years into the future. This demonstrates that yearly retraining provides, at best, short-lived improvements and does not fundamentally address the instability caused by distribution shift. These findings underscore that relying on transient lexical features is insufficient for long-term stability. The observed temporal fragility motivates the need for a detection framework capable of capturing invariant characteristics of DGA domains, ensuring robustness against the continuous evolution of generation algorithms. II.3 Related Works Research on DGA detection has evolved considerably over the past decade, progressing from traditional machine learning techniques to DL models and, more recently, Transformerbased architectures. Early systems relied on manually engineered lexical or statistical features extracted from domain names or Domain Name System (DNS) traffic, whereas modern approaches increasingly attempt to learn domain representations directly from raw strings. 1) Machine Learning-based Approaches: Classical machine learning-based DGA detectors typically rely on handcrafted features and traditional classifiers. Chen et al. [20] employed a Support Vector Machine trained on a small set of statistical domain features, while Sivaguru et al. [21] used a Random Forest model incorporating 26 lexical and linguistic attributes. Li et al. [22] combined a Decision Tree (J48) classifier with DBSCAN-based clustering for improved separation of DGA families. Although these methods demonstrated early success, they depend heavily on feature engineering and often require auxiliary DNS metadata [23], [24], which limits scalability and generalization in real-world environments. 2) Deep Learning-based Approaches: The advent of deep neural networks enabled automated feature extraction from

raw domain strings. Woodbridge et al. [25] introduced the first Long Short-Term Memory (LSTM)-based DGA detector, inspiring subsequent LSTM variants [26], [27]. In parallel, Convolutional Neural Network (CNN)-based approaches emerged following their success in text classification [28]– [30]. Yu et al. [19] demonstrated that CNNs can effectively capture local character-level patterns for DGA detection. Hybrid architectures combining CNN and LSTM further improved feature expressiveness [19], [31]. Attention-based models followed, such as Ren et al. [32], who integrated CNN, bidirectional-LSTM, and attention mechanisms to emphasize salient regions of domain strings. More recently, Transformer-based methods have gained traction due to their superior sequence modeling capabilities. Ding et al. [9] proposed the HMT, which augments Transformer encoders with character-level embeddings. Huang et al. [33] leveraged BERT embeddings to enhance feature representations. These approaches capitalize on the contextual modeling strength of Transformers but still rely predominantly on character-level tokenization. 3) Tokenization Strategies: Most prior work treats domain names as raw character sequences, which limits effectiveness for word-based DGAs that contain meaningful substrings. Koh et al. [34] explored word-level tokenization, but their method is tailored to word-based DGAs and fails to generalize to purely stochastic ones. Recent studies have begun exploring hybrid- or subword-level tokenization [9], [35], yet research in this direction remains sparse. A systematic framework that integrates both character-level and subword-level representations is still lacking, despite clear evidence that DGAs exhibit heterogeneous generation patterns. II.4 Challenges and Motivation In this subsection, we summarize the key challenges in driftresilient DGA detection and derive the corresponding requirements (R1 –R4 ) that motivate our design. Each challenge–

requirement pair directly informs the architecture and evaluation strategy presented in the following sections. Challenge 1: Need for a Temporal Evaluation Strategy. As revealed by Cebere et al. [8], most prior studies evaluate DGA detectors using randomly shuffled train-test splits drawn from the same time period. Such static evaluations mask the real-world consequences of distribution shift and fail to reveal how quickly models degrade when exposed to future domain distributions [36]. R1 : Our solution must adopt a temporally faithful evaluation protocol that mirrors deployment conditions and quantifies robustness against real-world temporal drift. We enforce this requirement using a forward-chaining evaluation setup described in §IV. Challenge 2: Lack of Temporal Robustness in Existing Detectors. As shown in our longitudinal experiments, even stateof-the-art DL models exhibit dramatic increases in missed detections with only modest temporal gaps. While routine retraining can alleviate this degradation, it poses three practical challenges: (1) promptly detecting that drift has occurred, (2) acquiring accurate ground-truth labels for newly emerging domains, and (3) preparing a stable, high-potential model as the retraining baseline. Consequently, retraining on recent data only delays degradation, offering no durable solution on its own. R2 : Our solution must learn invariant features that remain stable across years, enabling the detector to generalize to future, unseen DGAs without continuous retraining. We address this requirement with our multi-task self-supervised pre-training in §III.2. Challenge 3: Domain-Name-Only Detection. A considerable portion of prior DGA detection pipelines (e.g., [2], [37], [38]) relies on auxiliary signals such as Non-Existent Domain (NXDOMAIN) bursts, DNS response anomalies, WHOIS metadata, or broader Open-Source Intelligence (OSINT)-based enrichment [39]. However, these signals are often unreliable, incomplete, or entirely unavailable in practical deployment environments [8]. As a result, such approaches can fail for (i) botnets whose DGAs remain dormant until the primary C&C infrastructure is taken down, (ii) registered-DGA-style campaigns in which operators pre-register or “age” domains before activation, and (iii) DGAs with sufficiently low daily generation rates where attackers can feasibly register all algorithmically generated domains, producing no NXDOMAIN evidence at all. R3: Our solution must therefore function robustly under a strictly domain-only setting, remaining effective even when NXDOMAIN-based cues are absent and OSINT sources are inconsistent or incomplete. We design and evaluate DRIFT under this domain-only assumption in §III. Challenge 4: Limitations of Pure Character-Level Tokenization. Most existing models rely exclusively on characterlevel tokenization, which is insufficient for capturing the heterogeneous nature of DGAs—some rely on stochastic character sequences, while others generate word-based or hybrid patterns. Word-level tokenization alone is also inadequate, as it fails to generalize beyond word-based DGAs and introduces sparsity. Although recent work has begun exploring subword units [9], the field lacks a systematic framework that

integrates both character-level and subword-level cues. R4 : Our solution must combine character-level and subword-level representations in a unified architecture capable of modeling both stochastic and word-based DGAs. We instantiate this hybrid dual-branch design in §III.1 and §III.3. III. P ROPOSED M ETHOD In this section, we introduce DRIFT, our proposed driftresilient DGA detection framework that jointly models the semantic structure of subwords and the fine-grained lexical patterns of characters. An overview of the architecture is shown in Fig. 4. §III.1 describes the hybrid tokenization pipeline, detailing how domain names are converted into character- and subword-level numerical representations. §III.2 presents the three self-supervised learning subtasks—MTP, TPP, and TOV—used to pre-train the dual-branch Transformer encoder. Finally, §III.3 outlines the fine-tuning procedure of DRIFT using longitudinal data from 2017 to 2019 to initialize a temporally robust classifier. III.1 Tokenization To prepare domain names for model processing, we convert each input string into a standardized numeric representation. This involves two steps: (i) preprocessing to normalize raw inputs and isolate meaningful lexical components, and (ii) tokenization to map the cleaned strings to character- and subword-level indices. 1) Data Preprocessing: Prior to tokenization, we apply a preprocessing pipeline that removes noise and enforces a consistent representation of domain names. This ensures that DRIFT learns intrinsic generation patterns rather than artifacts introduced during data collection. Normalization and Character Filtering. All domain names are lowercased to enforce case-insensitivity, treating strings such as Google.com and google.com equivalently. Following the IETF RFC 1035 specification [40], valid domain labels consist of alphanumeric characters, hyphens (-), and dots (.). Although underscores (_) appear in a small portion of our raw dataset, they do not conform to standard DNS naming rules and have become increasingly rare in modern domain registrations. We therefore exclude such cases from the final dataset. Effective Second-Level Domain (SLD) Extraction. To isolate the generative component of each domain, we extract the effective SLD, defined as the substring that excludes Top-Level Domains (TLDs) and country code TLD (ccTLD) suffixes. Because these suffixes are drawn from small, hard-coded lists in both benign and DGA domains, retaining them introduces high-frequency noise without contributing meaningful discriminative patterns. We use a curated list of TLDs and country codes and apply the following concise rules: (i) if the domain ends with a recognized ccTLD (e.g., .co.kr), remove the full ccTLD block; (ii) otherwise, remove the substring to the right of the final dot (standard TLD); (iii) the remaining substring becomes the effective SLD, with domains lacking dots used as-is.

Although the Mozilla Public Suffix List (PSL) [41] provides comprehensive domain mappings, its complex syntax (wildcards, exception rules such as *.kawasaki.jp, !city.kawasaki.jp) makes reliable parsing at scale prone to noise. We therefore use a deterministic extraction logic centered on core domain structures, validated against tldextract [42] with 96% agreement on our 149M records. The 4% discrepancy stems from platform SLDs such as blogspot, wordpress, ddns, and myftp; whereas tldextract keeps them in the registered domain, we categorize them as platform noise because they are heavily skewed toward specific classes and would let the model exploit class-correlated artifacts rather than DGA patterns. Deduplication and Merging. To construct a comprehensive benign dataset, we merge samples from Alexa and Tranco after preprocessing. Deduplication is performed using the effective SLDs to prevent over-representing frequently occurring domains. Only unique effective SLDs are retained in the final dataset. 2) Tokenization: After preprocessing, each effective SLD is mapped to an integer sequence using two complementary tokenization strategies: (i) Character-level tokenization for finegrained lexical patterns and (ii) Subword-level tokenization for semantic regularities in word-based DGAs. Character-Level Tokenization. For the character-based branch, the input alphabet consists of lowercase letters (a–z), digits (0–9), the hyphen (-), and the dot (.). We also include five special tokens—[PAD], [SEP], [CLS], [MASK], and [UNK]—resulting in a vocabulary of 43 unique IDs. Each domain is converted into a sequence of these indices, with [CLS] and [SEP] prepended and appended, respectively. Subword-Level Tokenization. The subword-branch uses the WordPiece algorithm, a widely adopted subword tokenization method in Transformer-based language models. This approach allows the tokenizer to capture meaningful morphemes when present (e.g., in word-based DGAs) while falling back to smaller subword units on random or pseudo-random strings. Choosing an appropriate vocabulary size V is conceptually important to balance expressiveness and efficiency: a very small vocabulary degenerates toward character-level segmentation, whereas an overly large vocabulary may lead to sparse, poorly shared subwords. In practice, we evaluated V ∈ {500, 1000, 30522} and observed only marginal performance differences (cf. Table II), indicating that DRIFT is relatively insensitive to V within this range; we therefore adopt V = 30522 (including the same five special tokens) as a reasonable trade-off between sequence length and representation granularity. III.2 Self-Supervised Pre-Training To learn robust representations of domain names that capture both local patterns and global structural information, we employ a multi-task self-supervised learning scheme based on a Transformer encoder. Unlike standard language modeling, which typically focuses on next-token prediction or maskedtoken reconstruction only, our framework jointly optimizes

three complementary objectives. Together, these objectives enable the model to learn (i) local semantic context over subwords or characters, (ii) the canonical ordering of tokens in valid domains, and (iii) the distinction between coherent and distorted sequences. The total loss is defined as the sum of the three task-specific losses: Ltotal = LMTP + LTPP + LTOV .

(1)

By training on these objectives simultaneously, DRIFT acquires a richer understanding of both benign and DGA domain patterns. 1) Embedding: The embedding layer serves as the entry point for the model, converting discrete inputs into continuous vector representations. Let V be the vocabulary size and D be the dimension of the model. First, the input domain sequence is converted into a sequence of IDs, X = {x1 , x2 , ..., xL }, where L is the maximum sequence length. We utilize a learnable lookup table to map each xi to a dense vector ei ∈ RD . To stabilize training, the weights of this embedding layer are initialized using Xavier normal initialization. Because the Transformer encoder is permutation-invariant, we inject positional information via learnable positional embeddings. The final input representation H0 is obtained by element-wise addition of token and positional embeddings: H0 = TokenEmbedding(X) + PositionalEmbedding(X). (2) The sequence H0 is then fed into a multi-layer Transformer encoder to produce high-level contextual representations. 2) Three Subtasks and Loss function: To capture the linguistic and structural properties of domain names, we design three auxiliary tasks depicted in Fig. 3. Each task is instantiated in two variants, one for the subword-branch Fig. 3(a) and one for the character-branch Fig. 3(b), but they share the same underlying objective. Masked Token Prediction (MTP). The MTP objective comprises Masked Subword Prediction for the subword branch and Masked Character Prediction for the character-branch. This task is inspired by the Masked Language Modeling objective in BERT [43] and aims to learn bidirectional context and local dependencies. MTP is designed to teach the model which local character or subword patterns are plausible given their surrounding context. During preprocessing, we randomly select 15% of tokens in the input sequence and replace them with the special [MASK] token, yielding a corrupted sequence X̂. The model is trained to recover the original token xi at each masked position based on the surrounding context. The loss is the cross-entropy over masked positions only: X LMTP = − log P (xi | X̂), (3) i∈M

where M is the set of masked indices. Token Position Prediction (TPP). The TPP objective comprises Subword Position Prediction and Character Position Prediction. While MTP focuses on local context, TPP encourages the model to learn the global structure and correct

SLD SLD extraction extraction

SLD SLD extraction extraction

-100 -100

66

domain domain

domain.com domain.com

21 21 117 117 [mask] [mask]

dd 21 21

MTP MTP Head Head Mask MaskToken Token Prediction Prediction

domain domain

-100 -100

yy

domain.com domain.com

17 17 [mask] [mask]

-100 -100

15 15

Mask MaskToken Token Prediction Prediction

33

dd 66

285 285

-100 -100

MTP MTP Head Head

11 11

-100 -100 -100 -100 -100 -100

16 16

SubwordSubwordbased based Transformer Transformer Backbone Backbone

ain285 ain285

21 21 117 117

TPP TPP Head Head Token TokenPosition Position Prediction Prediction

21 21 117 117 285 285

Tokenizer

Tokenizer

om om117 117

285 285

oo 17 17 m m 15 15 aa 33

21 21

TOV TOV Head Head

117 117 285 285

Token TokenOrder Order Verification Verification

17 17

CharacterCharacterbased based Transformer Transformer Backbone Backbone

66

33 15 15 66 11 11

ii 11 11

33 11 11

16 16

16 16

TOV TOV Head Head

66

Token TokenOrder Order Verification Verification

33 17 17

nn 16 16

15 15

Token TokenPosition Position Prediction Prediction

15 15 11 11

00

17 17

TPP TPP Head Head

11

16 16

(a) Subword-based Transformer Backbone

(b) Character-based Transformer Backbone

Fig. 3. Proposed pre-training strategy, where each backbone processes the input domain as a sequence of character and subword tokens, respectively. To stabilize the backbone model to learn robust structural and contextual features without labeled data, we employ three auxiliary subtasks—see §III.2.2.

(4)

This objective acts as a denoising autoencoding task and promotes learning of canonical domain structures. Token Order Verification (TOV). The TOV objective comprises Subword Order Verification and Character Order Verification. This is a sequence-level binary classification task that trains the model to discriminate between coherent and scrambled domain names. TOV is designed to teach the model to recognize whether an entire domain looks like a realistic sequence or a structurally corrupted one. For each batch, 50% of sequences are kept in their original order (label y = 0), while the remaining 50% are randomly shuffled (label y = 1). To obtain a fixed-size representation for classification, we aggregate the encoder outputs using both max pooling and mean pooling over the time dimension and concatenate the resulting vectors. This pooled representation is passed through a classification head to produce a probability p that the input has been scrambled. The loss is the binary cross-entropy:   LTOV = − y log p + (1 − y) log(1 − p) , (5) where y ∈ {0, 1} indicates whether the sequence order was preserved. This task encourages the model to capture highlevel semantic coherence beyond token-level statistics.

III.3 Fine-tuning for DGA Detection After pre-training the subword-based and character-based backbones independently, we integrate them into a unified

21

om 117

Subwordbased Transformer Backbone

max pool

avg pool

ain 285

d

6

o

17

m 15 a

3

i

11

n

16

256

256

Characterbased Transformer Backbone

max pool

Dense

t=1

log P

xoriginal | Xshuffled . t

d

domain.com

Concatenation

LTPP = −

L X

SLD extraction domain

Tokenizer

ordering of tokens within a domain name. TPP is designed to teach the model to understand how valid domain tokens are arranged, rather than treating them as unordered bags of symbols. In this task, we randomly shuffle the non-padding tokens of the input to obtain a scrambled sequence Xshuffled . The model receives Xshuffled as input and must reconstruct the original sequence by predicting the correct token for each position. Unlike MTP, which computes loss only on masked tokens, TPP applies a cross-entropy loss over all valid positions:

Output

0 or 1

2

512

256

avg pool 1024 256

Fig. 4. Proposed dual-branch architecture for DGA detection. Subword-level and character-level Transformer encoders are pre-trained independently and then fused via pooled representations for binary classification.

architecture for the downstream task of DGA detection. This dual-branch design allows the model to exploit both the semantic regularities captured by subwords and the fine-grained structural patterns captured by characters. 1) Dual-Branch Feature Extraction: The fine-tuning model consists of two parallel branches: a Subword encoder branch and a Character encoder branch. Each branch processes the same input domain name using the weights transferred from its respective pre-trained Transformer encoder. Rather than relying solely on the [CLS] token for sequence classification, we employ a pooling strategy that aggregates information from the entire sequence. For each branch we take hidden states H ∈ RL×D from the last Transformer layer. We then apply both max pooling and mean pooling along the sequence dimension. The two pooled vectors are concatenated to form a branch-specific representation: vbranch = [MaxPool(H); MeanPool(H)],

(6)

where [ · ; · ] denotes vector concatenation. This yields a subword-based representation vsubword and a character-based representation vchar .

2) Feature Fusion and Classification: To combine information across granularities, we concatenate the representations from both branches into a single fused feature vector: vfusion = [vsubword ; vchar ].

(7)

This fused vector is fed into a binary classification head consisting of a fully connected layer with ReLU activation, a dropout layer for regularization, and a final linear layer that outputs logits for the two classes—benign vs. DGA. Although more expressive fusion mechanisms (e.g., gating or cross-attention) may further improve performance, we adopt simple concatenation in this work and leave the exploration of richer fusion strategies as future work (see also the per-family analysis in §IV.2.3). As the classifier operates solely on this fused representation derived from the raw domain string, it is fully consistent with R3 . 3) Training Strategy: During supervised training, we adopt a two-stage transfer learning strategy. In the first stage, the parameters of both pre-trained Transformer encoders are frozen and only the classification head is updated. This linear probing warm-up stabilizes optimization and adapts the head to the pre-trained feature space. In the second stage, we unfreeze the encoders and finetune the entire model end-to-end on the DGA detection task, using a smaller learning rate for the backbones than for the classification head. This strategy allows us to preserve useful linguistic and structural features from self-supervised pretraining while still adapting them to the downstream detection objective. We train the model using binary cross-entropy loss with the Adam optimizer. Let p denote the predicted probability that a domain is DGA-generated and y ∈ {0, 1} is the ground-truth label (y = 1 for DGA, y = 0 for benign). The classification loss is   Lclf = − y log p + (1 − y) log(1 − p) . (8) IV. E XPERIMENTAL R ESULTS In this section, we empirically evaluate DRIFT on the longitudinal DGA benchmark. §IV.1 details the experimental setup; §IV.2 reports ablations and per-family analysis that isolate the contribution of hybrid tokenization, dual-branch architecture, and self-supervised pre-training; §IV.3 compares DRIFT against state-of-the-art baselines under forward-chaining evaluation across 2017–2025; and §IV.4 evaluates adaptability under periodic retraining and continuous learning drift-mitigation strategies. IV.1 Implementation Details All experiments are conducted on an HP OMEN 45L desktop equipped with an Intel Core Ultra 9 285K (24 cores, 5.7 GHz), 64 GB RAM, and an NVIDIA GeForce RTX 5090 GPU. Models are implemented in PyTorch. We use the Hugging Face tokenizers library for the WordPiece tokenizer.

1) Dataset: Unless otherwise stated, we use the full benign and DGA datasets from 2017–2019 for both self-supervised pre-training and supervised fine-tuning. For each year, 300,000 samples (150,000 benign and 150,000 DGA) are held out from the full datasets as a validation set. To evaluate temporal robustness, we test on data from later years (2020–2025), i.e., on domains that are strictly newer than the training period. Thus, our forward-chaining evaluation protocol is consistent with R1 . Furthermore, the DGA training set contains 64 DGA families, while 83 families appear only in the test set. 2) Backbone Model: The subword-based backbone uses an input length of Lsub = 30 and a subword vocabulary of size Vsub (default Vsub = 30,522; see the ablation in Table II). The character-based backbone uses Lchar = 77 and a character vocabulary of size Vchar = 43. Both backbones share the same Transformer encoder configuration: embedding dimension D = 256, Nenc = 12 encoder layers, Nhead = 8 attention heads, and a feed-forward dimension of Dff = 768. 3) Heads and Optimization: All three pre-training heads (MTP, TPP, and TOV) are implemented as one-layer feedforward networks. For MTP and TPP, the head consists of a linear layer that projects the hidden representation to the vocabulary size V (subword or character, depending on the branch). The masking ratio for MTP is 15% of the actual token length (excluding padding), with at least one token always masked. For TPP, non-padding tokens are shuffled with probability 1.0 to form the corrupted input. For TOV, the input is the concatenation of max-pooled and mean-pooled encoder outputs (dimension 2D), passed through a linear layer that returns logits for the two classes (original vs. shuffled). The Adam optimizer with a learning rate of 10−4 was used for the pre-training. The final DGA detection head (used in supervised finetuning) is a two-layer MLP: it takes the fused representation vfusion ∈ R4D as input, applies a hidden linear layer with size 2D and ReLU activation, and then a final linear layer that outputs logits for the benign and DGA classes. We use the Adam optimizer with separate learning rates: 10−4 for the classification head and 10−6 for the backbone parameters (cf. the two-stage training strategy in §III.3.3). The batch size B is set to 128 in all experiments. 4) Training Time and Inference Throughput: All training uses BF16 mixed precision. Each backbone is pre-trained for 2.5M steps (about 24 h for the subword model and 29 h for the character model), followed by 1.4M steps of supervised finetuning over approximately 22 h. At inference, DRIFT reaches a throughput of λ = 27,545.6 domains per second at batch size B = 1,024. Under a constant arrival rate λ, the maximum and average queuing latencies are Lmax = (B−1)/λ = 37.14 ms and Lavg = (B−1)/(2λ) = 18.57 ms, both well within the widely adopted ≤100 ms DNS resolution timeout [44], indicating negligible batching overhead for inline deployment. Crucially, this latency is self-contained: DRIFT consumes only the raw domain string and requires neither OSINT enrichment nor NXDOMAIN telemetry, so it remains usable against dormant, pre-registered, or low-generation-rate DGAs that yield

TABLE II E XPERIMENTAL SETUP AND DETECTION PERFORMANCE (M ICRO F1- SCORE ON 2020–2025 TEST SETS ).

Base

Backbone

Pre-training Dataset

H

TABLE III A BLATION STUDY ON THE THREE PRE - TRAINING SUBTASKS (MTP, TPP, TOV). P ERFORMANCE IS EVALUATED USING MICRO - AVERAGED METRICS ON THE 2020–2025 TEST SETS .

Vsub

Unfrozen

F1-score

Case

MTP

Benign & DGA

30,522

✔

0.9646

1 2 3

✓

4 5 6

✓ ✓

7 (Base)

✓

(a) (b) (c) (d)

H H H H

Benign only Benign only Benign only Benign only

† 30,522

500 1,000 30,522

✗ ✗ ✗ ✗

0.9539 0.9564 0.9538 0.9533

(e) (f)

S C

Benign & DGA Benign & DGA

30,522 —

✔ ✔

0.9511 0.9387

(g)

H

Benign & DGA

30,522

✗

0.9585

(h)

H

Benign only

30,522

✔

0.9584

Branch—H: Subword–Char Hybrid, S: Subword only, C: Character only Vocab size—† Off-the-shelf BERT-base-uncased tokenizer.

no auxiliary evidence—a decisive deployability advantage over pipelines that depend on such signals. IV.2 DGA Detection Performance 1) Base Configuration and Ablation Studies: To analyze the contribution of each component in DRIFT, we construct several variants of the base model and report the F1score over the 2020–2025 test sets in Table II. The “Base” configuration corresponds to our proposed setup: a hybrid subword–character backbone, pre-trained on both benign and DGA domains, with the backbone encoders unfrozen during supervised fine-tuning. This configuration achieves the highest F1-score among the architectural variants in Table II (0.9646), and the remaining rows serve as ablation studies and design justifications. Tokenizer and Vocabulary Size. Rows (a)–(d) evaluate different tokenizer choices and vocabulary sizes for the dual-branch. Row (a) uses the off-the-shelf BERT-base-uncased tokenizer trained on general natural language, while rows (b)–(d) employ tokenizers trained on domain names with vocabulary sizes V ∈ {500, 1000, 30522}. The performance differences are marginal (0.9533–0.9564), and all configurations remain close to the Base setting. This indicates that DRIFT is relatively insensitive to the exact choice of vocabulary size in this range and that domain-name-specific tokenizers do not dramatically outperform the generic BERT tokenizer in terms of aggregate F1. Effect of Dual vs. Single-Branch Backbones. Rows (e) and (f) compare the dual-branch to single-branch variants that use only the subword backbone or only the character backbone, keeping the pre-training dataset and training strategy aligned with the Base configuration. Both singlebranch models underperform the hybrid model: the subwordonly variant (row (e)) reaches 0.9511, while the characteronly variant (row (f)) drops further to 0.9387. This confirms that combining subword- and character-level representations is beneficial and supports R4 . In §IV.2.3, we further show that this hybrid design yields higher micro-averaged True Positive Rates (TPRs) across diverse DGA families.

TPP

TOV

Acc

Prec

Recall

F1-score

✓

0.9436 0.9442 0.9473

0.9835 0.9814 0.9802

0.9385 0.9402 0.9458

0.9603 0.9603 0.9626

✓

✓ ✓

0.9501 0.9518 0.9493

0.9844 0.9857 0.9840

0.9460 0.9473 0.9451

0.9647 0.9660 0.9641

✓

✓

0.9528

0.9818

0.9481

0.9646

✓ ✓

Backbone Fine-tuning vs. Frozen Encoders. Row (g) examines whether the backbones should be fine-tuned during supervised fine-tuning. Compared to the Base model (unfrozen encoders), freezing the backbone and training only the classification head (row (g)) yields a slightly lower F1-score (0.9585 vs. 0.9646). This result favors end-to-end fine-tuning, indicating that adapting the pre-trained features to the DGA detection objective provides a measurable benefit. Impact of DGA Samples in Pre-Training. Finally, row (h) evaluates the role of DGA samples in self-supervised pre-training. Relative to the Base configuration (benign and DGA pre-training), training the hybrid model on benign-only data (row (h)) results in a small but consistent drop in F1score (0.9584 vs. 0.9646). This suggests that including DGA domains during pre-training slightly improves downstream detection performance, helping the model better internalize patterns that are characteristic of algorithmically generated domains rather than benign traffic alone. 2) Ablation of Pre-training Subtasks: To justify the necessity of the joint objective Ltotal in (1), we analyze the performance of DRIFT across seven combinatorial variants of our pre-training tasks. Table III reports micro-averaged metrics across the 2020–2025 test sets, while Table IV provides the year-wise FPR and FNR breakdown. Among single-task variants (Cases 1–3), TOV alone yields the lowest average FNR across years, confirming that sequence-level verification captures global distributional cues that transfer well to DGA detection. Among two-task combinations (Cases 4–6), Case 5 (MTP+TOV) achieves the lowest FPR across all years, while Case 7 (Base) attains the lowest FNR. This contrast reflects a well-known precision–recall trade-off: incorporating the TPP objective makes the model more aggressive at flagging DGA domains, which reduces FNR—the more critical metric in security settings where missed malicious domains pose a greater operational risk than false alarms. Accordingly, we adopt the full joint objective Ltotal as the Base configuration because it yields the highest Accuracy (0.9528) and Recall (0.9481), thereby maximizing coverage of malicious domains at the cost of only a modest FPR increase relative to Case 5. 3) Per-Family Classification: To further examine the benefit of the dual-branch architecture, we conduct a family-level analysis over 148 classes (147 DGA families plus the benign class). Each family name is prefixed to indicate whether it is character-based or word-based. We fine-tune three model

TABLE IV Y EAR - WISE FPR AND FNR BREAKDOWN ACROSS SEVEN PRE - TRAINING SUBTASK COMBINATIONS (2020–2025).

1 2 3

✓

4 5 6

✓ ✓

7

✓

TPP

TOV

False Negative Rate (FNR)

2020

2021

2022

2023

2024

2025

2020

2021

2022

2023

2024

2025

✓

0.0287 0.0329 0.0352

0.0270 0.0313 0.0334

0.0294 0.0339 0.0361

0.0345 0.0400 0.0433

0.0842 0.0869 0.0964

0.0932 0.0956 0.1078

0.0381 0.0458 0.0407

0.0511 0.0509 0.0458

0.0578 0.0539 0.0467

0.0597 0.0567 0.0495

0.0801 0.0751 0.0701

0.0822 0.0758 0.0718

✓

✓ ✓

0.0276 0.0249 0.0283

0.0258 0.0230 0.0265

0.0280 0.0257 0.0292

0.0328 0.0302 0.0341

0.0784 0.0749 0.0764

0.0869 0.0836 0.0855

0.0418 0.0414 0.0428

0.0460 0.0448 0.0467

0.0464 0.0448 0.0469

0.0484 0.0465 0.0489

0.0700 0.0686 0.0712

0.0709 0.0699 0.0724

✓

✓

0.0328

0.0311

0.0336

0.0397

0.0875

0.0965

0.0402

0.0445

0.0448

0.0470

0.0657

0.0668

✓ ✓

0.3 0.2 0.1 0.0

c chir c ud2 c copperstealer c sharkbot c gspy c downloader c enviserv c toxicpanda c errorfather w gozi c corebot w nymaim2 c madmax c recjs w volatilecedar c tinyfluff c qhost c misfox c grandoreiro c mirainomi w matsnu w bigviktor c darkshell w xagent c redyms c symmi c diamondfox w ngioweb c vobfus c xxhex c gazavat c carnavalheist c coffeeloader w chaes c amadey c allasenha c bobax w fosniw c magecart c mekotio c g01 w kfos c tsifiri w vipersoftx w ud6 w ud8

1.0 0.9 0.8 0.7 0.6 0.5 0.4 0.3

MTP

c bamital c alien c feodo c dyre c coper c calfbot c teleru c sisron c verblecon c tinynuke c pandabanker c omexo c monerominer c wd c makloader c murofetweekly c gameover c padcrypt c chinad c zloader c tufik c murofet c ud5 c emotet c sphinx c qadars c ranbyus c vo1d c blackhole c flubot c ramdo c metastealer c ghostweaver c flashback c cryptolocker c tinba c mintsloader c qakbot c pitou c fobber c dircrypt c ares c ramnit c bedep c necurs c virut c mirai c locky c hesperbot c pykspa2 c pykspa2s benign c pykspa c szribi c proslikefan c lechiket c pseudomanuscrypt c shadowpad c kingminer w nymaim c ccleaner c pushdotid c phorpiex c dmsniff c conficker c mydoom c darkwatchman w suppobox c tempedrevetdd c mydoomtid c tempedreve c shifu c zeroaccess c m0yvtdd c darkcracks c ekforward c m0yv c n3cr0m0rph c pushdo c sinowal c qsnatch c tofsee c bazarbackdoor c ftcode c runforestrun c infy c vawtrak c oderoor c urlzone c ebury c ud3 c sutra c vidrotid c vidro c abcbot c orchardgenesis c orchard c banjori c simda c bumblebee c rovnix c prometei

TPR

False Positive Rate (FPR) Case

DGA Family

Fig. 5. Per-family TPRs for 147 DGA families and the benign class under three models— Hybrid (Base), subword-only (e), and character-only (f). The macro-averaged TPR is 0.6713, 0.6977, and 0.6211 for Base, (e), and (f), respectively, while the micro-averaged TPR is 0.9397, 0.9201, and 0.8954. The Hybrid model outperforms these two variants on 69 out of 147 families. Overall, the Hybrid model attains the highest micro-averaged TPR, while the subword-only variant attains the highest macro-averaged TPR. For interpretability, the families are split into two panels with different y-axis ranges to make both high and low TPR regimes visible. TABLE V R EPRESENTATIVE EXAMPLES OF DGA FAMILIES HIGHLIGHTING CASES WHERE THE BASE MODEL ACHIEVES SUPERIOR PERFORMANCE OR , DESPITE INTEGRATING ( E ) AND ( F ), PERFORMS UNEXPECTEDLY WORSE , SUPPORTED BY REAL DOMAIN SAMPLES . TPR Family

Scheme Examples

Base

(e)

(f)

Cases where the Hybrid model outperforms variants (n = 69/147) de130b71 0.9190 0.6093 0.5894 darkwatchman c 51e88cc1 7c99c1b4 0.7094 0.4704 0.4601 infy c d63bbe49 runtime-incorrect 0.2372 0.0228 0.0158 nymaim2 w remedies-nude Cases where the Hybrid model underperforms both single-branch variants —(e), (f)— (n = 15/147) cmid1s1zeiu bumblebee c 0.4128 0.8447 0.6616 tuaksrh3m4v xinchaoagcddf prometei c 0.3122 0.5258 0.8213 xinchaobhcdeg rwmu35avqo12tqc urlzone c 0.5484 0.9238 0.7437 rv1jsyatn9j3j

variants: (i) a subword-only variant (row (e) in Table II), (ii) a character-only variant (row (f)), and (iii) the proposed model (Base), and compute the TPR for each class. Fig. 5 shows that the character-only variant is effective for character-based families but struggles with word-based DGAs, whereas the subword-only variant performs more uniformly across both types; the hybrid model achieves the highest micro-averaged TPR, benefiting from the complementary strengths of both branches. Table V illustrates both regimes: for the top three families, the subword-only and character-only variants each perform poorly but the hybrid exhibits clear synergy; for

TABLE VI OVERALL FORWARD - CHAINING PERFORMANCE ON 2020–2025 TEST SETS ( MICRO - AVERAGED ACROSS YEARS ). Method

Accuracy Precision

Endgame (2016) [25] MIT (2016) [19], [45] NYU (2016) [19], [28] B-ResNet (2020) [46] M-ResNet + B-cos (2022) [47] Dom2Vec (2023) [7] HMT (2023) [9] SFT-Llama3-8B (2024) [16] HDDN (2025) [10] Fine-tuned BERT [43] DRIFT (Supervised) (Fig. 4) DRIFT

0.943948 0.930575 0.932011 0.939874 0.948813 0.927860 0.931811 0.805239 0.939153 0.938252 0.941976 0.952763

0.976964 0.986709 0.985763 0.979729 0.977461 0.968624 0.986542 0.895069 0.978111 0.983688 0.982171 0.981770

Recall F1-score 0.939656 0.910075 0.913118 0.930760 0.946484 0.923743 0.912077 0.808071 0.931284 0.924444 0.931506 0.948077

0.957947 0.946844 0.948051 0.954617 0.961723 0.945651 0.947849 0.849348 0.954123 0.953147 0.956168 0.964630

the bottom three, the single-branch variants are individually effective yet naı̈vely combining them causes the hybrid to regress, suggesting that more sophisticated fusion is needed to avoid catastrophic forgetting across branches. Several of these failure cases (e.g., prometei) involve Chinese-language contexts under-represented in training. Overall, jointly leveraging subword and character representations is crucial for robust detection of heterogeneous DGA mechanisms, directly addressing R4 . IV.3 Forward-Chaining Performance Comparison To evaluate the temporal robustness of DGA detection models, we conduct a comprehensive comparative analysis against ten baselines. These baselines span a wide range of methodologies, including classical DL models (Endgame [25], MIT [19], NYU [19]), residual networks

(B-ResNet [46], M-ResNet [47]), statistical embedding approaches (Dom2Vec [7]), advanced hybrid models (HMT [9], HDDN [10]), and large language models (BERT [43], SFTLlama3-8B [16]). All models are trained on the 2017–2019 datasets and evaluated on subsequent years (2020–2025) under the forward-chaining protocol, thereby enforcing R1 and simulating realistic model aging without retraining. We adopted public source code for MIT, NYU, B-ResNet, and M-ResNet [15], [19]. Given the large scale of our training set, we trained these models extensively until convergence. We used Hugging Face’s Transformers [48] to implement a finetuned BERT that works as a binary classifier—cf. Fig. 4(b) in [43]. For SFT-Llama3-8B, we used the following prompt— “Analyze the following domain name and classify if it is generated by a Domain Generation Algorithm (DGA) or if it is a Benign domain.\nDomain: {domain}\nLabel: {label},” where label ∈ {Benign, DGA}. We manually reproduced Endgame, Dom2Vec, HMT, and HDDN. Table VI reports the overall forward-chaining metrics averaged across years, while Table VII and Fig. 6 detail the yearwise FPR and FNR. Finally, Table VIII presents the microaveraged FNR specifically for unseen DGA families across 2020–2025. Vulnerability of Existing Models to Concept Drift. As expected, most baseline models exhibit noticeable temporal degradation. Early DL models (Endgame, MIT, NYU) show a clear FNR increase as the test year moves away from training, indicating failure to generalize to later DGA families. More recent architectures (Dom2Vec, HDDN) mitigate this only partially: both FPR and FNR steadily grow over time. SFTLlama3-8B, despite its large capacity, suffers from persistently high error rates (FPR ≈ 20%, FNR ≈ 19%), suggesting that generic generative pre-training does not directly yield the discriminative robustness required for DGA detection. Impact of Benign Concept Drift on FPR. A central observation from 2024–2025 is that all methods experience an FPR increase—for example, Endgame and HDDN see FPR more than double, from ∼4% in 2020 to ∼11–12% in 2025. This benign drift reflects the evolution of legitimate domain naming practices (e.g., creative branding, new services); models trained on older benign distributions increasingly misclassify novel legitimate domains. Our method is not immune—FPR rises from ∼3% (2020) to ∼9.6% (2025)—though still below most baselines. Temporal drift on benign traffic remains an open challenge. Robustness and Remaining Limitations. Despite this residual FPR drift, DRIFT achieves the best overall forwardchaining performance in Table VI, with the highest Accuracy (0.9528), Recall (0.9481), and F1-score (0.9646). More importantly from a dependability perspective, our FNR stays below 6.7% (0.040–0.067) across all years with labeled DGAs, whereas competitive baselines such as M-ResNet+Bcos, HMT, and fine-tuned BERT exhibit FNRs in the 4– 11% range and SFT-Llama3-8B exceeds 18%. This low and temporally stable FNR means DGA domains are reliably flagged years after deployment—critical for the dependability

of the protection system. Performance Against Future Unseen DGAs. As noted in §IV.1.1, 64 DGA families appear in the training set, while the remaining 83 families are exclusive to the test sets. Table VIII shows that DRIFT achieves the lowest FNR (0.1439) on these unseen families among the evaluated baselines (MIT, NYU, and HMT), demonstrating superior generalization to previously unseen DGA families. In summary, although DRIFT is not immune to benign concept drift, it substantially reduces and stabilizes the FNR compared to existing methods, fulfilling R2 under forwardchaining evaluation and leaving further FPR reduction as future work. IV.4 Performance under Adaptive Drift-Mitigation Strategies To evaluate adaptability against continuous concept drift, we compare DRIFT with the three baselines (NYU, MIT, and HMT) under two adaptive drift-mitigation strategies: periodic retraining (RT) and continuous learning (CL). Both protocols are implemented at yearly granularity to align with the benchmark’s year-indexed test sets and with DGArchive’s annual label cadence; the same procedure applies to the remaining baselines and is omitted for brevity. Periodic Retraining. Periodic retraining trains an independent model entirely from scratch for each evaluation year, using the progressively accumulated dataset Ytrain ∈ [2017, N ] for 2019 ≤ N ≤ 2024, with the corresponding test year Ytest = N + 1. For DRIFT, this explicitly requires repeating both the pre-training and the fine-tuning phases for every new model. Continuous Learning. Continuous learning starts from the base model trained on 2017–2019. For each N ∈ {2020, . . . , 2024}, the model from the previous step (N − 1) is updated for a single epoch using only data from Ytrain = N ; the updated model is then evaluated on Ytest = N + 1 and serves as the base for the next iteration. To prevent catastrophic forgetting and maximize efficiency in DRIFT, we freeze the pre-trained backbones and update only the classification head. As shown in Fig. 7, both adaptation strategies mitigate concept drift, and CL generally outperforms RT across all models. Crucially, CL-DRIFT (dashed red) attains the highest F1 in every test year from 2020 to 2025. This performance gain is obtained even though DRIFT updates only the classification head for a single epoch, whereas the baselines fully retrain their architectures in both RT and CL. This indicates that the invariant features learned through the pre-training already encode most of the cues needed to track emerging DGAs, so adaptation can be concentrated at the decision boundary. While both RT and CL incur practical costs—particularly the continuous acquisition of up-to-date labels—these results reinforce R2 : when adaptation is unavoidable, DRIFT serves as a markedly more efficient and robust backbone than the evaluated baselines. V. D ISCUSSION AND C ONCLUSION Our 9-year longitudinal study (2017–2025) under forwardchaining evaluation shows that state-of-the-art DGA detectors degrade rapidly as the training–deployment gap widens,

TABLE VII P ERFORMANCE COMPARISON OF EXISTING METHODS ACROSS TEST YEARS . False Positive Rate (FPR) Method

2020

2021

2022

2023

False Negative Rate (FNR)

2024

2025

2020

2021

2022

2023

2024

2025

Endgame (2016) [25] 0.037587 0.035945 0.038921 0.046901 0.109103 0.120169 0.049656 0.059766 0.064794 0.067611 0.073841 0.075314 MIT (2016) [19], [45] 0.022765 0.021082 0.023194 0.027517 0.065128 0.071038 0.069813 0.081169 0.086732 0.089291 0.104253 0.105506 NYU (2016) [19], [28] 0.024707 0.022929 0.025192 0.029634 0.066882 0.073718 0.068470 0.078663 0.083348 0.086131 0.100390 0.101692 0.043184 0.041887 0.045256 0.053354 0.097250 0.108473 0.057026 0.061783 0.063773 0.066373 0.083641 0.084701 B-ResNet (2020) [46] M-ResNet + B-cos (2022) [47] 0.039640 0.038170 0.041114 0.048349 0.098267 0.108946 0.043007 0.048391 0.049730 0.051817 0.068386 0.068851 0.050248 0.049740 0.053397 0.063417 0.127900 0.137200 0.066665 0.074395 0.078659 0.080442 0.085100 0.084700 Dom2Vec (2023) [7] HMT (2023) [9] 0.023073 0.021395 0.023669 0.027690 0.065852 0.072185 0.069080 0.079517 0.085153 0.087280 0.101229 0.102667 SFT-Llama3-8B (2024) [16] 0.199478 0.200564 0.196810 0.199898 0.200038 0.200178 0.190985 0.192171 0.189474 0.192437 0.192921 0.193405 0.045432 0.044082 0.047069 0.056879 0.098528 0.108187 0.055095 0.064236 0.070306 0.073623 0.079726 0.080943 HDDN (2025) [10] Fine-tuned BERT [43] 0.026280 0.024604 0.026919 0.031989 0.107327 0.118348 0.056094 0.068145 0.074343 0.077104 0.084107 0.091110 DRIFT (Supervised) (Fig. 4) 0.031638 0.030062 0.032776 0.038314 0.081483 0.089660 0.054527 0.061111 0.063187 0.066023 0.081593 0.082249 DRIFT 0.032849 0.031163 0.033638 0.039797 0.087579 0.096520 0.040287 0.044555 0.044820 0.047055 0.065754 0.066817 Endgame MIT NYU B-ResNet M-ResNet + B-cos Dom2Vec HMT SFT-Llama3-8B HDDN Fine-tuned BERT DRIFT (Supervised) DRIFT

0.06

0.04

0.02

0.035 0.030 FNR Increase (∆ FNR)

FPR Increase (∆ FPR)

0.08

0.025 0.020 0.015 0.010 0.005 0.000

0.00 2021

2022

2023

2024

2025

2021

2022

2023

2024

2025

Year under forward-chaining evaluation. Left: year-wise FPR for all methods. TestRight: Year year-wise FNR for all methods Fig. 6. Temporal evolution of detectionTest errors (2020–2025). The proposed method substantially reduces FNR drift while still exhibiting the benign FPR drift observed across all models.

TABLE VIII U NSEEN -FAMILIES FNR ON 2020–2025 T EST S ETS (M ICRO -AVERAGED ) Metric MIT [19], [45] NYU [19], [28] HMT [9] FNR

0.279048

DRIFT

0.255106 0.259630 0.143913

0.99

F1-score

0.98 0.97 0.96

NYU (RT) NYU (CL)

2020

2021

MIT (RT) MIT (CL)

2022 2023 Test Year

HMT (RT) HMT (CL)

2024

DRIFT (RT) DRIFT (CL)

2025

Fig. 7. Performance comparison of DRIFT and three baseline models under adaptive drift-mitigation strategies. Solid lines denote periodic retraining (RT) from scratch on accumulated historical data; dashed lines denote continuous learning (CL) via sequential single-epoch updates on each new year’s data.

especially in the form of rising FNRs. These observations motivated four requirements for drift-resilient DGA detection: temporally faithful evaluation, temporal robustness, domainname-only operation, and hybrid character/subword representations. To address these challenges, we proposed DRIFT, a dualbranch Transformer that processes domain names through subword and character tokenizations and is pre-trained with

three self-supervised objectives (MTP, TPP, and TOV), designed to learn invariant structural features directly from raw strings, without auxiliary signals such as NXDOMAIN bursts or OSINT enrichment. The resulting fused representation is fine-tuned for binary DGA detection under a domain-only setting, satisfying R3 and R4 . Across ten competitive baselines, DRIFT achieves the best overall forward-chaining performance (highest Accuracy, Recall, and F1-score averaged over 2020–2025). At the family level, the hybrid model attains the highest TPR on more families than either single-branch variant, and the highest microaveraged TPR overall. Most importantly from a dependability standpoint, DRIFT substantially reduces and stabilizes the FNR over time, maintaining low FNR even for DGAs appearing years after training—indicating that our self-supervised dual-branch design generalizes to unseen DGAs, fulfilling R2 . At the same time, our results reveal that benign concept drift remains a significant challenge: like all evaluated methods, DRIFT experiences a non-negligible increase in FPR during 2024–2025. Reducing this benign FPR drift while preserving the low FNR remains an important direction for future work— for instance, via calibrated uncertainty, adaptive thresholding, or lightweight online adaptation that limits labeling cost. We hope our longitudinal evaluation protocol, dataset curation, and representation learning framework will serve as a foundation

for future research on dependable, drift-resilient DGA detection. R EFERENCES [1] D. Plohmann, K. Yakdan, M. Klatt, J. Bader, and E. Gerhards-Padilla, “A comprehensive measurement study of domain generating malware,” in Proc. USENIX Conference on Security Symposium, ser. SEC’16. USA: USENIX Association, 2016, pp. 263—-278. [2] M. Antonakakis, R. Perdisci, Y. Nadji, N. Vasiloglou, S. AbuNimeh, W. Lee, and D. Dagon, “From throw-away traffic to bots: Detecting the rise of DGA-based malware,” in Proc. USENIX Security. Bellevue, WA: USENIX Association, Aug. 2012, pp. 491–506. [Online]. Available: https://www.usenix.org/conference/ usenixsecurity12/technical-sessions/presentation/antonakakis [3] A. Mahboubi, K. Luong, H. Aboutorab, H. T. Bui, S. Camtepe, K. Ansari, and B. Barry, “The evolving threat landscape of botnets: Comprehensive analysis of detection techniques in the age of artificial intelligence,” Internet of Things (The Netherlands), vol. 33, 2025. [Online]. Available: https://www.scopus.com/inward/record.uri?eid= 2-s2.0-105013173895&doi=10.1016%2fj.iot.2025.101728&partnerID= 40&md5=08b1919f13d6fe6e48766f501c1bed50 [4] S. Yadav, A. K. K. Reddy, A. N. Reddy, and S. Ranjan, “Detecting algorithmically generated malicious domain names,” in Proc. ACM SIGCOMM, 2010, pp. 48–61. [5] A. M. H. Saeed, D. Wang, H. A. M. Alnedhari, K. Mei, and J. Wang, “A survey of machine learning and deep learning based DGA detection techniques,” Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 13202 LNCS, pp. 133–143, 2022, cited by: 10. [Online]. Available: https://www.scopus.com/inward/record.uri? eid=2-s2.0-85127037344&doi=10.1007%2f978-3-030-97774-0 12& partnerID=40&md5=a0bad05c4e724d73a6f35f9c6db094f1 [6] H. Alqahtani and G. Kumar, “Advances in artificial intelligence for detecting algorithmically generated domains: Current trends and future prospects,” Engineering Applications of Artificial Intelligence, vol. 138, p. 109410, 2024. [Online]. Available: https://www.sciencedirect.com/ science/article/pii/S0952197624015689 [7] L. T. Aravena, P. Casas, J. Bustos-Jiménez, G. Capdehourat, and M. Findrik, “Dom2Vec - detecting DGA domains through word embeddings and AI/ML-driven lexicographic analysis,” in Proc. CNSM, 2023, pp. 1–5. [8] B. C. Cebere, J. L. B. Flueren, S. Sebastián, D. Plohmann, and C. Rossow, “Down to earth! guidelines for DGA-based malware detection,” in Proc. RAID, ser. RAID ’24. New York, NY, USA: Association for Computing Machinery, 2024, p. 147–165. [Online]. Available: https://doi.org/10.1145/3678890.3678913 [9] L. Ding, P. Du, H. Hou, J. Zhang, D. Jin, and S. Ding, “Botnet dga domain name classification using transformer network with hybrid embedding,” Big Data Research, vol. 33, p. 100395, 2023. [Online]. Available: https://www.sciencedirect.com/science/article/pii/ S221457962300028X [10] J.-L. Chen, J.-F. Qiu, and Y.-H. Chen, “A hybrid DGA DefenseNet for detecting DGA domain names based on FastText and deep learning techniques,” Computers & Security, vol. 150, p. 104232, 2025. [Online]. Available: https://www.sciencedirect.com/science/article/pii/ S0167404824005388 [11] C. Lee, C. Jung, and S. Jeong, “Longitudinal benign and DGA domain name dataset,” 2026. [Online]. Available: https://dx.doi.org/10.21227/ za2s-9e09 [12] Internet Archive, “Wayback machine—top-1m.csv.zip,” 2017, accessed on Dec 1, 2025. [Online]. Available: https://web.archive.org/web/ 20170801000000*/http://s3.amazonaws.com/alexa-static/top-1m.csv.zip [13] V. Le Pochat, T. Van Goethem, S. Tajalizadehkhoob, M. Korczynski, and W. Joosen, “Tranco: A research-oriented top sites ranking hardened against manipulation,” in Proc. NDSS, ser. NDSS 2019. Internet Society, 2019. [Online]. Available: http://dx.doi.org/10.14722/ndss.2019.23386 [14] Tranco, “A research-oriented top sites ranking hardened against manipulation,” 2019, accessed on Dec 1, 2025. [Online]. Available: https://tranco-list.eu/ [15] A. Drichel and U. Meyer, “False sense of security: Leveraging xai to analyze the reasoning and true performance of contextless dga classifiers,” in Proceedings of the 26th International Symposium on Research in Attacks, Intrusions and Defenses, ser.

RAID 2023. ACM, Oct. 2023, p. 330–345. [Online]. Available: http://dx.doi.org/10.1145/3607199.3607231 [16] R. L. L. O, C. A. Catania, and T. Parlanti, “LLMs for domain generation algorithm detection,” 2024. [Online]. Available: https: //arxiv.org/abs/2411.03307 [17] J. R. Gregório and A. M. Cansian, “Legitimate domains and dga categorized morphologically and by families.” 2025. [Online]. Available: https://data.mendeley.com/datasets/nhvyvytn2h/1 [18] H. Lee, J. Do Yoo, S. Jeong, and H. K. Kim, “Detecting domain names generated by dgas with low false positives in chinese domain names,” IEEE Access, vol. 12, p. 123716–123730, 2024. [Online]. Available: http://dx.doi.org/10.1109/ACCESS.2024.3454242 [19] B. Yu, J. Pan, J. Hu, A. Nascimento, and M. De Cock, “Character level based detection of DGA domain names,” in 2018 International Joint Conference on Neural Networks (IJCNN), 2018, pp. 1–8. [20] Y. Chen, S. Yan, T. Pang, and R. Chen, “Detection of DGA domains based on support vector machine,” in Proc. SSIC, 2018, pp. 1–4. [21] R. Sivaguru, C. Choudhary, B. Yu, V. Tymchenko, A. Nascimento, and M. D. Cock, “An evaluation of DGA classifiers,” in 2018 IEEE International Conference on Big Data (Big Data), 2018, pp. 5058–5067. [22] Y. Li, K. Xiong, T. Chin, and C. Hu, “A machine learning framework for domain generation algorithm-based malware detection,” IEEE Access, vol. 7, pp. 32 765–32 782, 2019. [23] S. Schiavoni, F. Maggi, L. Cavallaro, and S. Zanero, “Phoenix: DGAbased botnet tracking and intelligence,” in Proc. DIMVA. Springer, 2014, pp. 192–211. [24] J. Kwon, J. Lee, H. Lee, and A. Perrig, “Psybog: A scalable botnet detection method for large-scale DNS traffic,” Computer Networks, vol. 97, pp. 48–73, 2016. [25] J. Woodbridge, H. S. Anderson, A. Ahuja, and D. Grant, “Predicting domain generation algorithms with long short-term memory networks,” 2016. [Online]. Available: https://arxiv.org/abs/1611.00791 [26] S. Akarsh, S. Sriram, P. Poornachandran, V. K. Menon, and K. P. Soman, “Deep learning framework for domain generation algorithms prediction using long short-term memory,” in Proc. ICACCS, 2019, pp. 666–671. [27] J. Selvi, R. J. Rodrı́guez, and E. Soria-Olivas, “Toward optimal LSTM neural networks for detecting algorithmically generated domain names,” IEEE Access, vol. 9, pp. 126 446–126 456, 2021. [28] X. Zhang, J. Zhao, and Y. LeCun, “Character-level convolutional networks for text classification,” in Advances in Neural Information Processing Systems, C. Cortes, N. Lawrence, D. Lee, M. Sugiyama, and R. Garnett, Eds., vol. 28. Curran Associates, Inc., 2015. [29] Y. Kim, “Convolutional neural networks for sentence classification,” arXiv preprint arXiv:1408.5882, 2014. [Online]. Available: https: //arxiv.org/abs/1408.5882 [30] N. Kalchbrenner, E. Grefenstette, and P. Blunsom, “A convolutional neural network for modelling sentences,” arXiv preprint arXiv:1404.2188, 2014. [Online]. Available: https://arxiv.org/abs/1404.2188 [31] K. Highnam, D. Puzio, S. Luo, and N. R. Jennings, “Real-time detection of dictionary DGA network traffic using deep learning,” SN Computer Science, vol. 2, no. 2, p. 110, 2021. [32] F. Ren, Z. Jiang, X. Wang, and J. Liu, “A DGA domain names detection modeling method based on integrating an attention mechanism and deep neural network,” Cybersecurity, vol. 3, no. 1, p. 4, 2020. [33] W. Huang, Y. Zong, Z. Shi, L. Wang, and P. Liu, “PEPC: A deep parallel convolutional neural network model with pre-trained embeddings for DGA detection,” in 2022 International Joint Conference on Neural Networks (IJCNN), 2022, pp. 1–8. [34] J. J. Koh and B. Rhodes, “Inline detection of domain generation algorithms with context-sensitive word embeddings,” in Proc. Big Data, 2018, pp. 2966–2971. [35] S. Liew and N. Law, “Use of subword tokenization for domain generation algorithm classification. cybersecurity 6 (1), 49 (sep 2023).” [36] P. W. Koh, S. Sagawa, H. Marklund, S. M. Xie, M. Zhang, A. Balsubramani, W. Hu, M. Yasunaga, R. L. Phillips, I. Gao et al., “Wilds: A benchmark of in-the-wild distribution shifts,” in Proc. ICML. PMLR, 2021, pp. 5637–5664. [37] S. Schüppen, D. Teubert, P. Herrmann, and U. Meyer, “FANCI: Feature-based automated NXDomain classification and intelligence,” in Proc. USENIX Security 18. Baltimore, MD: USENIX Association, Aug. 2018, pp. 1165–1181. [Online]. Available: https://www.usenix. org/conference/usenixsecurity18/presentation/schuppen

[38] Y. Iuchi, Y. Jin, H. Ichise, K. Iida, and Y. Takai, “Detection and blocking of DGA-based bot infected computers by monitoring NXDOMAIN responses,” in Proc. CSCloud, 2020, pp. 82–87. [39] G. Liu, L. Jin, S. Hao, Y. Zhang, D. Liu, A. Stavrou, and H. Wang, “Dial ”n” for NXDomain: The scale, origin, and security implications of DNS queries to non-existent domains,” in Proc. IMC, ser. IMC ’23. New York, NY, USA: Association for Computing Machinery, 2023, p. 198–212. [Online]. Available: https://doi.org/10.1145/3618257.3624805 [40] P. Mockapetris, “Domain names - implementation and specification,” RFC Editor, RFC 1035, Nov. 1987, https://www.rfc-editor.org/info/ rfc1035. [Online]. Available: https://www.rfc-editor.org/info/rfc1035 [41] Mozilla Foundation, “Public suffix list,” 2025, accessed: 2026-02-23. [Online]. Available: https://publicsuffix.org/list/public suffix list.dat [42] J. Kurkowski, “tldextract: Accurately separates a URL’s subdomain, domain, and public suffix,” 2025, python package. [Online]. Available: https://github.com/john-kurkowski/tldextract [43] J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova, “BERT: Pre-training of deep bidirectional transformers for language understanding,” 2019. [Online]. Available: https://arxiv.org/abs/1810.04805 [44] J. Liang, J. Jiang, H. Duan, K. Li, and J. Wu, “Measuring query latency of top level DNS servers,” in Proc. PAM. Springer, 2013, pp. 145–154. [45] S. Vosoughi, P. Vijayaraghavan, and D. Roy, “Tweet2vec: Learning tweet embeddings using character-level cnn-lstm encoder-decoder,” in Proc. ACM SIGIR, ser. SIGIR ’16. New York, NY, USA: Association for Computing Machinery, 2016, p. 1041–1044. [Online]. Available: https://doi.org/10.1145/2911451.2914762 [46] A. Drichel, U. Meyer, S. Schüppen, and D. Teubert, “Analyzing the real-world applicability of DGA classifiers,” in Proceedings of the 15th International Conference on Availability, Reliability and Security, ser. ARES ’20. New York, NY, USA: Association for Computing Machinery, 2020. [Online]. Available: https://doi.org/10.1145/3407023. 3407030 [47] M. Böhle, M. Fritz, and B. Schiele, “B-cos networks: Alignment is all we need for interpretability,” 2022. [48] T. Wolf, L. Debut, V. Sanh, J. Chaumond, C. Delangue, A. Moi, P. Cistac, T. Rault, R. Louf, M. Funtowicz, J. Davison, S. Shleifer, P. von Platen, C. Ma, Y. Jernite, J. Plu, C. Xu, T. L. Scao, S. Gugger, M. Drame, Q. Lhoest, and A. M. Rush, “Transformers: State-ofthe-art natural language processing,” in Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing: System Demonstrations. Online: Association for Computational Linguistics, Oct. 2020, pp. 38–45. [Online]. Available: https: //www.aclweb.org/anthology/2020.emnlp-demos.6