## 4 Experiments
### Results
#### 4.3.1 Comparison Experiments with Existing Detection Methods
\begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Family**} & \multicolumn{4}{c}{**Recall**} \\ \cline{2-5}  & **Ours** & **Koh** &
\begin{tabular}{c} **ATT-CNN-** \\ **BiLSTM** \\ \end{tabular} & **LSTM.MI** \\ \hline Locky & 97.10\% & 95.65\% & 96.25\% & 95.90\% \\ \hline Murofet\_v1 & 100.00\% & 100.00\% & 100.00\% & 100.00\% \\ \hline Murofet\_v2 & 99.80\% & 99.70\% & 99.85\% & 99.65\% \\ \hline Murofet\_v3 & 100.00\% & 100.00\% & 100.00\% & 100.00\% \\ \hline Necurs & 98.55\% & 97.55\% & 98.05\% & 97.65\% \\ \hline Padcrypt & 99.65\% & 98.70\% & 99.40\% & 99.55\% \\ \hline Proslikefan & 91.65\% & 87.85\% & 89.60\% & 88.55\% \\ \hline Pushdo & 95.25\% & 86.15\% & 95.15\% & 93.90\% \\ \hline Pykspa & 92.20\% & 88.35\% & 90.70\% & 89.70\% \\ \hline Pykspa\_noise & 92.40\% & 89.20\% & 91.70\% & 90.60\% \\ \hline Qadars & 99.40\% & 98.80\% & 99.10\% & 98.95\% \\ \hline Qakbot & 99.25\% & 98.70\% & 99.10\% & 98.65\% \\ \hline Ramdo & 99.65\% & 99.25\% & 99.80\% & 99.85\% \\ \hline Ramnit & 98.60\% & 97.45\% & 98.15\% & 97.50\% \\ \hline Ranbyus\_v1 & 99.55\% & 99.45\% & 99.55\% & 99.55\% \\ \hline Ranbyus\_v2 & 99.80\% & 99.80\% & 99.75\% & 99.85\% \\ \hline Shiotob & 99.05\% & 98.90\% & 98.65\% & 98.70\% \\ \hline Simda & 94.80\% & 80.60\% & 96.15\% & 96.15\% \\ \hline Sisron & 100.00\% & 100.00\% & 100.00\% & 100.00\% \\ \hline Symmi & 100.00\% & 99.95\% & 100.00\% & 99.80\% \\ \hline Tempedreve & 94.20\% & 90.75\% & 92.90\% & 92.75\% \\ \hline Tinba & 99.80\% & 99.15\% & 99.20\% & 99.30\% \\ \hline Vawtrak\_v1 & 96.10\% & 92.45\% & 94.40\% & 94.25\% \\ \hline Vawtrak\_v2 & 99.65\% & 86.60\% & 98.15\% & 99.70\% \\ \hline Vawtrak\_v3 & 99.80\% & 79.90\% & 99.00\% & 99.00\% \\ \hline Zeus-newgoz & 100.00\% & 100.00\% & 100.00\% & 100.00\% \\ \hline \hline \end{tabular}
\end{table} 
Table 4: _Cont._DGA Archive and Netlab 360 to compare the recall rates of the final models trained on the full dataset. The experimental results are shown in Table 5.  
Based on the comparison results, we found that our method achieved the best recall rates on the three generalization datasets, which were slightly higher than those of the other three comparison methods, demonstrating that our method has the ability to detect AGDs in real traffic and the ability to detect latest AGD samples. **(4) Comparison experiment for adversarial DGA families**  
In recent years, many researchers use adversarial methods to construct AGDs, which makes the detection even harder [40; 41; 42; 43; 44; 45]. In order to test the detection ability of our method against such DGA families, we constructed a dataset for the experiment. We separately selected 10,000 AGDs generated by adversarial methods named _deception_ and _deception_2 proposed by [PERSON] et al. [42], and randomly selected 50,000 AGDs and 70,000 benign domain names from the full dataset. Finally, a dataset containing 140,000 domain names was constructed and split into training, validation, and testing sets. The experimental results are shown in Table 6.  
The results in Table 6 show that our method achieved the best detection performance, and the recall rates of the two adversarial DGA families are more than 70%, which proves that our method also has detection ability for Adversarial DGA samples. \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Indicators** & **Ours** & **Koh** &
\begin{tabular}{c} **ATT-CNN-** \\ **BiLSTM** \\ \end{tabular} & **LSTM.MI** \\ \hline Accuracy & 89.13\% & 87.10\% & 84.33\% & 84.30\% \\ \hline Precision & 89.32\% & 86.90\% & 86.21\% & 86.43\% \\ \hline Recall & 88.87\% & 87.37\% & 81.73\% & 81.37\% \\ \hline F1 & 89.10\% & 87.13\% & 83.91\% & 83.83\% \\ \hline Recall of _Deception_ & 74.42\% & 72.63\% & 61.24\% & 59.31\% \\ \hline Recall of _Deception2_ & 72.24\% & 66.50\% & 50.73\% & 49.97\% \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Comparison of adversarial DGA families.