## 1 Introduction
In [15], the proposal was a hybrid model using transformers and CNN to classify around 50 DGA families in the NetLab360 dataset. The obtained results presented are a macro precision of 71.66% and a macro F1 score of 67.44%. Another work, Ref. [16], presents a study on multiclass classification involving 12 categories, comprising 11 word-based DGA families and legitimate examples. The proposed model utilizes a Bi-LSTM deep neural network, with input data derived from word embeddings. The study reports an F1 score of 94.40% for DGAs and 77.30% for the legitimate class. Therefore, recent DGA detection models exhibit performance metrics nearing ideal results, with accuracy rates surpassing 95%. The researchers in [17] address multiclass DGA classification and the problem of class imbalance using an approach based on a deep learning model and a transfer learning technique. The work addresses the issue of catastrophic forgetting in transfer learning between deep neural network models to mitigate the class imbalance problem. However, recent studies focusing on the classification of these DGAs suggest that there is still room for improvement, especially with regard to the increase in classes. It can also be seen that all works start from a well-defined dataset, with a specific number of DGA families, and use the entire dataset to train and test their models. Given the daily emergence of new threats and the resultant new DGA families, it would be highly valuable to incrementally retrain [18] a model that already exhibits adequate performance metrics. This approach should allow the model to identify new families without compromising its ability to classify previously known families and without requiring the use of all examples from all known families [19]. However, in artificial neural networks, there is a phenomenon known as catastrophic forgetting [20; 21]. This occurs when a pre-trained model is retrained with a dataset different from the one originally used,  
algorithm-generated domain examples. The institute kindly provided us with access to its API, allowing us to query both historical DGA data and daily cataloged examples. Through the API, it collected examples of DGAs observed over a 15-day period, from 1 January to 15 January 2024, encompassing 122 DGA families. For the development of this work, only families with at least 1000 examples in the dataset were selected, reducing the number of families to 61. Table 1 presents the distribution of examples for each DGA family that make up the dataset used. Domain names were encoded character by character to ASCII code. The maximum length checked across the domain name samples was 70 characters, so smaller domain names were padded with zeros from the end to the maximum length. No data cleaning was necessary because the data received by the above-cited API was already tabulated, and the only input datum used was the domain name. No normalization or transformation was applied to the data to keep the model's input data as close to reality as possible. To train and test the proposed model, as well as the other models to compare the results, the dataset was separated in the proportion of 70% for training and 30% for testing into three different random states using the repeated holdout [27] principle to mitigate the impact of selection on results. For the class increment experiment, a family was selected and removed from the dataset; the remaining dataset was then separated into a proportion of 70% for training and 30% for testing. In this case, three families were chosen depending on the number of examples present in the dataset, namely Metastealer with 80,000 examples in the dataset, Suppobox with 10,350 examples in the dataset, and Darkshell with only 1049 examples available.