## 5 Conclusions  
In this paper, we aimed to identify dynamically generated domains from massive DNS queries to detect the callbacks of dict-DGA malware. The main issue to address was the character-level similarities between dynamically generated domain names and human-generated domain names; modeling based on these similarities is unlikely to be sufficiently accurate to detect dict-DGA malware. Therefore, we proposed an approach for identifying malicious domain names by analyzing their character strings at the word level. This approach was based on the following observations: Each type of dict-DGA malware uses its own dictionaries and algorithms to generate domain names and the word usages of malware-generated domains are distinctly different from those of human-generated domains. The results of the experiments conducted as part of this study showed that our approach could achieve accuracy, recall, and precision as high as 0.9989, 0.9977, and 0.9869, respectively. We also clarified the functional superiority of our approach via qualitative comparisons with published methods. Taken together, these results suggest that malware-infected computers can be identified and removed from networks using DNS queries for detected malicious domains as triggers. Therefore, we conclude that our approach can contribute considerably to improving network security by providing the ability to address various malware encroachments.  
The novel characteristics of our strategy ensure three levels of effectiveness. First, our approach enables high performance for detecting dict-DGA malware, even though it lacks the ability to detect typical DGA malware. It may be possible to resolve this issue by combining this approach with other available techniques. Next, the applicability of our approach is not restricted to networks with encrypted communications. In addition, its nature does not depend on the network scale. Finally, the computational cost of our approach can be reduced by restricting attention solely to specific domains for which the name resolution meets both the request of forward lookup and the response of NXDOMAIN messages. Imposing these two conditions substantially reduces the number of domains requiring identification, which means that simply optimizing this approach should suffice to yield satisfactory performance for practical operation.  
In the future, we plan to evaluate the identification accuracy and computational time of our proposed approach in relation to DNS queries observed over large-scale networks. We will also continue to discuss the evaluation results.  
Conceptualization and methodology, A.S. and Y.F.; software, A.S.; validation, formal analysis, and investigation, A.S. and Y.F.; resources, G.K. and Y.N.; data curation, A.S.; writing--original draft preparation and writing--review and editing, A.S.; visualization, A.S. and Y.F.; supervision and project administration, G.K. and Y.N.; funding acquisition, A.S. and G.K.; All authors have read and agreed to the published version of the manuscript.  
This work was supported by the Telecommunications Advancement Foundation (TAF). Part of this work was carried out as a Cooperative Research Project of the Research Institute of Electrical Communication (RIEC) of Tohoku University.  
DNS queries observed in our institute cannot be shared due to legal, confidentiality, and privacy concerns.  
The authors declare no conflict of interest.  
The following abbreviations are mainly used in this manuscript:  
\begin{tabular}{l l} DGA & Domain Generation Algorithm \\ Dict-DGA & Dictionary-Based DGA \\ C\&C & Command-and-Control Server \\ DNS & Domain Name System \\ ADNS & Authoritative DNS Server \\ RDNS & Recursive DNS Server \\ NXDOMAIN & Nonexisting Domain \\ \end{tabular}