## 1 Introduction
### Proposed Model  
The proposed deep learning model, a fundamental part of the proposed computational scheme, is based on CNN and natural language-processing techniques, with its data input into a character-level embedding layer [12; 28]. This receives an initial vector composed of 70 ASCII values relative to each character in the domain to be classified. The embedding layer then converts each value into a vector of 60 values, related to the context of that character in the domain name in question. The output of the embedding layer is then connected to a CNN structure that seeks to extract meta-features relevant to domain name  
\begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline
**\#** & **Family** & **Examples** & **\#** & **Family** & **Examples** & **\#** & **Family** & **Examples** \\ \hline
1 & gameover & 165,000 & 22 & pushdo & 10,468 & 43 & padcrypt & 2520 \\
2 & virt & 149,942 & 23 & suppobox & 10,350 & 44 & shifu & 2331 \\
3 & murofet & 113,400 & 24 & locky & 10,320 & 45 & pseudoman & 2300 \\
4 & tinba & 111,368 & 25 & pykspa2s & 9960 & 46 & ebury & 2000 \\
5 & necurs & 107,328 & 26 & zloader & 9109 & 47 & fobber & 2000 \\
6 & metastealer & 80,000 & 27 & conficker & 7500 & 48 & proslikefan & 1950 \\
7 & qakbot & 60,000 & 28 & darkwatchman & 7500 & 49 & tinynuke & 1920 \\
8 & flubot & 55,577 & 29 & pushdotid & 6000 & 50 & sphix & 1920 \\
9 & bazzloader & 46,924 & 30 & qadars & 6000 & 51 & rovnix & 1900 \\
10 & monerominer & 37,430 & 31 & ramdo & 6000 & 52 & gozi & 1757 \\
11 & ranbyus & 34,300 & 32 & corebot & 5850 & 53 & nymaim2 & 1600 \\
12 & banjori & 32,120 & 33 & nymaim & 5669 & 54 & bamital & 1560 \\
13 & urlzone & 32,020 & 34 & necro & 4757 & 55 & pitou & 1464 \\
14 & tinyfluff & 30,000 & 35 & xchex & 4400 & 56 & orchard & 1447 \\
15 & gnatch & 27,787 & 36 & symmi & 4320 & 57 & phorpiex & 1431 \\
16 & rammit & 20,109 & 37 & gamover\_p2p & 3000 & 58 & dircrypt & 1400 \\
17 & simda & 16,474 & 38 & murofetweekly & 3000 & 59 & mydoom & 1226 \\
18 & tufik & 15,300 & 39 & ngioweb & 2924 & 60 & grandoreiro & 1095 \\
18 & dyre & 15,000 & 40 & emotet & 2880 & 61 & darkshell & 1049 \\
20 & cryptolocker & 15,000 & 41 & vawtrak & 2700 & & & \\
21 & chinad & 15,000 & 42 & m0 yvtdd & 2664 & & & \\ \hline \hline \end{tabular}
\end{table}
Table 1: Distribution of examples by DGA family in the dataset.  
classification from the 70 vectors of 60 values provided by the next higher layer. This CNN structure has six convolutional layers, in addition to relu and maxpooling layers. The output of the CNN structure is then connected to a flattened layer to adjust the shape of the data and then deliver it to a dense classifier. The last dense layer of the classification has a number of neurons equal to the number of classes for which the model is being trained and uses softmax as an activation function. This function assigns a floating point value to each output neuron, and the sum of these values will always be equal to 1 and the highest observed value represents the class to which the model classified the input example. Figure 1 presents a conceptual model of the proposed classifier model; the model itself is available in full in the Kaggle Notebook mentioned in Section 1.