## 1 Introduction
This type of method is usually used for the detection of dictionary-based AGDs, and like traffic-based methods, a certain amount of data is required to perform detection, while a single domain name cannot be detected in real-time. (2) Methods based on meaningful word segmentation [10; 20; 21; 22; 23; 24]: Like the randomness of characters in character-based AGDs, dictionary-based AGDs exhibit randomness in the words selected. Meaningful word segmentation methods split the concatenated string into a set of meaningful English words to obtain the component words of dictionary-based AGDs. Then, features, such as statistical features and word distribution features are extracted from the word sets and used for classification. This type of method performs well for dictionary-based AGDs, but the methods are usually based on some distribution features, such as the average mean pooling of word features [20] or the part-of-speech distribution features [25], without considering the word correlation in a domain name. Therefore, the detection performance of dictionary-based AGDs should be improved, and the detection performance of character-based AGDs is lower than that of other types of methods. (3) Methods based on n-gram sequences [10; 26; 27; 28; 29; 30; 31; 32]: Methods of this type usually perform classification using the n-gram sequences obtained by the segmentation of the domain name by the n-gram algorithm and extracting statistical features or extract sequence features using deep neural networks such as RNN. Increasing the value of \(n\) improves the description of the character fragment sequence but increases the complexity exponentially. Therefore, the maximum value of \(n\) is usually 3. This kind of method can detect both character-based and dictionary-based AGDs, but it is insufficient to describe the characteristics of the component units (i.e., words) in dictionary-based AGDs. (4) Methods based on local feature extraction using CNN models [32; 33; 34; 35; 36; 37]: Methods of this type use a CNN model to extract local features, which are similar to the features of n-grams. Then,the sequence composed of local features is obtained, and sequence detection methods such as the long short-term memory (LSTM) model are used to perform classification. These methods can also detect both character-based and dictionary-based AGDs, but they cannot describe the word characteristics of dictionary-based AGDs. (5) Methods that introduce external information [38]: When extracting the features of domain names, some external features, such as WHOIS information, are extracted as auxiliary features for AGD detection. Methods of this type can also detect both kinds of AGDs. However, these methods usually require the internet for detection, making them difficult to use on offline devices. In summary, most current AGD detection methods use meaningful word segmentation features or sequence features for detection. The word distribution features of domain names can be effectively used to detect dictionary-based AGDs; character sequence features based on n-grams can effectively detect character-based AGDs, and n-gram sequence features can also help improve the detection performance of dictionary-based AGDs. However, in previous studies, the methods are insufficient for mining meaningful word features of the domain names, and the performance of hybrid detection of character-based and dictionary-based AGDs needs to be further improved. In this paper, we first enhance the meaningful word segmentation features based on previous studies and analyze the n-gram sequence features under different values of \(n\). To improve the detection performance of dictionary-based AGDs, the word distribution features, statistical features and 3-gram sequence features of the domain names are used to describe the word features and sequence features of dictionary-based AGDs. The 1-gram sequence features of the domain names are used to ensure the detection of the character-based AGDs.