## 2 Related Work and Methods  
### Autoencoder  
Neural networks have a strong ability to perform both linear and nonlinear mappings. They can learn arbitrary transformations and are well-suited for a wide range of tasks, including visual recognition and image segmentation. Among them, the autoencoder is a widely adopted neural network model known for its effectiveness in unsupervised fea  
Figure 1: The structure of DGA (different colors represent different features). ture learning and supervised dimensionality reduction tasks [21]. For intrusion detection, [PERSON] et al. [22] proposed SIGMOD, which integrates an improved Gaussian mixture model with a stacked sparse autoencoder. SIGMOD performs nonlinear dimensionality reduction through the autoencoder and determines sample anomalies based on reconstruction error. [PERSON] and [PERSON] [23] integrated three feature selection techniques to choose the optimal feature subset after unsupervised autoencoder feature extraction. [PERSON] et al. [19] leveraged autoencoders to represent each feature nonlinearly with varying weights and employed group sparse regularization to eliminate redundancy and achieve effective feature selection. [PERSON] et al. [20] further improved the network structure by introducing Lasso regularization penalties, enhancing feature selection efficiency, and reducing computational complexity. [PERSON] et al. [24] explored the flexibility of autoencoder loss functions and activation functions to address various learning tasks. They innovatively applied orthogonal non-negative constraints, transforming the encoder's weight matrix into an index matrix for feature selection. [PERSON] et al. [25] introduced the ACC_AN, which incorporates adaptive neighbor-based structured graph learning into deep autoencoder networks. This method preserves the data structure and enhances clustering performance. In summary, the autoencoders exhibit exceptional capabilities in nonlinear mapping and model generalization. They can effectively generate high-quality data representations, reduce redundancy, and extract low-dimensional features. These characteristics make autoencoders highly suitable for unsupervised feature selection, ultimately enhancing the performance of downstream tasks such as clustering. Autoencoders consist of a simple neural network whose goal is to transform input into output while preserving the same information as the input and minimizing distortion [22]. The primary constituents of an autoencoder comprise two components: an encoder and a decoder. For a single-layer autoencoder, the function \(h(x,\theta)\approx x\) is learned through encoding and decoding. Considering a data matrix \(X\in R^{d\times n}\), where d denotes the dimensions (i.e., the number of features) and n represents the sample size. The function \(h(\cdot)\) represents the nonlinear function, and \(\theta\) represents the parameter set. More specifically, the workflow of an autoencoder consists of two steps:  
Encoder. The encoder reduces the dimensionality of the raw data, compressing it into a low-dimensional space, thereby compelling the neural network to capture the most informative features present within it. Encoding process: mapping raw data X to a low-dimensional data representation \(Y\in R^{m\times n}\). \[Y=\sigma(W_{1}X+b_{1}) \tag{1}\]  
In the equation, \(W_{1}\in R^{m\times d}\) represents a weight matrix, \(b_{1}\in R^{m}\) denotes a bias vector, and refers to the basic nonlinear activation function is represented by \(\sigma(\cdot)\). The sigmoid function, hyperbolic tangent function, and rectilinear element are the most widely utilized activation functions. Decoder. The low-dimensional representation of the hidden layer is restored to the original data dimension by the decoder, with the expectation that the output will fully or approximately recover the original input. Decoding process: transforming the low-dimensional data representation \(Y\) back to the input space \(\hat{X}\in R^{d\times n}\).