## 2 Related Work
### Domain Name-Based Methods for Dictionary-Based AGDs
[27] extracted n-gram sequences and calculated embedding vectors for each n-gram, then used the LSTM model for binary classification, and further performed family classification for the domain names that were classified as AGDs. They used unlabeled samples to pre-train the n-gram embedding model, thereby solving the problem of insufficient labeled samples in the classifier training stage. Overall, the methods based on n-gram sequences usually deal with both character-based and dictionary-based AGDs at the same time. However, when encoding the n-grams, the number of distinct n-grams grows exponentially with the value of \(n\), so usually, 3 is the maximum value of \(n\). To address this problem, [PERSON] et al. [28] proposed a masked n-gram method, which first replaced the characters in the domain name with the 4 character types and used the n-gram algorithm for segmentation. In this way, the number of distinct n-grams was significantly decreased by the replacement, and a larger n-gram (i.e., 4 grams) was extracted. After constructing features based on the occurrence of each distinct n-gram, along with 18-dimensional lexical features, they used a random forest model for classification. However, the performance of methods based on the n-gram sequence was largely limited by the value of \(n\), and it was insufficient for these methods to be able to describe the characteristics of the component unit (i.e., words) of dictionary-based AGDs. Some researchers used a CNN model to extract local features to detect dictionary-based AGDs [32; 33; 34; 35; 36; 37], which has features similar to those of n-grams, and can extract a larger range of local features than methods based on n-gram sequences. [PERSON] et al. [33] first transformed domain names into feature sequences according to the character embeddings, extracted local features in parallel through a CNN network with multiple convolution kernels of different sizes, and extracted character sequence features through a bidirectional LSTM model. Then, the features from the CNN and bidirectional LSTM were concatenated for classification. [PERSON] et al. [34; 35] proposed the ATT-CNN-BiLSTM model based on CNN, bidirectional LSTM and the attention mechanism. Feature sequences were first obtained by character embeddings of domain names without TLD, and CNN layers were used to extract local features from the feature sequences. Then, sequence features were extracted by bidirectional LSTM layers, and an attention layer was used to allocate the corresponding weight. Finally, the features were input into fully-connected layers for classification. Overall, this kind of method can effectively extract the features from the sequence constructed by local features from the domain names. However, like n-gram sequence-based methods, these methods are insufficient for describing the characteristics of the words of dictionary-based AGDs. In addition to features from the domain names themselves, some methods obtain additional external information, such as WHOIS information [38], as supplementary data. However, the acquisition of this external information requires the use of the internet, which makes the methods difficult to use on offline devices. Based on the above findings, we chose to combine the meaningful word segmentation and n-gram sequence features of the domain names to improve the detection effect of dictionary-based AGDs and take into account the detection effect of character-based AGDs by n-gram sequence features.