## 1 Introduction  
The domain name system (DNS) is a decentralized system that is mainly used to build the mapping relationship between domain names and internet protocols (IPs) and to convert readily memorized domain names to numerical IP addresses. For network attacks such as botnets, to improve the reliability of the communication between the command and control (C&C) server and infected devices, attackers use the domain generation algorithm (DGA) to generate many random domain names, from which one or more domain names are selected to be registered as the domain names of the C&C server. With the use of many random domain names, i.e., algorithmically generated domains (AGDs), attackers may prevent communication from being blocked by blacklists to evade the detection of antiviruses. Therefore, DGA plays an important role in network attacks. DGA usually generates a set of random strings with the help of random seeds and combines them with specific top-level domain names (TLDs) to generate a set of AGDs. Therefore, AGDs usually exhibit randomness in the character sequences. In addition, the infected devices attempt to establish connections with the C&C server by querying the randomly generated AGDs, which results in many nonexistent domains (NXDomain) during the requests. Compared with normal DNS traffic, DGA traffic exhibits abnormalities in both domain names and traffic behaviors. Therefore, common DGA attack detection methods can be generally divided into two types: domain name-based methods and traffic-based methods. Domain name-based methods usually extract features such as character entropy, domain name length, ratio of vowels and consonants from a single DNS domain name [1; 2; 3] and use machine learning models [1; 2; 3], deep learning networks [4; 5; 6], or clustering methods [7; 8] to measure the randomness of the characters in domain names and detect the AGDs. Common models used in these methods include support vector machines (SVMs) [1; 9], random forests (RFs) [1; 10], recurrent neural networks (RNNs) [4; 5], convolutional neural networks (CNNs) [6; 11], K-means [7] and DBSCAN [8]. Traffic-based methods [12; 13; 14; 15; 16] usually obtain the traffic of a network device within a period and detect DGA traffic by analyzing the behavior characters, such as the ratio of the NXDomain or the similarity of queried domain names. Traffic-based methods are not limited by the training samples and may achieve good detection effects on new DGA attacks. However, in both the training and detection processes, they must buffer traffic for a certain period, which makes it difficult to achieve real-time detection and makes the training process relatively complicated. For domain name-based methods, the detection unit is usually a single domain name, and only a domain name dataset are needed when training the model. These methods achieve a better effect in real-time detection and are currently a popular topic of research in DGA attack detection. Since domain name-based detection methods mainly aim to detect AGDs, in this paper, AGD detection has the same meaning as domain name-based detection of DGA attacks. Traditional AGDs generated with random characters are quite different from normal domain names, making them easy to detect. Therefore, to generate AGDs more like normal domain names, attackers have developed the dictionary-based DGA (or wordlist-based DGA). In the dictionary-based DGA, a dictionary or wordlist is first established and then random domain names are generated by concatenating words selected from the dictionary with random seeds. Such AGDs appear to have practical semantics, which is challenging for domain name-based detection methods. There are currently 5 main types of methods for dictionary-based AGD detection. (1) Graph methods for discovering AGD words [9; 17; 18; 19]: In terms of word selection, dictionary-based DGAs tend to use different words from normal domain names. Therefore, dictionary-based AGDs can be found by constructing word relationship graphs.