## 4 Evaluation
### Qualitative Comparison  
Table 7 presents a qualitative comparison of the proposed approach and nine previously published methods, which are representative examples of blacklist-based detection [18], DPI-based detection [23], behavior-based detection [29; 30; 31], ML-based detection [4], DL-based detection [5; 34], and estimated dictionary-based detection [36]. In this comparison, we focus on the following five items: (1) DGA malware detection performance, (2) dict-DGA malware detection performance, (3) the ability to detect malware in real time, (4) robustness to encryption, and (5) dependence on network scale. These items are used to compare detection performance and operational limitations, which are the practical issues of each method discussed in Sections 2.2 and 4.2. The first three items correspond to detection performance, while the other two correspond to operational limitations. As noted in the previous section, the proposed approach has the ability to detect dict-DGA malware with high accuracy. The specific advantages of this approach include the following: In contrast to the BotHunter of [PERSON] et al. [23], the detection performance is not limited by encrypted communication; in contrast to both the DNSMap of [PERSON] et al. [30] and the DBod of [PERSON] et al. [31], the operation does not depend on the network scale. Unfortunately, our approach is useless against typical DGA malware because it specializes in detecting dict-DGA malware and thus must be complemented by additional techniques, such as the methods of [PERSON] et al. [5] and [PERSON] et al. [34], for practical operation. The proposed approach is more computationally expensive than other detection methods based on character strings in domain names [4; 5; 34; 36] because of the two tasks must be performed via brute-force algorithms in Sections 3.3 and 3.4: Identifying optimal candidates to segment domain strings into words and associating vertices with words. As described in \begin{table}
\begin{tabular}{l c c c c c c c c} \hline \hline  & \(\mathbf{X_{0}}\) & \(\mathbf{X_{1}}\) & \(\mathbf{X_{2}}\) & \(\mathbf{X_{3}}\) & \(\mathbf{X_{4}}\) & \(\mathbf{X_{5}}\) & \(\mathbf{X_{6}}\) & \(\mathbf{X_{7}}\) \\ \hline [PERSON] et al. [5] & 15,631 & 0 & 154 & 0 & 62 & 27 & 0 & 220 \\ [PERSON] et al. [36] & 105,706 & 0 & 285 & 26 & 23,286 & 28 & 0 & 36 \\ Our work & 2772 & 0 & 295 & 31 & 29 & 32 & 0 & 82 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Numbers of misidentified domains in the datasets. \begin{table}
\begin{tabular}{l c c c c c} \hline \hline  & **(1) DGA Malware Detection** & \begin{tabular}{c} **(2) Dict-DGA Malware Detection** \\ **Detection** \\ \end{tabular} & \begin{tabular}{c} **(3) Real-Time Detection** \\ \end{tabular} & \
\begin{tabular}{c} **(4) Robust to** \\ **Encryption** \\ \end{tabular} &
\begin{tabular}{c} **(5) Network-** \\ **Scale Independent** \\ **dent** \\ \end{tabular} \\ \hline [PERSON] et al. [18] & & & & ✓ & ✓ & ✓ \\ [PERSON] et al. [23] & & & ✓ & & ✓ \\ [PERSON] et al. [29] & & & ✓ & ✓ & ✓ \\ [PERSON] et al. [30] & & & & ✓ & \\ [PERSON] et al. [31] & ✓ & ✓ & & ✓ & \\ [PERSON] et al. [4] & ✓ & & ✓ & ✓ & ✓ \\ [PERSON] et al. [5] & ✓ & & ✓ & ✓ & ✓ \\ [PERSON] et al. [34] & ✓ & & ✓ & ✓ & ✓ \\ [PERSON] et al. [36] & & ✓ & ✓ & ✓ & ✓ \\ Our work & & ✓ & & ✓ & ✓ \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Qualitative comparison of our work with other well-known detection methods. Section 4.1, our approach took 2896 s to process 646,224 queries while the calculation times for [5; 36] were 402 s and 72 s, respectively. To reduce the computational cost, this approach restricts attention solely to specific domains for which the name resolution meets both the request of forward lookup and the response of NXDOMAIN messages. Imposing these two conditions substantially limits the number of domains that must be identified. Note that an NXDOMAIN response signifies that a domain is not registered, so no data transmission can arise associated with the name resolution.