## 4 Experiments
### Results
#### 4.3.1 Comparison Experiments with Existing Detection Methods
**(2) Comparison experiment for family recall**  
We compared the recall rate of each DGA family of our method with that of the Koh method, ATT-CNN-BiLSTM method, and the LSTM.MI method. For each method, we used the final model trained on the full dataset and calculated the recall rate of each DGA family in the full dataset to show the detection ability of different methods for each DGA family. The recall rate of each method for each family is shown in Table 4. In Table 4, the first 11 families, are dictionary-based DGA families, and the rest are character-based DGA families. \begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Family**} & \multicolumn{4}{c}{**Recall**} \\ \cline{2-5}  & **Ours** & **Koh** &
\begin{tabular}{c} **ATT-CNN-** \\ **BiLSTM** \\ \end{tabular} & **LSTM.MI** \\ \hline Gozi\_gpl & 94.55\% & 91.50\% & 87.70\% & 86.30\% \\ \hline Gozi\_luther & 93.00\% & 82.70\% & 88.40\% & 85.35\% \\ \hline Gozi\_nasa & 94.00\% & 87.60\% & 89.35\% & 87.30\% \\ \hline [PERSON]\_rfc4343 & 94.90\% & 88.55\% & 88.50\% & 85.80\% \\ \hline [PERSON] & 88.75\% & 81.15\% & 84.95\% & 79.80\% \\ \hline Nymaim & 67.20\% & 52.60\% & 58.30\% & 54.85\% \\ \hline [PERSON] & 98.54\% & 97.28\% & 97.91\% & 95.40\% \\ \hline Rovnix & 97.90\% & 97.70\% & 95.30\% & 92.70\% \\ \hline Suppbox\_1 & 98.54\% & 98.06\% & 97.38\% & 95.45\% \\ \hline Suppbox\_2 & 97.35\% & 95.35\% & 94.40\% & 94.85\% \\ \hline Suppbox\_3 & 99.90\% & 97.65\% & 99.50\% & 99.50\% \\ \hline Alureon & 98.20\% & 97.95\% & 97.65\% & 96.65\% \\ \hline Banjori & 100.00\% & 100.00\% & 100.00\% & 100.00\% \\ \hline Bedep & 99.55\% & 99.40\% & 99.45\% & 99.35\% \\ \hline Ccleaner & 100.00\% & 99.80\% & 99.90\% & 100.00\% \\ \hline Chinad & 100.00\% & 99.85\% & 100.00\% & 99.90\% \\ \hline Corebot & 100.00\% & 100.00\% & 100.00\% & 99.95\% \\ \hline Cryptolocker & 99.30\% & 98.70\% & 98.75\% & 98.80\% \\ \hline Dircrypt & 98.55\% & 98.20\% & 98.25\% & 98.20\% \\ \hline Dyre & 100.00\% & 100.00\% & 100.00\% & 100.00\% \\ \hline Fobber\_v1 & 99.85\% & 99.90\% & 99.75\% & 99.75\% \\ \hline Fobber\_v2 & 97.90\% & 97.15\% & 97.50\% & 96.85\% \\ \hline Kraken\_v1 & 99.95\% & 99.65\% & 99.85\% & 99.80\% \\ \hline Kraken\_v2 & 98.60\% & 97.60\% & 97.95\% & 97.20\% \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Comparison of recall of different families. From the comparison results, among the 50 families, our method achieved the highest recall rates in 44 families; the recall rates of some families were slightly lower than other methods, but the gap was relatively small. In addition, our method achieved relatively high recall rates for most families, but the recall rates of some families were slightly lower, such as the recall rates of two families of dictionary-based AGDs, Nymaim and Matsnu, which were only 67.20% and 88.75%, respectively, but were still higher than the three comparison methods. Overall, the recall rates of character-based AGDs were higher than those of dictionary-based AGDs. In addition, the average recall rate of 11 character-based DGA families was only 93.15%, demonstrating that after the character-based AGDs were added to the dataset, the recall rates of dictionary-based AGDs decreased slightly. **(3) Comparison experiment for generalization recall**  
In this experiment, we compared the detection performance of our final model and the 3 comparison methods on other datasets to measure the detection performance in real-world detection. We used the three generalization testing datasets constructed from