## 3 Results and Discussion
### Class Incremental Learning Method  
Once Model 1 proved to be robust, with metrics in line with the state-of-the-art, even surpassing metrics from published models, it began to verify the effectiveness of the proposed technique for class increment through transfer learning presented in Section 2.3. In this experiment, it was separated by a DGA family so that it could be used as an incremental class; that is, it would be included in the scope of classes known by the model already trained to classify the other classes. For this, it selected three DGA families, with different amounts of samples present in the dataset, namely Metastealer with 80,000 examples, Suppobox with 10,350 examples, and Darkshell with 1049 examples in the dataset. Three incremental training tests were carried out to increase the class using the proposed technique, and in each of the tests, a family was used as the incremental class. For each of the tests, the averages of the general metrics were calculated at each of the training moments. In the initial stage, the metrics refer to the classifier trained to classify among 60 families. The first stage of incremental training consists of defining all layers of the model as not-trainable except the last one, editing the last layer by adding one more neuron so that the model can classify between 61 classes. Then, the classifier model was retrained with 500 examples of each of the known families that were correctly classified by the classifier in their previous state, along with 70% of the examples of the new family. In the second stage of incremental training, the model has its layers defined as trainable again and training occurs with a learning rate of \(1\times 10^{-5}\), 10 times lower than the training rate used in the initial training, to perform fine adjustments to the weights of the model for the classification of the 61 classes. To verify the effectiveness of incremental training and assess whether there was indeed a transfer of learning in incremental training, it was trained an identical model, from scratch, only with the reduced set of examples used in the two stages of incremental training. The average precision, recall, and F1 score among all families classified by the model in the initial stage, in each of the incremental training stages, and in the control training for each of the families used as an incremental class are presented in Tables 5-7. Table 5 presents the general averages of precision, recall, and F1 score obtained when using the Metastealer class as an incremental class, for each of the incremental training steps of Model 1. The metrics extracted by each family are presented in Appendix A, Table A8 presents the metrics obtained by Model 1 for the initial training without the [PERSON] family, Table A9 presents the results obtained by Model 1 after the first stage of incremental training, with examples of the new Metastealer class. Table A10 presents the results after  
Figure 3: Graphical comparison of the metrics obtained by the tested models. the second training stage, and Table 11 shows the results of Model 1 trained exclusively on the reduced dataset. Table 6 presents the general averages of precision, recall, and F1 score obtained when using the Suppobox class as an incremental class, for each of the incremental training steps of Model 1. The metrics extracted by each family are presented in Appendix A, Table 12 presents the metrics obtained by Model 1 for the initial training without the [PERSON] family, Table 13 presents the results obtained by Model 1 after the first stage of incremental training, with examples of the new Metastealer class, Table 14 presents the results after the second training stage, and Table 15 shows the results of Model 1 trained exclusively on the reduced dataset. Table 7 presents the general averages of precision, recall, and F1 score obtained when using the Darkshell class as an incremental class, for each of the incremental training steps of Model 1.