## 2 Related Work
### Domain Name-Based Methods for Dictionary-Based AGDs  
Currently, domain name-based methods for detecting dictionary-based AGDs are mainly divided into the following categories: (1) graph methods for discovering AGD words, (2) methods based on meaningful word segmentation, (3) methods based on n-gram sequences, (4) methods based on local feature extraction using CNN models, and (5) methods that introduce external information. Dictionary-based DGAs tend to use different words from benign domain names, and dictionary-based AGDs can be found by constructing word relationship graphs [9; 17; 18; 19]. [PERSON] et al. [17] first obtained words from the domain names and constructed a graph, named WordGraph, based on the co-occurrence relationship of words in the same domain name. In WordGraph, words in AGDs are usually used repeatedly, resulting in more degrees than words in benign domain names. Therefore, the authors used the connected components in WordGraph as units to extract the structural features, including degrees, to determine their categories. When testing, a domain name was classified according to whether it is an AGD by the word categories in the domain name. [PERSON] et al. [18] also constructed a word graph based on the co-occurrence relationship of words and used the Infomap algorithm to perform community detection on the constructed word graph. Then, they used communities as units and classified them with the decision tree method. When testing, if all the words of a domain name belong to a word community, the domain name was classified as a dictionary-based AGD of this community. This type of method can adapt better to the detection of new AGDs, but like traffic-based DGA attack detection methods, these methods require many samples to build the graph, which makes it hard to detect a single AGD. This type of method is usually used for the detection of only dictionary-based AGDs and typically does not apply to character-based AGDs. Since the components of dictionary-based AGDs are English words, some studies obtained the word sequences of a domain name based on meaningful word segmentation [10; 20; 21; 22; 23; 24]. [PERSON] et al. [20] used Wordinja [46] to perform meaningful word segmentation on domain names without TLD and calculated the context-sensitive word embedding features of each word through the ELMo [39] model. After calculating the mean pooling of the word features, the final features of the domain names are obtained and classified although fully-connected networks. Overall, the performance of methods based on meaningful word segmentation for character-based AGDs has been relatively poor. Some methods further split words on the basis of word segmentation, which is compatible with the detection of character-based AGDs. [PERSON] et al. [21] used WordSegment [47] methods [47] for meaningful word segmentation and constructed a word frequency dictionary. A word was further split into characters if the word was not in the frequency dictionary. After calculating the word embedding features of each word, a CNN model was used for classification. Methods based on meaningful word segmentation are intended to restore the smallest components of AGDs as much as possible; the detection performance is more affected by the word segmentation method, and the word sequences obtained are usually short, so it is difficult to extract the sequence features from them. In addition, the n-gram algorithm is often applied to the detection of dictionary-based AGDs. The n-gram algorithm usually takes every \(n\) characters of the domain name as a window, extracts an n-gram sequence by the sliding window method, and performsclassification by sequence detection methods [10; 26; 27; 28; 29; 30; 31; 32]. [PERSON] et al. [26] first removed the TLD from the domain name and split it by the n-gram algorithm, in which \(n\) was set to 2 and 3. Then, each n-gram was encoded with one-hot encoding to form a feature matrix, and the CNN model was used for classification. [PERSON] et al.