# DGA Domain Name Classification Method Based on Long Short-Term Memory with Attention Mechanism
## 3 Theoretical Basis
### Attention Mechanism  
When we analyzed the DGA algorithm, we found that the attacker can control the domain name generated by the DGA; that is, the domain name generated in one cycle cannot be duplicated with the registered domain name of other person, but can hit the attacker to register the domain name, usually adding some restrictions. For example, the Banjori domain name only transforms the first four letters, and the part after the domain name is unchanged. Therefore, as long as the latter part is detected, the domain name can basically be regarded as a DGA and does not need to pay attention to the entire domain name. Therefore, this paper introduces the attention mechanism, which, in the classification model, gives different attention to different parts of the input domain name, effectively improving the classification effect of DGA domain names.  
In recent years, attention mechanism has been widely used in various types of deep learning tasks such as machine translation, image recognition, and speech recognition. Compared with simple Convolutional Neural Network (CNN) and Recurrent Neural Network (RNN), better results have been achieved. The use of self-attention in the BERT model [20] greatly enhances the effect of machine translation. When human eyes view pictures, they quickly scan the global image to obtain the target area that needs to be focused on, that is, the focus of attention, and then invest more attention resources in this area to obtain the details of the target while suppressing other useless information. The attention mechanism in deep learning is essentially similar to the human selective visual attention mechanism. The goal is to select information that is more critical to the current mission objectives from a variety of information. There are a number of popular attention mechanisms, such as content-based attention [21], attention based on (global/local) location [22], self-focused [23], etc. This paper refers to the global attention [22] and uses a simpler attention mechanism to reduce computational performance.  
The most important aspect of the global attention mechanism is the calculation of its position weight, assuming \(H=[h_{1},h_{2},\cdots,h_{m}]^{T}\), where \(h_{i}=[h_{i}^{1},h_{i}^{2},\cdots,h_{i}^{n}]\), then \(H\) is a matrix of \(m\times n\):  
\[H=\begin{bmatrix}h_{1}^{1}&\cdots&h_{1}^{n}\\ \vdots&\ddots&\vdots\\ h_{m}^{1}&\cdots&h_{m}^{n}\end{bmatrix} \tag{5}\]  
We need to calculate the position weight for \(h_{i}\); first, transpose \(H\), then \(H^{T}\) is a matrix of \(n\times m\):  
\[H^{T}=\begin{bmatrix}h_{1}^{1}&\cdots&h_{m}^{1}\\ \vdots&\ddots&\vdots\\ h_{1}^{n}&\cdots&h_{m}^{n}\end{bmatrix} \tag{6}\]  
Then, use the softmax function for each line of \(H^{T}\), the result is as follows,\[S^{T}=\begin{bmatrix}\frac{h_{1}^{1}}{\sum_{l=1}^{n}h_{l}^{1}}&\cdots&\frac{h_{m}^{ 1}}{\sum_{l=1}^{n}h_{l}^{1}}\\ \vdots&\ddots&\vdots\\ \frac{h_{m}^{n}}{\sum_{l=1}^{n}h_{l}^{n}}&\cdots&\frac{h_{m}^{n}}{\sum_{l=1}^{n} h_{l}^{n}}\end{bmatrix}=\begin{bmatrix}a_{1}^{1}&\cdots&a_{m}^{1}\\ \vdots&\ddots&\vdots\\ a_{1}^{n}&\cdots&a_{m}^{n}.\end{bmatrix} \tag{7}\]  
Then transpose \(S^{T}\) to get the required weight matrix \(S\) and the attention matrix:  
\[S=\begin{bmatrix}a_{1}^{1}&\cdots&a_{1}^{n}\\ \vdots&\ddots&\vdots\\ a_{m}^{1}&\cdots&a_{m}^{n}.\end{bmatrix} \tag{8}\]  
Finally, \(H\) is multiplied element-wise by \(S\) to achieve the attention mechanism:  
\[H\times S=\begin{bmatrix}h_{1}^{1}a_{1}^{1}&\cdots&h_{1}^{n}a_{1}^{n}\\ \vdots&\ddots&\vdots\\ h_{m}^{1}a_{m}^{1}&\cdots&h_{m}^{n}a_{m}^{n}.\end{bmatrix} \tag{9}\]  
The attention mechanism can be placed before the LSTM layer or behind the LSTM layer. This paper demonstrates that the attention mechanism is better behind the LSTM layer. Therefore, this paper puts the attention mechanism behind the LSTM layer.