# Illegal Domain Name Generation Algorithm Based on Character Similarity of Domain Name Structure
## 2 Related Research  
In terms of websites, [PERSON] et al. [2] proposed a method for effectively searching illegal web pages by analyzing the redirection behavior between illegal web pages and applying the heuristic search algorithm to web crawlers. [PERSON] et al. [3] actively discovered and identified pornographic, violent, reactionary, and other harmful websites in the network according to the link relationship between illegal webpages, combined with web crawler technology and content security filtering technology. In terms of DNS, [PERSON] et al. [4] observed DNS data and found that illegal domain names belonging to the same malware family were often resolved by the same host at the same time, and thus proposed an evaluation method based on the co-occurrence relationship of domain names. The degree of co-occurrence of listed domains with unknown domains, discovering new illegal domains that are not on the blacklist. [PERSON] et al. [5] found that botnets tend to have a community structure by analyzing DNS traffic, thus proposed a new botnet discovery method, identifying bot communities composed of hosts with similar malicious behaviors through DNS traffic, and correlating each community traffic to identify malicious servers controlling these hosts. Aiming at the unrobust problem of using local features of DNS data, [PERSON] et al. [6] proposed a complementary method to discover and analyze the global association between domains, establish meaningful associations between domains, and infer whether unknown domains are illegal. In terms of domain name generation, after a lot of research, domain name structure is one of the critical factors affecting the effectiveness and accuracy of domain name generation. Considering the factors of domain name structure, the primary process of illegal domain name generation includes data collection, structure analysis, classification, and generation of several steps. [PERSON] et al. [7] proposed a method to generate DGA variant samples for the illegal domain name data collection and structure analysis process. This method defines the domain name encoder and decoder based on the ASCII encoding method, trains the generative confrontation network to construct the domain name character generator, and thus predicts the DGA variant samples belonging to the same family. Regarding the illegal domain name classification, [PERSON] et al. [8] analyzed illegal domain name data sets, customized illegal domain name similarity rules, and classified illegal domain names using the structural similarity between illegal domain names. In terms of illegal domain name generation, [PERSON] et al. [9] proposed a method to proactively discover illegal domain names. [PERSON] et al. [10] use natural language modeling techniques to build a proactive blacklist and effectively learn illegal domain names in the network. [PERSON] [11] by extracting 56 data features in five categories, including domain name text and lexical grammar, proposed a data optimization method based on the degree of feature anomaly and constructed a variety of differentiated unlabeled real-network DNS traffic data sets. Aiming at the slow detection speed of mainstream illegal domain name detection algorithms, [PERSON] et al. [12] proposed a lightweight domain name detection algorithm based on morpheme features. According to the structural characteristics of illegal domain names, only mining domain name morpheme features can quickly detect illegal domain names. According to relevant research, there are many ways to discover illegal domain names. There are also studies on the discovery and generation of illegal domain names based on domain name structure. In terms of generation efficiency and accuracy, the results are not ideal. Furthermore, the existing illegal domain name generation methods only generate specific types of illegal domain names and cannot be applied to other kinds of illegal domain name generation.