# N-Trans: Parallel Detection Algorithm for DGA Domain Names
## 4 Experiment and Analysis
### Experimental Results and Analysis
#### 4.3.5 Ablation Experiments  
In order to further verify the impact of each part of the detection model on the experiments, the single N-gram and Transformer malicious domain name detection models proposed in this paper are first subjected to ablation experiments. Firstly, we use bigram and Transformer experiments, and to verify the effectiveness of word-hashing, we use the word-hashing processed dataset for malicious domain name detection. After that, we compare the models before and after feature gain by adding L1 regularization to verify the effect of feature gain on the model; the experimental results are shown in Table 6.  
When the L1 regularization was removed, the features processed by the parallel detection model increased significantly; the number of features obtained without adding the first and last flag bits was 160,106, and the number of features obtained after adding the first and last flag bits was 181,018, which means the experiment could not be carried out smoothly. Therefore, only the effect of adding the flag bits on the parallel detection model is verified. The ablation experiments were performed with or without adding the flag bits; the results are shown in Table 7.  
Tables 6 and 7 show that adding flag bits can increase the first and last position information in the domain names string, resulting in a small increase in the accuracy and _recall_ of the model detection. After adding L1 regularization, the time for model training was significantly reduced; at the same time, the detection effect of the model was optimized, and the accuracy and _recall_ of detection were further improved. The results  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Model**} & **Number of Characteristics** & **Training Time/s** & _Acc_ & _Recall_ \\ \hline bigram + Transformer & 1417 & 327.46 & 0.9370 & 0.9370 \\ Add flag bit + bigram + Transformer & 1486 & 353.37 & 0.9424 & 0.9484 \\
**Add flag bit + bigram + L1** & **441** & **67.16** & **0.9604** & **0.9599** \\
**Regularization + Transformer** & & & & \\ \hline \hline \end{tabular}
\end{table}
Table 6: Experimental analysis of single detection model.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline \multirow{2}{*}{**Model**} & **Number of Characteristics** & **Training Time/s** & _Acc_ & _Recall_ \\ \hline L1 Regularization + Parallel Detection & 547 & 73.9109 & 0.9413 & 0.9435 \\
**Add flag bit + L1 Regularization +** & **575** & **77.4251** & **0.9697** & **0.9707** \\ \hline \hline \end{tabular}
\end{table}
Table 7: Experimental analysis of parallel detection model.  
show that adding the first and last marker bits can enrich the features learned by the model; L1 regularization makes the experiment feasible, reduces the training time and memory consumption, and the features after L1 regularization gain can detect malicious domain names more accurately.  
In summary, the parallel detection model based on the N-gram and Transformer framework proposed in this paper can effectively and accurately detect malicious domain names.