# Illegal Domain Name Generation Algorithm Based on Character Similarity of Domain Name Structure
## 3 Algorithm Design and Process
### Illegal Domain Name Clustering  
Illegal domain names of the same type have similarities in structure. To divide illegal domain names belonging to different name types, the Mini-Batch K-means algorithm [13] is a practical choice for clustering illegal domain names. Mini-Batch K-means is a derivative algorithm of K-means, which usually appears in large-scale data of more than 10,000 [14]. Extracting the features of illegal domain names is an essential step before clustering. This experiment uses different methods to extract top-level and second-level domain name features. * Second-level Domain Name Characterization  
For the second-level domain, string \(s\) obtains all substrings with a length of \(n\), and counts the frequency of the substrings. After removing substrings with low frequency, the remaining substrings construct into a substring list \(S\). Initialize a zero vector \(\overrightarrow{Z}\) of the length of the substring list, and set the \(i^{th}\) component \(Z_{i}\) in the vector \(\overrightarrow{Z}\). \(Z_{i}\) is the number of occurrences of the \(i^{th}\) substring (\(i^{th}\) substring \(\in\) S) in the string \(s\). The vector \(\overrightarrow{Z}\) is the n-gram feature of the string \(s\). After many tests, the 3-g feature can cause the best clustering effect. * Top-level Domain Name Characterization  
Extract all top-level domain names to form a top-level domain list T after deduplication. For the top-level domain name \(t\), its feature vector \(\overrightarrow{Z}\) \(\left(length[\overrightarrow{Z}]=length[T]\right)\) is initialized as a zero vector. Set \(Z_{i}\) to 1 and the other components to 0. (\(t=T[i]\)) \(\overrightarrow{Z}\) is the feature vector of \(t\) which is encoded by one-hot. The clustering purpose of the Mini-Batch K-means algorithm is to find the set \(C\) of cluster centers by minimizing the objective function. Its calculation formula is shown in Formula (1):  
\[I=\sum_{x\in T}\|f(C,x)-x\|^{2} \tag{1}\]  
In the formula, means to return the cluster center \(c\in C\) closest to the feature vector of the illegal domain name. Euclidean distance is used as the distance calculation formula between domain name feature vectors. \[d_{ij}=\sqrt{\sum_{t=1}^{m}\left(x_{i}^{l}-x_{j}^{l}\right)^{2}} \tag{2}\]  
In the formula, \(d_{ij}\) represents the Euclidean distance between the \(i^{th}\) domain name feature vector and the \(j^{th}\) domain name feature vector. The optimal K value can be selected by reference to the sum of the squares of the distance between the sample and the nearest cluster center. In this chapter, the elbow method is used to select the optimal number of clusters K. The core idea is that as the number of clusters K increases when K is smaller than the real number of clusters, the increase in K will greatly increase. Increase the degree of aggregation of each cluster, so the sum of the squares I of the distance between the sample and the nearest cluster center will decrease greatly, and the K value I will continue to increase, and the K value will be the best when I is the smallest. \[I=\sum_{i=1}^{n}\underset{\mu_{j}\in\mathbb{C}}{min}\left(\|x_{i}-\mu_{j}\|^{ 2}\right) \tag{3}\]  
In the formula, \(I\) is the sum of the squares of the distance between the sample and the nearest cluster center, \(n\) is the total number of samples, \(x_{i}\) is the feature vector of the \(i\) sample, and \(\mu_{j}\) is the cluster center of cluster \(C\). The basic steps of the Mini-Batch K-means algorithm are as follows:  
1. Randomly extract a fixed-size collection of illegal domain names from the data set \(T\) to form a small batch and cluster the small batches through the K-means algorithm to construct initial K clusters;
2. Continue randomly extracting a fixed-size set of illegal domain names from the data set \(T\) to form a small batch;
3.