# N-Trans: Parallel Detection Algorithm for DGA Domain Names
## 4 Experiment and Analysis
### Data Analysis  
Ten thousand legitimate and ten thousand malicious domain names were randomly selected as the dataset for the experiment. For each domain name, because the characteristics of legitimate and malicious domain names at the first level are not obvious, the first-level domain was discarded and constituted the dataset \(D\). The training set and test set in the experiment were partitioned using the _sklearn_ module at 40% for the test set. After mixing the malicious domain names from 360 Network Security Lab, 10,000 data were randomly selected, and each family had no more than 1400 malicious domains. The selected families of malicious domain names and the number of them are shown in Table 2. Refer to Vranken [20] for a detailed description of the dataset, and refer to the DGALab study to classify the types of DGA. The column 'DGA type' indicates whether the DGA is Static DGA (Static), Seed-based (Seed), or Date-based (Date) [21]. The column 'Number' indicates the count of domain names; the column 'Length' indicates the length (min, max) of the second-level domain names. The last two columns show examples of second-level domain names. \begin{table}
\begin{tabular}{c c} \hline \hline
**Environment Configuration** & **Parameters** \\ \hline Operating System & Ubuntu 16.04.12 \\ Memory/GB & 128 GB \\ CPU & 2.2 GHz Inter (R) \\ Python & 3.8.10 \\ Tensorflow & 2.5.0 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Experimental environment configuration. For dataset \(D\), there were 1417 phrase elements after bigram processing, 31,220 phrase elements after trigram processing, 127,469 phrase elements after 4-g processing, and 138,636 phrase elements after 5-g processing. The N-gram algorithm was used for the legitimate and malicious domain names in \(D\). The distribution of the phrase elements of the domain names was obtained as shown in Figure 5a,b. From the N-gram distribution (\(N\) = 2 or 3) results of legitimate and malicious domain names, there was a great difference in the frequency of phrase elements of malicious and legitimate domain names. The distribution of phrase elements of malicious domain names was more uniform, while the distribution of phrase elements of legitimate domain names varied greatly, so the phrase elements generated after bigram segmentation had better domain name classification characteristics. When \(N\) = 4 or 5, legitimate domain names still had a good frequency distribution of phrase elements. Malicious domain names have an increased variety of phrase elements, become more random, and correspond to fewer phrase elements. The numerical characteristics of the phrase elements after N-gram algorithm processing are analyzed. The data analysis uses mean, variance, skewness, and kurtosis as indicators of numerical characteristics to analyze the results of N-gram processing for two types of domain names. The results are shown in Table 3. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**DGA Family** & **DGA Type** & **Number** & **Length** & **Sample1** & **Sample2** \\ \hline _simda_ & Static & 921 & 8–14 & digivehusyd & lymylur \\ _virut_ & Static & 869 & 6 & yvvioe & zuzmoq \\ _rovniz_ & Static & 1092 & 18 & rc7 thuhy8 agn43 zzgi & lryja5 lrm835m7 byr8 \\ _suppobox_ & Seed & 1282 & 9–18 & sharmainewestbrook & arivenice \\ _tinhu_ & Seed & 1400 & 12 & nvfowikhevmy & oykjjetwrmlw \\ _banjori_ & Seed & 1400 & 15–26 & earnesthesiobipbysicalohax & iutecerwerqahm \\ _gameover_ & Date & 791 & 20–28 & 14 duuoriaubbmjhgup7915 tinc & 2 id0 lappmam6w1799w7315 zaqj5 \\ _nymaim_ & Date & 1400 & 5–12 & zzayzoabsi & msfctioj \\ _necurs_ & Date & 845 & 7–21 & wiyqgyiwgm & otenbmgbpuskiasvehxm \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Characteristics of DGA families. Figure 5: Distribution of legitimate and malicious domain phrase element frequencies. After using N-gram processing, the phrase elements were sorted from highest to lowest frequency.