A DGA domain names detection modeling method based on integrating an attention mechanism and deep neural network

Cybersecurity

Table 3 Comparison of precision and recall for classification task on the Models

Domain Type	SVM		CNN		LSTM		CNN-BiLSTM		ATT-CNN-BiLSTM		Support
	P	R	P	R	P	R	P	R	P	R
benign	0.93	0.99	0.95	0.99	0.95	0.98	0.94	0.99	0.99	0.98	199999
banjori	0.95	0.97	0.99	0.98	0.99	1	1	0.99	1	1	5012
Cryptolocker	0	0	0.11	0.12	0.25	0.24	0.22	0.02	0.28	0.28	1200
dyre	0.92	0.98	0.99	0.99	0.99	1	0.99	0.98	0.99	1	167
emotet	0.66	0.81	0.67	0.98	0.67	1	0.66	1	0.65	0.84	3985
gameover	0.32	0.13	0.86	0.10	0.9	0	0.53	0.01	0.39	0.33	3323
locky	0.27	0.05	0.56	0.05	0.67	0	0.14	0	0.46	0.28	1610
matsnu	0.28	0.29	0.66	0.67	0.67	0.85	0.76	0.78	0.77	0.86	4133
murofet	0.96	0.99	0.96	0.99	0.94	1	0.97	0.99	0.98	1	5304
Post	0.61	0.72	0.79	0.73	0.76	0.75	0.68	0.87	0.85	0.76	4373
necurs	0.25	0.24	0.54	0.22	0.52	0.34	0.57	0.19	0.61	0.68	4400
pykspa_v1	0.91	0.88	0.9	0.98	0.92	0.96	0.98	0.93	0.98	0.98	4662
qakbot	0.63	0.43	0.74	0.61	0.71	0.64	0.62	0.73	0.76	0.67	5217
ramnit	0.39	0.49	0.68	0.71	0.61	0.71	0.63	0.72	0.62	0.74	4900
rovnix	0.85	0.91	0.99	1	1	0.99	1	0.99	1	0.99	5160
suppobox	0.75	0.32	0.85	0.23	0.86	0.22	0.99	0.07	0.86	0.94	2011
tinba	0.58	0.81	0.69	0.89	0.68	0.96	0.74	0.98	0.92	0.98	3955
urlzone	0.85	0.76	0.96	0.95	0.96	0.91	0.98	0.91	0.97	0.94	369
volatile	0.97	1	0.98	0.71	0.97	0.69	1	0.38	0.99	0.99	185
beebone	0.95	0.97	0.99	0.98	0.99	1	1	0.99	1	1	42
geodo	0.85	0.76	0.96	0.95	0.96	0.91	0.98	0.91	0.98	0.93	220
padcrypt	0.64	0.42	0.74	0.61	0.71	0.64	0.62	0.73	0.76	0.66	304
pizd	0.80	0.79	0.80	0.82	0.89	0.89	0.99	0.98	0.96	0.96	202
ramdo	0.79	0.82	0.86	0.89	0.88	0.89	0.89	0.88	0.92	0.96	400
shifu	0.81	0.82	0.84	0.85	0.89	0.89	0.90	0.88	0.94	0.95	510
micro avg	0.78	0.79	0.83	0.83	0.84	0.84	0.86	0.86	0.89	0.89	261643
macro avg	0.64	0.64	0.65	0.64	0.69	0.65	0.72	0.72	0.83	0.83	261643