aiqbench analysis
This research addresses the critical challenge of temporal drift in deep learning-based Domain Generation Algorithm (DGA) detectors, which often fail as botnet variants evolve. By proposing a Transformer framework that learns invariant representations through hybrid tokenization and multi-task pre-training, the study significantly improves long-term detection resilience across nine years of data. This work offers practical value for cybersecurity practitioners seeking robust defenses against evolving network threats using advanced machine learning architectures.
DRIFT: Drift-Resilient Invariant-Feature Transformer for DGA Detection
arXiv:2605.10436v2 Announce Type: replace-cross Abstract: Domain Generation Algorithms (DGAs) evolve continuously to evade botnet detection, posing a persistent challenge for dependable network defense. While deep learning-based detectors achieve strong performance under static conditions, they suffer severe degradation when facing temporal drift. Through a 9-year longitudinal study (2017-2025), we empirically show that state-of-the-art character- and word-based DGA classifiers rapidly lose effectiveness as new DGA variants emerge. To address this problem, we propose a drift-resilient Transformer-based framework that learns invariant representations through a hybrid tokenization strategy and multi-task self-supervised pre-training. The model integrates (i) character-level encoding to capture stochastic morphological patterns and (ii) subword-level encoding for word-based DGAs. Three pre-training tasks enable the model to learn robust structural and contextual features prior to supervised fine-tuning. Comprehensive evaluations demonstrate that our method significantly mitigates temporal degradation and consistently outperforms state-of-the-art baselines in forward-chaining experiments. The proposed approach offers a dependable foundation for long-term DGA defense in evolving threat landscapes. Our code is available at: https://github.com/snsec-net/2026-DSN-DRIFT.
Abstract:Domain Generation Algorithms (DGAs) evolve continuously to evade botnet detection, posing a persistent challenge for dependable network defense. While deep learning-based detectors achieve strong performance under static conditions, they suffer severe degradation when facing temporal drift. Through a 9-year longitudinal study (2017-2025), we empirically show that state-of-the-art character- and word-based DGA classifiers rapidly lose effectiveness as new DGA variants emerge. To address this problem, we propose a drift-resilient Transformer-based framework that learns invariant representations through a hybrid tokenization strategy and multi-task self-supervised pre-training. The model integrates (i) character-level encoding to capture stochastic morphological patterns and (ii) subword-level encoding for word-based DGAs. Three pre-training tasks enable the model to learn robust structural and contextual features prior to supervised fine-tuning. Comprehensive evaluations demonstrate that our method significantly mitigates temporal degradation and consistently outperforms state-of-the-art baselines in forward-chaining experiments. The proposed approach offers a dependable foundation for long-term DGA defense in evolving threat landscapes. Our code is available at: this https URL.
14 pages, 7 figures, 8 tables. Published in Proc. 56th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN 2026)
Cryptography and Security (cs.CR); Machine Learning (cs.LG); Networking and Internet Architecture (cs.NI)
C.2.0; I.2.6; K.6.5
arXiv:2605.10436 [cs.CR]
(or arXiv:2605.10436v2 [cs.CR] for this version)
https://doi.org/10.48550/arXiv.2605.10436 Focus to learn more arXiv-issued DOI via DataCite
Proc. 56th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN 2026), Charlotte, NC, USA, pp. 786-799
https://doi.org/10.1109/DSN69566.2026.00077 Focus to learn more DOI(s) linking to related resources
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Full text under the publisher's open licence · 312 words
