vix.ing · top · new · best · stats · spec

DRIFT: Drift-Resilient Invariant-Feature Transformer for DGA Detection

2026/05/31 by Chaeyoung Lee, Chaeri Jung, Seonghoon Jeong
Computer Science · Engineering · #Advanced Neural Network Applications #Ferroelectric and Negative Capacitance Devices #Wireless Signal Modulation Classification #acm:68M25 #acm:68T07 #cs.CR #cs.LG #cs.NI #msc:68M25 #msc:68T07

paper · pdf · doi:10.1109/dsn69566.2026.00077

published as Proc. 56th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN 2026), Charlotte, NC, USA, pp. 786-799 · 14 pages, 7 figures, 8 tables. Published in Proc. 56th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN 2026)

openalex publication_date 2026/06/22 · openalex created_date 2026/07/09 · openalex updated_date 2026/07/29 · arxiv created 2026/08/02 · arxiv updated 2026/08/04

Abstract

Domain Generation Algorithms (DGAs) evolve continuously to evade botnet detection, posing a persistent challenge for dependable network defense. While deep learning-based detectors achieve strong performance under static conditions, they suffer severe degradation when facing temporal drift. Through a 9-year longitudinal study (2017-2025), we empirically show that state-of-the-art character- and word-based DGA classifiers rapidly lose effectiveness as new DGA variants emerge. To address this problem, we propose a drift-resilient Transformer-based framework that learns invariant representations through a hybrid tokenization strategy and multi-task self-supervised pre-training. The model integrates (i) character-level encoding to capture stochastic morphological patterns and (ii) subword-level encoding for word-based DGAs. Three pre-training tasks enable the model to learn robust structural and contextual features prior to supervised fine-tuning. Comprehensive evaluations demonstrate that our method significantly mitigates temporal degradation and consistently outperforms state-of-the-art baselines in forward-chaining experiments. The proposed approach offers a dependable foundation for long-term DGA defense in evolving threat landscapes. Our code is available at: https://github.com/snsec-net/2026-DSN-DRIFT.

Citations