Comparative Analysis of the Time Stability of CNN, LSTM and DistilBERT in the Domain Generation Algorithms (DGAs) Detection Problem

Скорочена інформація про документ
dc.contributor.authorSalyk, Vasyl
dc.contributor.authorVenherskyi, Petro
dc.date.accessioned2025-10-21T09:14:42Z
dc.date.available2025-10-21T09:14:42Z
dc.date.issued2025
dc.description.abstractThis paper investigates the effectiveness of deep learning models (in particular, CNN, LSTM, and DistilBERT) in detecting algorithm-generated domains (DGAs), taking into account the time dynamics of the development of such domains. The models were trained on samples of DGA domains relevant up to and including 2018 and a proportional set of unique benign domains (1:1) and were tested on five annual datasets for the period 2019–2023, which contained annual slices of DGA domains and the corresponding samples of benign domains. The work quantifies the temporal stability of these models and their ability to effectively detect new threats in the context of concept drift. The analysis of the results shows different dynamics of performance indicators for the architectures studied, revealing their strengths and weaknesses in terms of long-term performance and resilience to the evolution of DGA. The findings highlight the critical need to develop strategies to regularly monitor, update, or adapt DGA detection models to ensure a consistently high level of protection in the face of continuous improvement of malicious domain generation techniques. Notably, the findings related to DistilBERT are based on a model trained with a significantly smaller dataset than CNN and LSTM, which limits the validity of direct performance comparisons. This constraint introduces a potential bias in the results and highlights the need for caution when interpreting DistilBERT’s relative performance. A more comprehensive evaluation is underway using an equivalent dataset.
dc.format.pagerangeС. 28-38
dc.identifier.citationSalyk, V. Comparative Analysis of the Time Stability of CNN, LSTM and DistilBERT in the Domain Generation Algorithms (DGAs) Detection Problem / Salyk Vasyl, Venherskyi Petro // Theoretical and Applied Cybersecurity : Матеріали ІІІ Всеукраїнської науково-практичної конференції (TACS-2025), [Київ], 29 травня 2025 р. / НН ФТІ, КПІ ім. Ігоря Сікорського. - Київ, 2025. - С. 28-38.
dc.identifier.urihttps://ela.kpi.ua/handle/123456789/76950
dc.language.isoen
dc.publisherНН ФТІ, КПІ ім. Ігоря Сікорського
dc.publisher.placeКиїв
dc.relation.ispartofTheoretical and Applied Cybersecurity : Матеріали ІІІ Всеукраїнської науково-практичної конференції (TACS-2025, 29 травня 2025 р., м. Київ, Україна)
dc.subjectCybersecurity
dc.subjectDGA detection
dc.subjectdeep learning (DL)
dc.subjectConvolutional Neural Networks (CNN)
dc.subjectLong ShortTerm Memory (LSTM)
dc.subjectDistilBERT
dc.subjectcomparative analysis
dc.subjecttemporal analysis
dc.titleComparative Analysis of the Time Stability of CNN, LSTM and DistilBERT in the Domain Generation Algorithms (DGAs) Detection Problem
dc.typeArticle

Файли

Контейнер файлів
Зараз показуємо 1 - 1 з 1
Ескіз
Назва:
P.28-38.pdf
Розмір:
354.7 KB
Формат:
Adobe Portable Document Format
Завантажити
Ліцензійна угода
Зараз показуємо 1 - 1 з 1
Ескіз недоступний
Назва:
license.txt
Розмір:
8.98 KB
Формат:
Item-specific license agreed upon to submission
Опис:
Завантажити

Зібрання

Theoretical and Applied Cybersecurity (3 ; 2025 ; Київ)