提出抗漂移的Transformer模型，提升DGA检测长期有效性。
DRIFT: Drift-Resilient Invariant-Feature Transformer for DGA Detection
- 混合字符与子词分词，学习不变特征表示
- 多任务自监督预训练，增强模型鲁棒性
- 在9年数据上验证长期有效性，适合持续防御场景
域名生成算法（DGAs）持续演进以逃避检测，对网络安全构成持久挑战。尽管基于深度学习的检测器在静态条件下表现优异，但在面对时间漂移时性能急剧下降。通过2017-2025年长达九年的纵向研究，我们实证发现当前主流的字符级和词级DGA分类器在新变种出现后迅速失效。为此，我们提出一种抗漂移的Transformer框架，通过混合分词策略和多任务自监督预训练学习不变特征表示。模型结合字符级编码捕捉随机形态模式，以及子词级编码处理词基型DGA。三种预训练任务使模型在微调前即可学习到稳健的结构与上下文特征。全面评估表明，该方法显著缓解时间漂移带来的性能退化，在前向链式实验中持续优于现有最佳基线。本方法为动态威胁环境中长期抵御DGA提供了可靠基础。代码已公开：https://github.com/snsec-net/2026-DSN-DRIFT。
原文摘要 · Abstract (English)
Domain Generation Algorithms (DGAs) evolve continuously to evade botnet detection, posing a persistent challenge for dependable network defense. While deep learning-based detectors achieve strong performance under static conditions, they suffer severe degradation when facing temporal drift. Through a 9-year longitudinal study (2017-2025), we empirically show that state-of-the-art character- and word-based DGA classifiers rapidly lose effectiveness as new DGA variants emerge. To address this problem, we propose a drift-resilient Transformer-based framework that learns invariant representations through a hybrid tokenization strategy and multi-task self-supervised pre-training. The model integrates (i) character-level encoding to capture stochastic morphological patterns and (ii) subword-level encoding for word-based DGAs. Three pre-training tasks enable the model to learn robust structural and contextual features prior to supervised fine-tuning. Comprehensive evaluations demonstrate that our method significantly mitigates temporal degradation and consistently outperforms state-of-the-art baselines in forward-chaining experiments. The proposed approach offers a dependable foundation for long-term DGA defense in evolving threat landscapes. Our code is available at: https://github.com/snsec-net/2026-DSN-DRIFT.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。