DNS-GT: A Graph-based Transformer Approach to Learn Embeddings of Domain Names from DNS Queries

• URL: http://arxiv.org/abs/2603.11200v1
• Date: Wed, 11 Mar 2026 18:14:07 GMT
• Title: DNS-GT: A Graph-based Transformer Approach to Learn Embeddings of Domain Names from DNS Queries
• Abstract summary: DNS-GT is a novel Transformer-based model that learns embeddings for domain names from sequences of DNS queries.<n>Our experiments with real-world DNS data showcase the ability of our method to learn effective domain name representations.
• Score: 6.172641282378335
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Network intrusion detection systems play a crucial role in the security strategy employed by organisations to detect and prevent cyberattacks. Such systems usually combine pattern detection signatures with anomaly detection techniques powered by machine learning methods. However, the commonly proposed machine learning methods present drawbacks such as over-reliance on labeled data and limited generalization capabilities. To address these issues, embedding-based methods have been introduced to learn representations from network data, such as DNS traffic, mainly due to its large availability, that generalise effectively to many downstream tasks. However, current approaches do not properly consider contextual information among DNS queries. In this paper, we tackle this issue by proposing DNS-GT, a novel Transformer-based model that learns embeddings for domain names from sequences of DNS queries. The model is first pre-trained in a self-supervised fashion in order to learn the general behavior of DNS activity. Then, it can be finetuned on specific downstream tasks, exploiting interactions with other relevant queries in a given sequence. Our experiments with real-world DNS data showcase the ability of our method to learn effective domain name representations. A quantitative evaluation on domain name classification and botnet detection tasks shows that our approach achieves better results compared to relevant baselines, creating opportunities for further exploration of large-scale language models for intrusion detection systems. Our code is available at: https://github.com/m-altieri/DNS-GT.

Related papers

• Improving the Identification of Real-world Malware's DNS Covert Channels Using Locality Sensitive Hashing [0.0]
  We present the first application of Locality Sensitive Hashing to the detection and identification of real-world malware utilizing DNS covert channels.<n>Our approach encodes DNS subdomain sequences into statistical similarity features that effectively capture anomalies indicative of malicious activity.
  arXiv  Detail & Related papers  (2025-11-25T12:00:58Z)
• DNS Tunneling: Threat Landscape and Improved Detection Solutions [1.6874375111244329]
  We propose a novel approach to detect DNS tunneling with machine learning algorithms.<n>We combine machine learning algorithms to analyze the traffic by using features extracted from DNS traffic.<n>Analyses results show that the proposed approach is a good candidate to detect DNS tunneling accurately.
  arXiv  Detail & Related papers  (2025-07-14T13:37:48Z)
• MTDNS: Moving Target Defense for Resilient DNS Infrastructure [2.8721132391618256]
  DNS (Domain Name System) is one of the most critical components of the Internet. Researchers have been constantly developing methods to detect and defend against the attacks against DNS. Most solutions discard packets for defensive approaches, which can cause legitimate packets to be dropped. We propose MTDNS, a resilient MTD-based approach that employs Moving Target Defense techniques.
  arXiv  Detail & Related papers  (2024-10-03T06:47:16Z)
• Verifying Learning-Based Robotic Navigation Systems [61.01217374879221]
  We show how modern verification engines can be used for effective model selection. Specifically, we use verification to detect and rule out policies that may demonstrate suboptimal behavior. Our work is the first to demonstrate the use of verification backends for recognizing suboptimal DRL policies in real-world robots.
  arXiv  Detail & Related papers  (2022-05-26T17:56:43Z)
• Optimized Random Forest Model for Botnet Detection Based on DNS Queries [8.641714871787595]
  Domain Name System (DNS) protocol has several security vulnerabilities. One promising solution to detect DNS-based botnet attacks is adopting machine learning (ML) based solutions. This paper proposes a novel optimized ML-based framework to detect botnets based on their corresponding DNS queries.
  arXiv  Detail & Related papers  (2020-12-16T16:34:11Z)
• Model-Based Deep Learning [155.063817656602]
  Signal processing, communications, and control have traditionally relied on classical statistical modeling techniques. Deep neural networks (DNNs) use generic architectures which learn to operate from data, and demonstrate excellent performance. We are interested in hybrid techniques that combine principled mathematical models with data-driven systems to benefit from the advantages of both approaches.
  arXiv  Detail & Related papers  (2020-12-15T16:29:49Z)
• CMT in TREC-COVID Round 2: Mitigating the Generalization Gaps from Web to Special Domain Search [89.48123965553098]
  This paper presents a search system to alleviate the special domain adaption problem. The system utilizes the domain-adaptive pretraining and few-shot learning technologies to help neural rankers mitigate the domain discrepancy. Our system performs the best among the non-manual runs in Round 2 of the TREC-COVID task.
  arXiv  Detail & Related papers  (2020-11-03T09:10:48Z)
• A Review of Single-Source Deep Unsupervised Visual Domain Adaptation [81.07994783143533]
  Large-scale labeled training datasets have enabled deep neural networks to excel across a wide range of benchmark vision tasks. In many applications, it is prohibitively expensive and time-consuming to obtain large quantities of labeled data. To cope with limited labeled training data, many have attempted to directly apply models trained on a large-scale labeled source domain to another sparsely labeled or unlabeled target domain.
  arXiv  Detail & Related papers  (2020-09-01T00:06:50Z)
• DNS Tunneling: A Deep Learning based Lexicographical Detection Approach [1.3701366534590496]
  DNS Tunneling is attractive to hackers who exploit it to establish bidirectional communication with machines infected with malware. The present work proposes a detection approach based on a Convolutional Neural Network (CNN) with a minimal architecture complexity. Despite its simple architecture, the resulting CNN model correctly detected more than 92% of total Tunneling domains with a false positive rate close to 0.8%.
  arXiv  Detail & Related papers  (2020-06-11T00:10:13Z)
• Cross-domain Face Presentation Attack Detection via Multi-domain Disentangled Representation Learning [109.42987031347582]
  Face presentation attack detection (PAD) has been an urgent problem to be solved in the face recognition systems. We propose an efficient disentangled representation learning for cross-domain face PAD. Our approach consists of disentangled representation learning (DR-Net) and multi-domain learning (MD-Net)
  arXiv  Detail & Related papers  (2020-04-04T15:45:14Z)
• Automating Botnet Detection with Graph Neural Networks [106.24877728212546]
  Botnets are now a major source for many network attacks, such as DDoS attacks and spam. In this paper, we consider the neural network design challenges of using modern deep learning techniques to learn policies for botnet detection automatically.
  arXiv  Detail & Related papers  (2020-03-13T15:34:33Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.