An Imbalanced Malicious Domains Detection Method Based on Passive DNS Traffic Analysis

Algorithm 1

The HAC_EasyEnsemble algorithm.

(1) : A set of minority class examples , a set of majority class examples ,

, the number of subsets to sample from

(2) are clustered into several small groups . by HAC

(3)

(4)   repeat

(5)

(6)   Select randomly instances from each cluster () with a total of K

(7)   Select randomly -K instances from -

(8)   Combine the dataset sampled from step (6) and (7) to form a subset , where

(9)   Learn using and , is a base classifier employed Decision Tree

(10) until

(11) Output: An ensemble