Multi-Expert Deep Learning Framework for DNS Attack Detection Using Adaptive Threshold Optimization and Zero-Data-Loss Temporal Modeling

This study proposes a new method to address limitations encountered in detecting DNS-basedattacks, such as data leakage, sample loss, and inadequate representation of attack-specific behavioraldifferences. The approach is based on a pipeline that structurally prevents data leakage through adiscrimination process performed before the sequencing operation. Subsequently, a padding-based fixedlength sequence generation mechanism is used that does not allow any sample to be lost from variablelength traffic flows. One of the key components of the method is the design of a separate expert model foreach attack type. Benign traffic is modeled using an LSTM architecture, malware traffic using a CNN–Transformer combination, spam traffic using a Transformer-based model, and phishing traffic using aBiLSTM structure enhanced with an attention mechanism. Class imbalance is addressed using SMOTEapplied after converting the sequences into vector form. Each expert is trained using binary decisionlogic. In the final stage, the confidence scores produced by the expert models are fused to obtain a singlestage benign–attack decision. Evaluations show that the method achieves 96.24% overall accuracy,86.24% recall, 44.14% precision, and 0.9691 AUROC. In a specific analysis of attack types, F1 scores of0.954 for malware, 0.905 for spam, and 0.770 for phishing were obtained. The benign class demonstratedhigh performance with an F1 value of 0.993 in the validation phase. Additionally, the Brier score wasmeasured at 0.0212, with FPR at 3.44 and FNR at 13.76. These findings support that the attack-typespecific specialization and confidence fusion approach provides more stable, more discriminative, andmore generalizable detection performance in DNS traffic.