What does this research mean for the field?

FGM-GAN improves the robustness and interpretability of deep neural networks for DNS threat classification against adversarial attacks. Novelty: ClaimNovelty.NOVEL_FINDING. Consensus alignment: ConsensusAlignment.NEUTRAL.

What question did this study set out to answer?

To develop a hybrid adversarial learning framework, FGM-GAN, that enhances the robustness and interpretability of deep neural networks for DNS threat detection.

February 28, 2026Open Access

Fast-gradient-guided generative adversarial learning for explainable cyber threat intelligence

Key Points

To develop a hybrid adversarial learning framework, FGM-GAN, that enhances the robustness and interpretability of deep neural networks for DNS threat detection.
Introduced FGM-GAN combining gradient-based and GAN-based perturbations
Conducted experiments on the CIC-BELL-DNS-2021 dataset with 7000 labeled samples
Evaluated against various classifiers including DNN, SVM, and Random Forest using accuracy and robustness metrics
Performed ablation studies to confirm the effectiveness of the hybrid mechanism
Integrated multi-level explainable AI analyses for enhanced transparency.
FGM-GAN consistently improved robustness across diverse adversarial attacks
Demonstrated strong cross-model transferability of adversarial perturbations
Identified a compact set of high-impact DNS features through interpretability analyses
Statistical significance tests confirmed reproducibility of the results.

Abstract

The rapid evolution of Domain Generation Algorithm (DGA)-driven attacks and obfuscated DNS traffic exposes fundamental weaknesses in conventional machine learning-based threat detection systems, particularly under adversarial manipulation. This study introduces FGM-GAN, a hybrid adversarial learning framework that synergistically combines gradient-based Fast Gradient Method (FGM) perturbations with adaptive Generative Adversarial Network (GAN)-based perturbations to improve both robustness and interpretability of deep neural networks for DNS threat classification. Unlike existing adversarial defenses that rely on model-specific perturbations, FGM-GAN explicitly learns class-conditional adversarial distributions for benign, phishing, and malware domains. This design enables the generation of realistic, feature-aligned perturbations that exhibit strong cross-model transferability. Experiments were conducted on the 32-feature CIC-BELL-DNS-2021 dataset (approximately 7000 labeled samples) using 5-fold cross-validation, hybrid perturbations with and , and evaluated against baseline DNN, SVM, Random Forest, KNN, and Decision Tree classifiers using accuracy and robustness metrics. Comprehensive evaluation demonstrates that FGM-GAN consistently improves robustness across diverse adversarial attacks (FGM, PGD, MIM, C&W) while maintaining stable performance across folds. Ablation studies and reduced-capacity variants confirm that gains arise from the hybrid adversarial mechanism rather than over-parameterization or hyperparameter tuning, and statistical significance tests verify the reproducibility of results. To enhance transparency and operational trust, the framework integrates multi-level explainable AI analyses spanning feature, neuron, and layer representations. These analyses consistently identify a compact set of high-impact DNS features and reveal structured adversarial propagation patterns, showing that robustness emerges from semantically meaningful representation learning. Collectively, these findings position FGM-GAN as a scalable and interpretable adversarial learning solution that jointly addresses robustness, transferability, and explainability in real-world DNS-based cybersecurity environments. • FGM-GAN hybrid improves neural network robustness against adversarial attacks • GANs produce realistic, class-specific adversarial perturbations for DNS data • Adversarial transferability validated across KNN, SVM, Decision Trees, RF • Gradient-XAI interprets feature, neuron, and layer-level model vulnerabilities • Combines robustness and explainability for actionable cyber threat intelligence

Read Full Paperexternally

Bookmark

View Full Paper

Cite This Study

Henna et al. (Sun,) studied this question.

synapsesocial.com/papers/69a285aa0a974eb0d3c009f7 https://doi.org/https://doi.org/10.1016/j.asoc.2026.114911

Bookmark

View Full Paper