text:
\section{Adversarial samples}

In recent years, the phenomenon of {\it adversarial samples} has surfaced in the
deep learning community~\cite{szegedy2013intriguing, goodfellow2014explaining}.
In essence, a malicious actor could take a sample that was correctly classified
by the model, perturb the input slightly, and the perturbed sample would be
misclassified.  When images are used, these perturbations are often invisible to
the eye.  These adversarial attacks have been successfully applied to fields
outside of images, including audio~\cite{carlini2018audio} and malware
classification~\cite{grosse2017adversarial}.  Though there are some defense
mechanisms that have been developed~\cite{papernot2016distillation,
feinman2017detecting}, many of these are later found to be
circumventable~\cite{carlini2017adversarial}.

Given that adversarial samples are not limited to images, it is reasonable to
believe that neural network-based DGA detectors could also suffer from this
vulnerability.  In our situation a malicious actor would wish to take a domain
that is detected as from a DGA and have it labeled as a non-DGA domain.  It
would be very straightforward to perform an attack like the Fast Gradient Sign
Method~\cite{szegedy2013intriguing} to modify the characters in a domain name.
In fact, it is not (generally) important to DGA authors what the domain name
looks like, so there is no cost to modify the letters of the domain.

Such a technique would likely prove effective against an approach that only
incorporated the domain name itself.  However, note that our model also
incorporates domain registration side information from WHOIS.  Although a
malware author can change the domain name they are using at will and nearly
arbitrarily, it is significantly more difficult to cause the WHOIS registration
information (such as registration date) to have specific values.  To do that, a
malware author might need to register a domain perhaps months in advance and
host a clean website on it, which is both expensive and time-consuming.  Thus,
it would be more difficult for a malware author to work around our proposed
model.

\section{Conclusion}

In this paper we have considered the problem of DGA domain detection.  We
introduced a measure of complexity for DGA families called the {\it smashword
score}, which reflects how closely a DGA's generated domains resemble English
words.  Because DGA families with higher smashword scores have typically posed
greater difficulty for detection, we build a novel machine learning model
consisting of recurrent neural networks (RNNs) using the generalized likelihood
ratio test (GLRT), and augment these models with a logistic regression model
that also includes side information such as WHOIS information.

This combined model notably outperforms existing state-of-the-art approaches on
DGA families with high smashword score, such as the difficult {\tt matsnu} and
{\tt suppobox} families. We believe that this model could be used as either a
standalone model or as a part of a larger DGA detection system that could also
incorporate network traffic, such as something more like the Pleiades system
\cite{antonakakis2012throw}.

There is room for future improvement in our work. The model we have used is
specialized for DGA families based on English words, and therefore can be less
effective for those DGA families that do not look like natural domain names.
Thus, in a production environment or in an improved system, our model could be
ensembled with other techniques that are more effective for DGA families with
lower smashword scores.

In a future work we would also like to explore multilingual approaches to tackle
new families that may use non-English dictionaries and expand our side information features.

\section{DGA Families}
\label{sec:families}

\begin{table*}[t!]
\begin{center}
\begin{tabular}{lccccll}
\toprule
{\bf DGA family} & {\bf $n$} & {\bf $\bar{l}(x)$} & {\bf $\bar{c}(x)$} & {\bf $\bar{s}(x)$} & {\bf sample 1} & {\bf sample 2} \\
\midrule
{\bf banjori}$^3$                      & 435385 & 22.165  & 3.767 & {\bf
173.909} & {\scriptsize {\tt iivnleasuredehydratorysagp[.]com}} & {\scriptsize {\tt yanzvinskycattederifg[.]com}} \\
beebone$^3$       & 210  & 13.223        & 3.466 &  66.159 & {\scriptsize {\tt backdates10[.]com}} & {\scriptsize {\tt dnsfor3[.]net}} \\
chinad$^6$                     & 256  & 19.843        & 3.882 &  19.565 & {\scriptsize {\tt evybt5gtf2tprvbi[.]info}} & {\scriptsize {\tt m5j42r6uiqov2dgm[.]biz}} \\
conficker$^5$     & 100000 & 11.754    & 3.208 &  19.988 & {\scriptsize {\tt jemmmpo[.]ws}} & {\scriptsize {\tt xobxceagb[.]biz}} \\
{\bf gozi}$^3$                       & 1212  & 23.262       & 3.550 & {\bf
222.240} & {\scriptsize {\tt questionibus[.]com}} & {\scriptsize {\tt chrisredemptisviros[.]com}} \\
locky$^5$                     & 8 & 14.125           & 3.226 &  20.800 & {\scriptsize {\tt pccibcjncnhjn[.]yt}} & {\scriptsize {\tt qtysmobytagnrv[.]it}} \\
{\bf matsnu}$^6$                    & 99995 & 30.527       & 3.757 & {\bf
332.581} & {\scriptsize {\tt dutytillboxpossessprogress[.]com}} & {\scriptsize {\tt dropbridgeexplorecraftgive[.]com}} \\
murofet$^6$                     & 102020 & 41.619      & 4.488 &  38.683 & {\scriptsize {\tt hyernzfvd10k57lyozotazkrp52gzfyp22eu[.]org}} & {\scriptsize {\tt m19e41hydyfxgtcxjyn10nynukulxdvhub18[.]com}} \\
necurs$^6$                    & 2048 & 17.029        & 3.541 &  31.256 & {\scriptsize {\tt gmwyfuhwqveqcbasvtj[.]in}} & {\scriptsize {\tt pysetkbwbryxbegmwg[.]eu}} \\
newgoz$^6$        & 1000 & 29.885        & 4.214 &  23.476 & {\scriptsize {\tt afkv141b7q87du27t2i1b91gfp[.]biz}} & {\scriptsize {\tt krx32h1jjusuatm2aetjkn6jn[.]org}} \\
others\_dga\_b$^7$    & 2775 & 19.233        & 3.485 &  90.369 & {\scriptsize {\tt qktpxl[.]info}} & {\scriptsize {\tt meatopen[.]net}} \\
proslikefan$^6$              & 130  & 11.584        & 3.225 &  20.768 & {\scriptsize {\tt rxxeqcoy[.]cc}} & {\scriptsize {\tt avhpdzz[.]com}} \\
pykspa$^6$                     & 5010  & 14.470       & 3.375 &  40.551 & {\scriptsize {\tt tdxiogn[.]org}} & {\scriptsize {\tt dwaejwfox[.]cc}} \\
qakbot$^6$                    & 5000 & 20.719        & 3.740 &  43.164 & {\scriptsize {\tt hfbtlwqlqvoywaknjksaaeeus[.]net}} & {\scriptsize {\tt wlwcrapplotshymcia[.]org}} \\
ramdo$^6$        & 100000 & 20.000      & 3.393 &  51.347 & {\scriptsize {\tt aaooekcoyysuouaa[.]org}} & {\scriptsize {\tt skmaogeyiwqgeyym[.]org}} \\
ramnit$^6$                    & 100  & 17.340        & 3.585 &  35.981 & {\scriptsize {\tt ckyioylutybvcxv[.]com}} & {\scriptsize {\tt ibvtknxochoyjidm[.]com}} \\
ranbyus$^6$                   & 80 & 18.750          & 3.684 &  35.726 & {\scriptsize {\tt cyedjumagsrrav[.]cc}} & {\scriptsize {\tt jxbdxeyxttdmcjagi[.]me}} \\
{\bf rovnix}$^6$       & 99764  & 26.797      & 3.685 & {\bf 284.222} & {\scriptsize {\tt coloniesgovernmentsthe[.]com}} & {\scriptsize {\tt tohavetheontheofassent[.]com}} \\
shiotob$^6$                   & 2001 & 16.566        & 3.655 &  20.998 & {\scriptsize {\tt cwitdw951w1n9cm[.]net}} & {\scriptsize {\tt 3pttjmaw2g[.]com}} \\
{\bf suppobox}$^6$ & 258  & 17.298        & 3.341 & {\bf 152.536} & {\scriptsize {\tt bartholomewalbertson[.]net}} & {\scriptsize {\tt dutykind[.]net}} \\
tinba$^6$                     & 101001 & 16.006      & 3.457 &  31.592 & {\scriptsize {\tt fuvfpkpwgjqj[.]com}} & {\scriptsize {\tt hosvsbvbveee[.]com}} \\
volatile$^3$              & 352 & 19.000         & 3.745 & 112.362 & {\scriptsize {\tt hpyersgtdobfla[.]info}} & {\scriptsize {\tt ergtydobflashp[.]info}} \\
\bottomrule
\end{tabular}
\end{center}
\caption{Information about a representative set of DGA families.  We include the number of samples
$n$, average length $\bar{l}(\cdot)$, the average entropy $\bar{c}(\cdot)$, the
average smash-word score $\bar{s}(\cdot)$, and two examples of the
domains found in the family.  Families with high smash-word score are given in
{\bf bold}.}
\vspace*{-2.5em}
\label{tab:families}
\end{table*}

Before introducing our proposed classifier and experiments, we introduce our
dataset of DGA families and clean domains in order to perform some exploratory
analyses.  In this section we establish the Ground Truth (GT) datasets for both
confirmed DGA and non-DGA domains.  Each of our sources are taken from public
locations, making our dataset straightforward to reproduce.

\subsection{DGA Ground Truth Set}
The GT for DGA domains consists of domains generated using Python
implementations of real-world malware families using various seeds if necessary
as an input, as well as domains collected from the wild. In order to have
sufficiently diverse coverage, the following entities were selected in
order to represent many wide-spread patterns of DGA domains seen
in-the-wild in 2017/2018:
\begin{itemize}
	\item random-looking 2nd level domain names
	\item random-looking 3rd level domain names with generic 2nd level domain (usually dynamic DNS provider)
	\item domain names comprised of random words (generally English)
\end{itemize}
The last type of domains was of our particular interest as lexically they are
virtually indistinguishable from legal domains which means that some extra
techniques are required for detection.

In almost all cases DGAs are using some sort of input seeds in order to either
randomize the output and don't generated the same domains twice, or make it
unpredictable for researchers to avoid blocking or sinkholing. Here are some of
the popular seeds:
\begin{itemize}
	\item current date and/or time
	\item value embedded into a sample/group of samples by campaign (usually one DWORD)
	\item string(s) available online either on a malware authors or public server
	\item 3rd party public online document (for example, The US Declaration of Independence, the Apple license, etc)
\end{itemize}

In addition, some work has been done to make sure that there are diverse top level domains (TLDs) represented as malware authors tend to use only some particular ones which may introduce substantial skew to our dataset.
Overall, we have collected 41 DGA families. Information on each family is given
in Table \ref{tab:families}, including the average entropy $\bar{c}(\cdot)$ and
average smashword score $\bar{s}(\cdot)$. The families are collected from
multiple sources and denoted in the table: DGArchive\footnote{See
\url{https://dgarchive.caad.fkie.fraunhofer.de/}.},
an implementation for the {\tt locky} family found on
Github\footnote{See \url{https://github.com/sourcekris/locky}.},
Andrey Abakumov's DGA repository on Github\footnote{See
\url{https://github.com/andrewaeva/DGA}.}, and Johannes Bader's DGA
implementations\footnote{See \url{https://johannesbader.ch} and
\url{https://github.com/baderj/domain\_generation\_algorithms}.}.
Smaller or unknown families were grouped as {\tt others\_dga} and {\tt
others\_dga\_b} \footnote{Sinkholed domains collected from public WHOIS
registration information containing {\tt jgou.veia@gmail.com} as the contact
email.}. All of this data is publicly available; our set of DGA
domains is reproducible.

\subsection{Non-DGA Ground Truth Set}
For non-DGA domains the GT is comprised of domains found in the Alexa top 1 million sites
and the OpenDNS public domain lists\footnote{These lists can be found at
\url{https://github.com/opendns/public-domain-lists}.}, giving 1.02M clean
domains for the clean GT set.
There were multiple major problems that had to be addressed:

\begin{enumerate}
\itemsep 5pt
	\item some prevalent DGA domains can manage to get into the list
of world top popular domains,
	\item 3rd level domains should be covered separately,
	\item some DGA domains are so short that they collided with the non-DGA
domains, and
	\item some DGA domains use combinations of English words, so the chances
that they collide with non-DGA domains are quite high.
\end{enumerate}

In the last two cases, malware authors have no problem when collisions take
place, as in
any case malware will be waiting for a valid response from the C\&C before
following up. Just the opposite, such cases can make the work of security
engineers more complicated as they cannot simply ban all domains generated by the
DGA---since some domains are known to be clean.  In our dataset, we only found
12 such domains that existed in both the non-DGA and DGA sets.  It presents
no modeling problem to leave these points in both sets.

\section{Measuring the difficulty of detection of a DGA family}

Since data-based approaches for the detection of malicious domains have been a
recurrent trend during recent years, it is inevitable that malware authors would
shift to generation algorithms that overlap with lexical patterns commonly found
in clean datasets to avoid being detected. Taking into account this adversarial
environment, we need to be able to measure how our DGA detection models will
perform not only overall, but also against the most difficult samples.
In this context, `difficult' samples can be understood to be those that trick
existing detectors---the most relevant example is those DGA families that combine
English words, like the {\tt matsnu} family \cite{skuratovich2015}, which was
one of the first of many families to build domain names from English word lists.
These generate domains like the natural-looking domains {\tt songneckspiritprintmetal[.]com} and {\tt
westassociatereplacerisk[.]com}, which present a much harder challenge to the many
detection systems that depend on lexical features~\cite{yu2018character,
woodbridge2016predicting, phoenix14, deepdga16}.

An exploratory data analysis of our dataset shows that DGA families have
characteristics that can affect the performance of classification
approaches. From an information theory point of view, both the average length
$\bar{l}(\cdot)$ and the average character entropy \cite{shannon48}
$\bar{c}(\cdot)$ of the domain names seem likely to be interesting features to
compare.  The entropy of a single domain $x$ is calculated as below:

\vspace*{-0.5em}
\begin{equation}
\hat{c}(x) = -\sum_{x_i \in x} p(x_i) \log_2 p(x_i)
\end{equation}
\vspace*{-0.5em}

\noindent where $p(x_i)$ is the empirical probability of the character $x_i$ in
the string $x$.  However, in our experiments, we found no serious correlation
between the average character entropy $\bar{c}(\cdot)$ of a DGA family and
if that family was made up of difficult English-like words.  Thus, we
cannot use $\bar{c}(\cdot)$ as a proxy for the difficulty of detecting a family.

Therefore, we have developed the {\it smashword score} $\hat{s}(\cdot)$, which
is the the average $n$-gram overlap (with $n$ ranging from 3-5) with words from an English dictionary.
The computation of the smashword score amounts to calculating term-frequency
inverse-document-frequency (TF-IDF) \cite{sparck1972statistical} scores for a
domain name using an English list of words as a reference document set.
Specifically:

\vspace*{-0.5em}
\begin{equation}
\hat{s}(x) = \frac{1}{| \mathcal{N}_{i,j}(x) |} \sum_{n_i \in
\mathcal{N}_{i,j}(x) \cap \mathcal{N}_{i,j}(D)} \log\left(|\{ d \in D : n_i \in d
\}|\right).
\end{equation}
\vspace*{-0.5em}

In this equation, $\mathcal{N}_{i,j}(x)$ refers to the set of character
$n$-grams in the domain $x$ of length $i$ or $j$, $D$ refers to the English
word list, and $\mathcal{N}_{i,j}(D)$ refers to the set of character $n$-grams in
the entire word list $D$ of length $i$ or $j$.  The $\log$ term is the count of
times an $n$-gram appears in the entire word list $D$.  If there is no overlap in any $n$-grams between the
domain and the word list, the score is has a lower bound of 0 and an upper bound depends on the word list.  The
score is normalized to the number of $n$-grams in the domain.

Computing the smashword score $\hat{s}(x)$ for a string $x$ can be done in
$\min(| \mathcal{N}_{3,4,5}(x) |, | \mathcal{N}_{3,4,5}(D) |)$ operations; but
since $| \mathcal{N}_{3,4,5}(x) |$ will generally be much smaller than $|
\mathcal{N}_{3,4,5}(D) |$, we can say that the computation will generally take
time linear in the length of the string $x$, since in a string with length
$|x|$, there are $|x| - 2$ 3-grams, $|x| - 3$ 4-grams, and $|x| - 4$ 5-grams.

The average smashword score $\bar{s}(\cdot)$ of a DGA family is then calculated
by simply taking the average smashword score $\hat{s}(\cdot)$ of all of the
domains in that family that are present in the data.

We can expect that domains with a high smashword score will resemble English
words, and thus we expect that $\bar{s}(\cdot)$ is a good indicator of the
difficulty of detecting a DGA domain.  Indeed, in the following section we find
that our data bears out this expectation.

\section{Experiments}

\begin{figure*}[t!]
\begin{subfigure}[b]{0.48\textwidth}
  \centering
  \includegraphics[width=0.95\textwidth]{matsnu_roc_curves}

  \vspace*{-0.8em}
  \caption{ROC curves for {\tt matsnu} family.}
  \label{fig:matsnu_roc}
\end{subfigure}
\begin{subfigure}[b]{0.48\textwidth}
  \centering
  \includegraphics[width=0.95\textwidth]{rovnix_roc_curves}

  \vspace*{-0.8em}
  \caption{ROC curves for {\tt rovnix} family.}
  \label{fig:rovnix_roc}
\end{subfigure}
\begin{subfigure}[b]{0.48\textwidth}
  \vspace*{-0.3em}
  \centering
  \includegraphics[width=0.95\textwidth]{gozi_roc_curves}

  \vspace*{-0.8em}
  \caption{ROC curves for {\tt gozi} family.}
  \label{fig:gozi_roc}
\end{subfigure}
\begin{subfigure}[b]{0.48\textwidth}
  \vspace*{-0.3em}
  \centering
  \includegraphics[width=0.95\textwidth]{banjori_roc_curves}

  \vspace*{-0.8em}
  \caption{ROC curves for {\tt banjori} family.}
  \label{fig:banjori_roc}
\end{subfigure}
\vspace*{-0.8em}
\caption{ROC curves for different families.}
\label{fig:rocs}
\vspace*{-0.8em}
\end{figure*}

\begin{table*}[htb]
\begin{center}
\begin{tabular}{lcccccc}
\toprule
{\bf family} & {\bf $\bar{s}(x)$} & {\bf \ \ \ \ lr-tfidf \ \ \ \ } & {\bf \ \
lr-tfidf-aug \ \ } & {\bf
\ \ \ \ glrt-lstm \ \ \ \ } & {\bf \ \ glrt-lstm-aug \ \ } & {\bf split-glrt-lstm-aug} \\
\midrule
matsnu                      & 332.6 & 0.581 & 0.824 & 0.501 & 0.546 & {\bf 0.891} \\
rovnix         & 284.2 & 0.540 & 0.758 & 0.515 & 0.635 & {\bf 0.805} \\
gozi                        & 222.2 & 0.540 & 0.684 & 0.520 & 0.548 & {\bf 0.773} \\
banjori                     & 173.9 & 0.701 & 0.585 & 0.634 & 0.508 & {\bf 0.808} \\
suppobox  & 152.5 & 0.509 & 0.505 & 0.579 & {\bf 0.798} & 0.568 \\
volatile               & 112.4 & 0.605 & 0.498 & 0.818 & 0.850 & {\bf 0.958} \\
others\_dga\_b    &  90.4 & 0.649 & 0.502 & {\bf 0.704} & 0.604 & 0.677 \\
\midrule
beebone        &  66.2 & 0.498 & 0.498 & 0.498 & 0.498 & {\bf 0.749} \\
ramdo          &  51.4 & 0.902 & 0.498 & 0.973 & 0.498 & {\bf 0.980} \\
qakbot                      &  43.2 & 0.940 & 0.498 & {\bf 0.966} & 0.914 & 0.951 \\
pykspa                      &  40.6 & 0.777 & 0.498 & 0.911 & 0.866 & {\bf 0.957} \\
murofet                     &  38.7 & 0.975 & 0.498 & 0.960 & 0.498 & {\bf 0.994} \\
ranbyus                     &  35.7 & 0.940 & 0.498 & {\bf 0.963} & 0.815 & 0.791 \\
tinba                       &  31.6 & 0.859 & 0.498 & {\bf 0.968} & 0.655 & 0.867 \\
necurs                      &  31.3 & 0.818 & 0.498 & {\bf 0.813} & 0.514 & 0.581 \\
new\_goz                    &  23.3 & 0.863 & 0.498 & {\bf 0.993} & 0.498 & 0.990 \\
\midrule
shiotob                     &  21.0 & 0.653 & 0.498 & 0.894 & 0.846 & {\bf 0.902} \\
locky                       &  20.8 & {\bf 0.849} & 0.498 & 0.751 & 0.498 & 0.557 \\
proslikefan                &  20.8 & 0.647 & 0.498 & {\bf 0.802} & 0.600 & 0.665 \\
conficker      &  19.9 & 0.609 & 0.498 & {\bf 0.836} & 0.619 & 0.649 \\
chinad                      &  19.6 & 0.786 & 0.498 & 0.952 & 0.498 & {\bf 0.979} \\
dyre   &   6.5 & 0.548 & 0.498 & 0.779 & 0.498 & {\bf 0.974} \\
\bottomrule
\end{tabular}
\end{center}
\caption{Partial AUC (FPR <= 0.01) performance numbers for selected different
DGA families, with a focus on those with either high or low average smashword
score.  Our {\bf split-glrt-lstm-aug} model performs best on those DGA families
with high average smashword score.}
\label{tab:aucs}
\vspace*{-2.0em}
\end{table*}

The most important situation for any DGA detection model is when it encounters
an entirely new DGA family that it has never seen before.  This is the situation
that we focus on in our experiments, since it reflects the real-world `zero-day'
situation.  We compare our model to several baselines that reflect the
state-of-the-art for machine learning systems that do not use network traffic
data.

{\bf Leave-one-out models.}  To simulate the situation where a DGA family has
not been seen, we validate the performance of our DGA detection model by
performing {\it leave-one-out} experiments, where we train the model on all DGA
families except one, and then the test set consists entirely of the left-out DGA
family combined with some never-before-seen non-DGA domains.  This shows us how
well the model is able to generalize to unseen DGA family types.

{\bf Dataset details.}  Our collected dataset, as described in
Section~\ref{sec:families}, includes 41 DGA families plus non-DGA data, totaling
2.3 million domain names (1.01 million non-DGA, 1.28 million DGA).
Of these 41 DGA families, many with high average smashword score have been
specifically mentioned in related work as difficult.  The LSTM model of
Woodbridge et~al.~\cite{woodbridge2016predicting} is specifically shown to
perform very poorly on the {\tt matsnu}, {\tt suppobox}, and {\tt
beebone} families, each of which have above average to very large average
smashword scores.  Mac et~al.~\cite{mac2017dga} claim that {\tt matsnu} is not
differentiable from non-DGA domains at all, and show very poor performance on all
their surveyed algorithms for the {\tt nymaim} DGA, which is very similar to the
{\tt gozi} DGA that we use here.  Because our model has been specifically
designed to focus on DGA families that are understood to be more difficult, we
will focus on these families.

{\bf Baseline models.}  We wish to compare the performance of our proposed model
with existing and baseline approaches.  Therefore, we compare our model with
four other models, which we now introduce.  Two of these are simple baseline
models, with and without WHOIS information, and the other two are based on LSTM
architectures that represent the most closely related state-of-the-art work of
Woodbridge et~al.~\cite{woodbridge2016predicting}.

\begin{itemize}
  \itemsep 5pt
  \item {\bf lr-tfidf}: logistic regression on TF-IDF features extracted
  from the domain name using 2-grams.\footnote{We did not use 3-grams, because
  the memory usage on our system was too large.}  Any WHOIS side information is
  not used here, so this model presents a reasonable baseline using only the
  domain name.

  \item {\bf lr-tfidf-aug}: logistic regression on TF-IDF features extracted
  from the domain name using 2-grams, and augmented with the WHOIS features.
  This is a reasonable baseline for classification using both the domain name
  and the side information (WHOIS features).

  \item {\bf glrt-lstm}: a GLRT LSTM model built only on the full domain name
  (no side information).  This can be considered to be a slight improvement over
  the model of Woodbridge et~al. \cite{woodbridge2016predicting} due to the use
  of the GLRT.

  \item {\bf glrt-lstm-aug}: a GLRT LSTM model built only on the full domain
  name, and then used as input to a logistic regression model, with the WHOIS
  features augmented.

\end{itemize}

{\bf Our model.}  We refer to our model as the {\bf split-glrt-lstm-aug} model;
this is the model from Section \ref{sec:model}.

{\bf Training and implementation details.}  The {\bf lr-tfidf} and {\bf
lr-tfidf-aug} models were implemented with {\tt
scikit-learn}~\cite{pedregosa2011scikit}, and the three LSTM-based models were
implemented with Keras~\cite{chollet2015keras} using the TensorFlow
backend~\cite{abadi2016tensorflow}.  Each LSTM model used 500 LSTM units and was
trained for 100 epochs (passes over the dataset) with early stopping using the
RMSprop optimizer, with dropout of 0.2.  With our setup (one nVidia GeForce GTX
TITAN X), each LSTM model took approximately 8-10 hours to train.  In our
experiments, we found that changing the optimizer made little difference to the
resulting model, and we found that increasing or decreasing the number of LSTM
units decreased performance slightly.  Overall, our model seemed to be
relatively robust to hyperparameter choice.

Figure~\ref{fig:rocs} shows receiver operating characteristic curves (ROC
curves) on the four datasets with highest smashword score.  We can see in the
figures that the {\bf split-glrt-lstm-aug} model (our proposed model)
outperforms each of the other models, providing better performance at lower
false positive rates.  For instance, on the difficult {\tt matsnu} family, when
the false positive rate is chosen to be 0.5\%, the {\bf split-glrt-lstm-aug}
model operates at a true positive rate of
95\%,
whereas the next best model ({\bf lr-tfidf-aug}) operates at a true positive
rate of only
70\%.

In typical application scenarios, we typically care only about running our
classifier at false positive rates less than or equal to 1\% (FPR $\le 0.01$).
Therefore, we study the performance of the classifiers using the {\it partial
AUC} \cite{mcclish1989analyzing} measure, which is the standard
area-under-the-curve (AUC) measure specific to false positive rates less than a
given threshold.  In Table \ref{tab:aucs}, we show the partial AUC of each model
for each leave-one-out family experiment, sorted by decreasing $\bar{s}(\cdot)$.

On the most difficult families (with large $\bar{s}(\cdot)$), the proposed {\bf
split-glrt-lstm-aug} reliably and significantly outperforms all other compared
models.  This is the region of most interest in our work, as these families are
difficult to detect---even with WHOIS data.  Each of these difficult families
generates domains that resemble English words; see Table~\ref{tab:families}.
Note that the {\bf lr-tfidf-aug} model and {\bf glrt-lstm-aug} models both have
access to the WHOIS features; however, only {\bf split-glrt-lstm-aug} is able to
take advantage of these to provide good performance for families with high
$\bar{s}(\cdot)$.

For `easier' families with lower $\bar{s}(\cdot)$, where the generated domains
typically look more like random characters, classification can be performed more
reliably with only the text of the domain itself; thus, the {\bf glrt-lstm}
model is dominant in this regime.

Overall, we see that our model is successful in detecting DGA-generated domains
that resemble English words.  The model appears to generalize well to different
families, given the nature of our leave-one-out experiments.

\section{Introduction}

\begin{figure}[t!]
\centering
\includegraphics[width=0.4\textwidth]{dga-process}
\label{fig:dga-process}
\caption{Typical example of malware using a DGA to find its command-and-control
(C\&C) server.  The infected host attempts to resolve a number of DGA-generated
domains, and connects to the first one that resolves successfully.}
\end{figure}

Many modern malware families communicate with a centralized command and control
(C\&C) server.  In order to do this, the malware must know the location of the
C\&C server to connect to---simple approaches might hardcode an IP or a domain
name.  But, these are easy to mitigate: the traffic to a specific IP can be
trivially blocked, and domain names can be easily seized.  Therefore, modern
malware authors use {\it domain generation algorithms} (DGAs) in order to
generate a large set of possible domain names where the C\&C server may exist.

Typically, an infected machine will use the DGA to serially generate domain
names.  Each of these domain names will be resolved, and if the DNS resolution
does not result in an NXDOMAIN response (i.e. if the domain name is registered),
then the machine will attempt to connect to the resolved IP as if it is the C\&C
server.  If any step of that process is not successful, then the machine will
generate another domain name with the DGA and try again, until it is successful.
Some DGA families generate random-looking domain names such as {\tt
xobxceagb[.]biz}; others generate difficult-to-distinguish domain names like
{\tt dutykind[.]net}.

This DGA-based approach to finding the C\&C server is robust to IP blocking and
domain name seizure; the C\&C server operator can use any IP they have access to
(and they may use different IPs at different times), and typically the number of
unique domain names a DGA can generate is quite large, and sometimes the DGA
itself may be hard to reverse engineer.  Therefore, it is not generally feasible
to pre-emptively seize all domain names that a DGA could generate.  In fact,
DGAs may even generate domain names that are not malicious or compromised, and
this does not affect the malware's ability to reach the C\&C server eventually.

As a consequence, the task of determining whether or not a given domain name is
produced by a DGA is an integral part of modern malware defenses.
Simultaneously, as DGA authors create DGAs that generate domain names that do not
look randomly-generated, the challenge of detecting these domain names increases.

A large body of related work seeks to use machine learning techniques directly
to classify domains as generated by DGAs or not.  Our contribution adds to this
lineage of work; here, our machine learning detector is one component of an
effective malware detection system.  To this end, we describe a machine learning
system that is able to
accurately classify a domain name as DGA-generated or clean using only the
domain name itself and some simple additional features derived from WHOIS data.
This system is especially effective on DGA families that generate domain names
based on English word lists (i.e., domains that look benign to a human observer).
Compared to previous approaches, our system performs better on
difficult-to-detect DGA families that resemble English words (such as the {\tt
matsnu} and {\tt suppobox} families), and the system is not difficult to deploy
in a real-world environment---either as a standalone detector or as part of a
larger malware detection system.

Overall, this paper makes the following contributions:
\begin{itemize}
\itemsep 5pt
\item{We provide a novel machine learning system built partially on recurrent
neural networks that is capable of classifying DGA-generated domain names even
from families traditionally understood as difficult.  To achieve this degree of
performance, our model takes advantage of side information such as WHOIS.}
\item{This model is robust: although it is trained with WHOIS information,
predictions can still be made if WHOIS or other network level information is not
available.  This is crucial for real-time detection and prevention of malware
outbreaks.}
\item{We devise a new measure that we term the {\it smashword score}.  We rank
41 DGAs in terms of detection difficulty using this measure, giving an intuitive
measure of difficulty related to how closely the domain resembles English words.
Our approach can be re-used for new DGA families, and we believe our measure is
useful for other DGA detection works in the future.}
\item{We successfully classify difficult DGA-generated domains using our model
that other state-of-the-art approaches could not conclusively label; this
includes domains with high smashword scores (e.g., those that are composed of
combinations of English words).  Note that these domains can even be difficult
for humans to classify correctly.}
\end{itemize}

\section{Model Architecture}
\label{sec:model}

Given the effectiveness of deep learning classifiers for character-level DGA
modeling~\cite{woodbridge2016predicting, yu2018character}, we have designed
our DGA detector on character-level recurrent neural networks
(RNNs)~\cite{karpathy2016visualizing}.  A character-level RNN sequentially
receives characters from a string, updating internal state as each character is
passed in.
Instead of training the RNNs to predict the class of the domain, we instead
train two RNNs to predict the next character in the domain and combine these
predictions via a generalized likelihood ratio test (GLRT).  In addition, our
model also incorporates the WHOIS side information discussed in the previous
section via model stacking.  This allows us to achieve significantly better
performance on more difficult DGA families.

Overall, our model is a logistic regression classifier built on the output of
four different models:

\begin{enumerate}

  \item A character-level RNN GLRT model built only on the {\it subdomains} in
the training set.

  \item A character-level RNN GLRT model built only on the {\it domains} in the
training set.

  \item One-hot encoded top-level domain features (for the most popular 250
TLDs).

  \item Extracted features from the WHOIS information.
\end{enumerate}

The overall architecture of the model can be seen in
Figure~\ref{fig:overall_model}.  In the following subsections we describe the
details of the full model.

\subsection{Character-level RNN GLRT}

The core of the model is the character-level RNN that uses the generalized
likelihood ratio test to classify a domain or a subdomain as DGA or non-DGA.
Previous approaches and other uses of RNNs often predict the class of the output
directly~\cite{woodbridge2016predicting, graves2005framewise};
however, this only allows backpropagation of the error signal at the end of the
entire sequence, which can slow the learning process.

Therefore, we build one RNN on each class in the input dataset (in our case,
there are only two classes: {\it DGA} and {\it non-DGA}).  Each input
sequence is converted to a one-hot character encoding, and the label or expected
output of the RNN for each time step is the one-hot encoding of the {\it next}
character in the sequence.  This means the RNN is trained to predict the next
character in the sequence.  Thus, backpropagation can be done at every timestep,
instead of waiting until the end of the sequence to compare the output of the
RNN with the desired label.  Our model's architecture is a single LSTM
layer~\cite{hochreiter1997long} followed by a single dense layer, pictured in
Figure~\ref{fig:lstm}.  We use LSTMs to help avoid the vanishing and exploding
gradient phenomenons~\cite{pascanu2013difficulty}. Although it is possible to
build a more complex network, we found that this provides a good balance between
training time and the accuracy of the model.

\begin{figure}[b!]
  \centering
  {\small
  \begin{tikzpicture}[scale=0.6]
    \input{lstm.tex}
  \end{tikzpicture}
  }
  \caption{The individual RNN model architecture.  The model takes a one-hot
encoded character as input (along with its current hidden state) in order to
predict the next character in the sequence.}
  \label{fig:lstm}
\end{figure}

In order to perform the one-hot encoding, we first build a dictionary $D$ on the
entire training set, including the `unknown' character {\tt '?'}.  If a character
is encountered at prediction time that is not in $D$, then it is encoded as {\tt
'?'}.

We use the categorical cross-entropy~\cite{goodfellow2016deep} for the loss
function.  Then, during prediction, at each time step $i$ for the input $x$, the
output of the model $\theta$ is a probability $p(x_i | (x_0, \ldots, x_{i - 1}),
\theta)$ and with this we can construct an estimate of the likelihood of the
point $x$ arising from the model $\theta$:

\begin{equation}
p(x | \theta) = \prod_{i} p(x_i | (x_0, \ldots, x_{i - 1}), \theta).
\end{equation}

For the generalized likelihood ratio test~\cite{neyman1933ix}, if we calculated
both likelihood estimates $p(x | \theta_{\textrm{non-dga}})$ and $p(x |
\theta_{\textrm{dga}})$, we could then set a threshold $\eta$ and compute

\begin{equation}
\Lambda(x) = \frac{p(x | \theta_{\textrm{dga}})}{p(x |
\theta_{\textrm{non-dga}})},
\end{equation}

\noindent and if $\eta > \Lambda(x)$, we classify the point as a DGA domain;
otherwise, we classify the point as non-DGA.  The value of $\eta$ can be swept in
order to control the false positive and true positive rate.  $\eta$ is directly
related to the typical posterior probability of a classifier; in fact, if we
normalize the likelihood estimates we can produce a posterior probability of $x$
being a DGA domain:

\begin{equation}
p(\theta_{\textrm{dga}} | x) = \frac{p(x |
\theta_{\textrm{dga}})}{p(x | \theta_{\textrm{non-dga}}) + p(x |
\theta_{\textrm{dga}})}.
\end{equation}

Then, setting a threshold for $p(\theta_{\textrm{dga}})$ is reducible to
setting a GLRT threshold $\eta$.

For our DGA classifier, we build two separate RNN-GLRT models as described
above: one on the {\it subdomains} of our training set, and one on the {\it
domains}.  Each of these two models, in turn, contains a separately-trained LSTM
RNN, whose outputs are combined to perform the GLRT as shown above.

As input to the logistic regression model, we extract six features from each
RNN-GLRT model, giving a total of twelve features.  The features are listed
below.

\begin{itemize}
  \itemsep 5pt
  \item A boolean feature indicating whether a domain or subdomain could be
extracted from the input domain $x$.

  \item The likelihood estimate $p(x | \theta_{\mathrm{non-dga}})$.

  \item The likelihood estimate $p(x | \theta_{\mathrm{dga}})$.

  \item The posterior probability $p(\theta_{\mathrm{non-dga}} | x)$.

  \item The posterior probability $p(\theta_{\mathrm{dga}} | x)$.

  \item The likelihood ratio $\Lambda(x)$.
\end{itemize}

Since we are extracting the likelihood estimates and posterior probabilities
into a logistic regression model, we actually have no need to select a threshold
$\eta$---that is only needed for a standalone GLRT LSTM model.  Instead, in our
combined model, the logistic regression will learn directly from the
probabilities and likelihoods.

\vspace*{-0.4em}
\subsection{Top-level domain features}

Since TLDs are so short (usually two or three characters), it is excessive to
train an RNN on them.  Therefore, we use a one-hot encoding of the TLD, matching
against the 249 most frequent TLDs in our training dataset; if there is no
match, the TLD is encoded as `other', giving a total of 250 binary features out
of the TLD.

In order to perform the conversion, we used the TLD list available from
\url{http://publicsuffix.org}.  The most common TLDs in our dataset were {\tt
.com}, {\tt .org}, {\tt .ru}, {\tt .net}, and {\tt .info}.  We found that the
{\tt .ru}, {\tt .info}, {\tt .biz}, and {\tt .cc} TLDs contained significantly
higher concentrations of DGA domains, with each of those TLDs containing
at least 3 times as many DGA as non-DGA domains.  Since we have split these
into separate features, we can expect our model to learn which TLDs domain
generation algorithms are more likely to use.

\vspace*{-0.4em}
\subsection{WHOIS side information}

The WHOIS data makes up the rest of the input to the logistic regression model.
It is concatenated with the RNN-GLRT features for the domain, the RNN-GLRT
features for the subdomain, and the one-hot encoded TLD features.

Before all of these features are fed into the logistic regression
model, we perform whitening via PCA for decorrelation and
scaling~\cite{kessy2015optimal}.  This step can improve the performance of the
model, although it generally also makes interpretability more difficult.

\vspace*{-0.4em}
\subsection{Computational concerns}

Recurrent neural networks, especially those with complex memory cells like
LSTMs, are well-known to be time-consuming to train~\cite{li2015fpga,
doetsch2014fast}.  Our model is not exempt from this; for large datasets, it may
take many hours to train\footnote{Our training was conducted on a high-end
consumer-grade system with a single GPU.}.  However, in practice this is not a
concern---a single forward pass through the model for classification is
comparatively very fast, and once our model is trained, there are no
computational difficulties with deployment in a low-latency
detection system.  This means that the model can be, e.g., deployed into a
consumer endpoint security product without problems.

\section{Acknowledgements}

\bibliographystyle{ACM-Reference-Format}

\section{Related Work}

The problem of distinguishing legitimate domain names from algorithmically generated is certainly not new, and has
been studied for a number of years.  DGAs first became widely known to the
community with the introduction of Kraken \cite{kraken09} and Conficker \cite{conficker2009}
in 2008.  Since that time, DGAs in malware have proliferated.

The early efforts to stop this threat were dealing with lack of sufficient training data to apply machine learning approaches~\cite{avivbotnet11}. One decade later it continues to be a problem but to a smaller extent.
Thus early proposed approaches and techniques were rather statistical. For example Yadav et al.~\cite{domainflux12}
applied such technique to show differences between valid domain names and algorithmically generated ones. The limitation of such approach would be that it often does not transfer to a different DGA family.

Another milestone in detection techniques was credited to more extensive usage of DNS data. For example Zhou et al.~\cite{Zhou2013DGABasedBD} gathered DNS NXDOMAIN data from RDNSs and then used it to assemble a set of suspicious algorithmically generated domain names.

A different approach was proposed by Jian et al.~\cite{dnsgraph10}. It relied on DNS traffic analysis but only for failed lookups. In this technique interactions between hosts and failed domain names would be extracted. Then a graph decomposition algorithm using nonnegative matrix tri-factorization technique to iteratively extract coherent co-clusters would be applied. The obtained sub-graphs would be further analyzed by exploring temporal properties of generated clusters. The authors claim that their anomaly based approach can detect new and previously undiscovered threats.

Further research efforts evolved towards more and more extensive usage of machine learning techniques. At a large scale, it was pioneered by Phoenix~\cite{phoenix14} that was able to use both the URLs and other side information to detect DGA botnets. The list of parameters observed by this system includes some handcrafted features like pronounceability, blacklist information, DNS query information. This approach does not use any recurrent neural network (RNN) or powerful modeling technique for the domains themselves leaving a room for improvement. Tong and Nguyen \cite{semanticdga16} have already proposed extensions to the Phoenix system. They included additional measures such as entropy, n-grams and modified distance metric for domain classification.

Further progress in DGA detection was reported when using machine learning techniques. For example, Zhao et al.~\cite{aptdns15} addressed the problem in the context of detecting APT malware.
The authors proposed 14 features based on their big data research to characterize different properties of malware-related DNS and the ways that they are queried as well as defined network traffic features that can identify the traffic of compromised clients that have remotely been controlled.
The features are comprised of signature-based engine, anomaly-based engine and
so-called dynamic DNS features. The data was filtered by using
Alexa\footnote{See \url{https://www.alexa.com/topsites}.} popularity and prevalence based on the number of hosts connecting to domains.
As the outcome, an engine was built and it was used to compute reputation scores for IP addresses using extracted features vectors.
The results are produced by using the J48 decision tree algorithm.

A comparable approach was presented by Luo et al.~\cite{dgasensor17} who described a system using lexical patterns that were extracted from clean domains listed in the Alexa top 100k domains as well as confirmed malicious DGA cases. The proposed approach is machine learning-based and achieves 93\% accuracy for detecting malicious domains on the test dataset.

Additional improvements for state of the art results were reported by Woodbridge et al.~\cite{woodbridge2016predicting}.
Despite a relatively simple Long Short-Term Memory (LSTM) network used to
classify DGA domains, the approach was reported to have a high level of
effectiveness. The presented results still have certain shortcomings, especially
for difficult DGA classes that resemble English words.

The same problem was approached from a different angle by Anderson et al.~\cite{deepdga16}.
The authors use a Generative Adversarial Network (GAN) to generate adversarial DGA domain names to try and deceive a classifier. The authors were able to achieve this goal. Then the GAN-generated domain names were added to the training set, which resulted in improved DGA detection performance.
However, the authors did not test on any DGA families that look like they are
made up of English words.

Shibahara et al.~\cite{Shibahara2016EfficientDM} proposed a slightly different
algorithm that is using RNN on changes in network communication with a goal of
reducing malware analysis time. This approach is not DGA-only specific but
rather generic and attempts to cover other types of malware. However, it could
successfully be used against DGA-type of threats based on their communication
patterns. Thus this technique requires additional run-time data that is
not required in many of the other approaches as it requires malware sandboxing.
The authors claim that without their optimization the analysis time takes over
15 min. and their approach reduces this time by 67\%, preserving the detection rate of malicious URLs at 97.9\%.

Overall, though the task of DGA detection is certainly not new, there has not
been much focus on directly detecting DGA families made from English words
using the domain itself as a feature. This task has been described as
`extremely difficult' in some previous works \cite{woodbridge2016predicting}.
Here, our focus is specifically on those DGA families.

\section{Side Information}
\label{sec:side}

DGA families with a high average smashword score $\hat{s}(\cdot)$ are very hard
to classify based on the domain names alone.  In fact, human analysts may even
have a difficult time differentiating---for instance, it is plausible at first
glance that {\tt darkhope.net} might be a personal website for a 1990s-era
teenaged computer enthusiast.  In reality, that domain name is generated by the
{\tt suppobox} DGA.  Thus, we cannot hope to build an effective classification
system using single domain names alone.

Therefore, we augment our domain names with {\it side information}, which we
collect from the WHOIS database \cite{rfc3912}.  Specifically, given a domain
name, we perform a WHOIS lookup, and extract the following numeric or Boolean
features:

\medskip
\begin{itemize}
  \item {\tt has\_registrarname}: Boolean, indicates whether a registrar
name is available.
  \medskip
  \item {\tt has\_contactemail}: Boolean, indicates if any contact email is
available.
  \medskip
  \item \texttt{days\_since\_created}, \texttt{days\_since\_updated}, \\
\texttt{days\_until\_expiration}: numeric, the number of days since the domain was
created, updated, or until expiration
  \medskip
  \item {\tt status\_length}: numeric, length of the ``status'' field
  \medskip
  \item {\tt has\_registrant\_info}, {\tt has\_admincontact\_info}, \\ {\tt
has\_billingcontact\_info}, {\tt has\_techcontact\_info}, \\ {\tt
has\_zonecontact\_info}: Boolean, indicates whether contact
information is available.
  \medskip
  \item {\tt has\_registrar\_iana\_id}: indicates whether a registrar IANA ID is
given.
\end{itemize}
\medskip

Note that for a non-registered domain name (NXDOMAIN), the boolean features will
all be {\tt false}, and the numeric features will all be taken as 0.

We do not perform any semantic analysis on the content of the WHOIS record;
instead, we focus on those features most likely to give us information relevant
to DGAs and C\&C servers: temporal information about the registration, and
whether the domain itself is registered.  The features we are using roughly
match the type of features used by Ma et~al. \cite{ma2009beyond}.

For our dataset, we used a snapshot of collected WHOIS data
with 245M records.
For our clean domain names, we matched 927k domains (91.7\%) to
WHOIS data, and for the DGA domains, we matched only 2.3k domains (0.18\%)
to WHOIS data.  This is expected, given that most DGA domains are never
registered.  In practice, either a snapshot of WHOIS data (potentially updated
nightly) or on-demand access of the WHOIS data could be used, depending on the
scalability needs of the deployment.

In our dataset, DGA families have an average of 3.5\% of their domains
matched to WHOIS data; with the {\tt ramnit} family matching the highest
percentage at 84\%, and the {\tt pandex} family matching the lowest nonzero
percentage at 0.008\% (only 7 out of 91758 domains registered).  19 families,
totaling 321k domains, have no domains matched to any WHOIS data.

Although having matching WHOIS data for a domain is strongly correlated with
whether or not the domain arises from a DGA, note that a detector built to
classify a domain as malicious simply if there is no WHOIS data would not be
very effective: with our data, it would achieve a true positive rate (TPR) of
96.5\%, but with an unacceptably high false positive rate (FPR) of 8.3\%.
Though WHOIS data gives us good information, it is not sufficient for
prediction.

\subsection{WHOIS and GDPR}

After the passing of the European privacy bill GDPR \cite{gdpr}, it is unclear
how WHOIS lookups will be affected \cite{icann-gdpr}.  At the time of our
experiments, WHOIS data was still publicly available.  However, if this is not
the case in the future, it would be easy to find alternatives.  Given that the
important features we extract depend more on the temporal registration
information than the contact details of the registrant, we could replace our
WHOIS features with DNS tracking systems like Active DNS
\cite{kountouras2016enabling} or the Alembic system \cite{lever2016domain}.

At the time of this writing, it is not clear what the long-term solution for
WHOIS data will be.  But, since WHOIS data is widely used for security
applications \cite{ma2009beyond, bilge2011exposure, canali2011prophiler}, it
seems unlikely that the types of features we are using for our system will
become unavailable.

redpajama_set_name: RedPajamaArXiv


text:
El narval (Monodon monoceros) és una espècie àrtica de cetaci odontocet, semblant a la beluga (Delphinapterus leucas), i com a tal està dotat de dents i no pas de barbes com els misticets. És estrany trobar-ne a latituds més al sud de 70°N.

Història
El gran ullal del narval donà lloc al mite de l'unicorn, i durant molts anys foren caçats per vendre els seus ullals com a banyes d'unicorn. De fet, al Japó es van comercialitzar fins al 1950, sota el nom dikkaku, un remei capaç de neutralitzar qualsevol verí. Actualment la seva caça per aquest motiu està totalment prohibida i només els esquimals tenen llicència per caçar-ne un nombre determinat cada any, ja que formen part de la seva dieta. La carn de narval és molt apreciada pels esquimals, sobretot crua pel seu alt valor nutritiu.

Descripció
Els narvals amiden 1,5 metres quan naixen i poden arribar a fer 6 metres els mascles i 5 metres les femelles (aquestes mides no tenen en compte l'ullal). Una característica del narval és que no disposa d'aleta dorsal. Aquest fet segurament forma part d'una adaptació per poder viure a l'Àrtic, ja que sense aquesta aleta poden nedar sota el gel sense por de xocar-hi. Per tal de suplir les funcions de l'aleta dorsal tenen un seguit de protuberàncies que els permeten mantenir l'equilibri. El seu hàbitat gèlid també fa que disposin d'una capa de greix molt gruixuda (pot arribar a suposar el 40% del seu pes total). Altres trets característics són la pell blanca amb taques negres (que sol tornar-se més clara amb l'edat) i la cua en forma convexa (al contrari que la dels dofins, per exemple).

La dieta dels narvals inclou arengades, bacallà, halibuts, salmons, cefalòpodes i crustacis.

Les femelles de narval tenen un temps de gestació d'entre 14 i 15 mesos; i una longevitat de 40 anys.

L'ullal dels narvals
El tret més característic del narvals és l'ullal que els sobresurt del musell. En realitat és només un dels dos ullals que posseeixen. L'ullal dret no sol créixer i queda amagat dins la geniva, mentre que l'esquerre pot créixer fins als 3 metres, en el cas del mascles. D'altra banda, tot i que les femelles posseeixen els dos ullals, no els en sol créixer cap. Tot i això s'han trobat exemplars de femelles amb un ullal sobresortint i mascles als quals els havien crescut els dos ullals. No se sap del cert la utilitat d'aquests ullals. Les diverses hipòtesis suggereixen que pot ser per defensar-se de depredadors com l'os polar, per lluitar entre mascles o per trencar clapes de gel per poder sortir a respirar.

Referències bibliogràfiques

Bibliografia
 Carwardine, M. et al.: Ballenas, delfines y marsopas, Barcelona: Ediciones Omega S.A. Any 1999
 Carwardine, M.:Ballenas, delfines y marsopa, 1a edició Barcelona: Plaza & Janés. Any 1993
 Macdonald, D.:Mamíferos marinos: ballenas, focas y delfines, Ediciones Folio. Any 1991
 Papastavrou, V.: Ballenas, delfines y otros mamíferos marinos, 1a edició Madrid: Santillana. Any 1994

Delfinoïdeus
Mamífers del Canadà
Mamífers de Groenlàndia

redpajama_set_name: RedPajamaWikipedia


For the explosive 'Before I Self Destruct album,' 50 Cent returned to working closely with Dr. Dre and Eminem as he did on Get Rich Or Die Tryin', his first official album.
With Dr. Dre and Eminem producing and guesting, Before I Self Destruct is darker and harder than 2007's Curtis, as shown by the grimy single and video to "OK, You're Right" (produced by Dr. Dre), which was released earlier this year. In early September, 50 released the hit single "Baby By Me" feat. Ne-yo produced by Polow da Don (Fergie, T.I., Ludacris).
Before I Self Destruct continues 50 Cent's phenomenal rise from street culture hero to pop culture icon.


text:
Danny, the Champion of the World
For the film based on the book, see Danny, the Champion of the World (film).
"The Champion of the World" redirects here. For other uses, see The Champion of the World (disambiguation).
Original book cover
Jill Bennett (original)
1975 Jonathan Cape (original)
Puffin Books (current)
Print (Hardback, Paperback)
Danny, the Champion of the World is a 1975 children's book by Roald Dahl. The plot centres on Danny, a young English boy, and his father, William, who live in a Gypsy caravan fixing cars for a living and partake in poaching pheasants. It was first published in 1975 in the United States by Alfred A. Knopf, Inc. and in the United Kingdom by Jonathan Cape.
It was adapted into a made-for-TV movie in 1989 by Thames Television which starred Jeremy Irons. It is based on Dahl's adult short story "Champion of the World" which first appeared in print in The New Yorker magazine,[1] as did some of the other short stories that would later be reprinted as Kiss Kiss (1960). Peter Serafinowicz provides the English language audiobook recording.[2] Time included the novel in its list of the 100 Best Young-Adult Books of All Time.[3]
2 TV movie
3 Relations to other Roald Dahl books
Summary[edit]
Danny was only four months old when his mother died. At the beginning of the book, he lives with his widowed father, William, in an old caravan behind the service station and garage owned and operated by his father. At the age of nine, Danny learns that his father is an avid poacher, as was his father's father. Shortly thereafter, Danny wakes at 2:10 am to find his father hasn't returned from his latest poaching venture on the property of the local beer magnate, Mr Hazell. Danny drives to the property and finds his father in a trap, incapacitated by a broken ankle. Danny rescues his father and helps him home. While his father recovers from his injury, he and Danny realize Mr. Hazell's annual pheasant shoot is approaching - an event to which he invites wealthy, powerful and influential people. Danny and his father decide to humiliate Mr Hazell by capturing all the pheasants in the forest. To accomplish this, they place the contents of the sleeping pills prescribed to Danny's father by the village doctor, Doc Spencer, into raisins that the pheasants will eat; Danny's father calls this new method "Sleeping Beauty".
After having successfully captured 120 pheasants from Hazell's Wood, Danny and his father take a taxi (driven by a fellow poacher) to the local vicarage, where they hide the pheasants. Afterwards, they walk home. The next day, the vicar's wife (Mrs Clipstone) delivers the sleeping pheasants to Danny's father's garage in a specially built baby carriage; however, the pheasants start flying out of the baby carriage as the narcotic wears off. The birds do not travel far, as they're still sleepy. During the commotion, Mr. Hazell arrives and confronts Danny, his father and Doc Spencer. With the help of Sergeant Enoch Samways, the village policeman, Danny and his father shoo the stunned pheasants over (and in some cases inside) Mr. Hazell's Rolls Royce, damaging the car's paintwork in the process. As Mr. Hazell leaves disgraced, the pheasants wake up completely and fly away in the opposite direction from Hazell's property. The book ends when Danny is hailed as "the champion of the world" by his father, Doc Spencer and Sgt. Samways. Six pheasants died of a sleeping pill overdose, so Doc Spencer gives two each to Sgt Samways, Mrs Clipstone and Danny and his father. Danny and his father then walk into town, intending to buy a new oven to cook their pheasants. They also discuss possibly attempting to poach trout from a local stream.
TV movie[edit]
Main article: Danny, the Champion of the World (film)
The book was adapted into a made-for-TV movie in 1989 by Thames Television. It was directed by Gavin Millar and starred Jeremy Irons as William and his son, Samuel, as Danny, with Robbie Coltrane as Mr. Hazell. It was released to Region 2 DVD in 2006.
Relations to other Roald Dahl books[edit]
Danny, The Champion of the World is based on a previous short story by Dahl, entitled The Champion of the World, which was first published in The New Yorker Magazine in 1959 and later re-published in the compilation Kiss Kiss. The original story has a similar premise, but with adults as the main characters.
William tells Danny a bedtime story sequence of a "Big Friendly Giant" who captures good dreams and blows them into children's bedrooms at night. Dahl would later use the same concept in the full-length novel entitled The BFG.
Danny describes being caned by his teacher, Captain Lancaster, for cheating in an exam. This is similar to an experience that Dahl recounted of his own teacher, Captain Hardcastle, in Boy: Tales of Childhood.
Editions[edit]
ISBN 0-435-12221-5 (hardback, 1975)
ISBN 0-14-032287-6 (paperback, 1977)
ISBN 0-224-06469-X (paperback, 2002)
ISBN 0-375-91425-0 (library binding, 2002)
ISBN 0-14-131132-0 (hardback, 2004)
^ All works by Roald Dahl. The New Yorker. Retrieved 1 October 2014.
^ "Danny, the Champion of the World". Penguin Books. Retrieved 20 November 2015
^ "100 Best Young-Adult Books". Time. Retrieved 30 October 2019.
The Gremlins (1943)
James and the Giant Peach (1961)
The Magic Finger (1966)
Fantastic Mr Fox (1970)
Charlie and the Great Glass Elevator (1972)
Danny, the Champion of the World (1975)
The Enormous Crocodile (1978)
The Twits (1980)
George's Marvellous Medicine (1981)
The BFG (1982)
The Witches (1983)
The Giraffe and the Pelly and Me (1985)
Matilda (1988)
Esio Trot (1990)
The Vicar of Nibbleswicke (1991)
The Minpins (1991)
Revolting Rhymes (1982)
Dirty Beasts (1983)
Rhyme Stew (1989)
Some Time Never: A Fable for Supermen (1948)
My Uncle Oswald (1979)
Over to You: Ten Stories of Flyers and Flying (1946)
Someone Like You (1953)
Kiss Kiss (1960)
Lamb to the Slaughter (1953)
Switch Bitch (1974)
The Wonderful Story of Henry Sugar and Six More (1977)
The Best of Roald Dahl (1978)
Tales of the Unexpected (1979)
More Tales of the Unexpected (1980)
The Roald Dahl Omnibus (1986)
Two Fables (1986)
Ah, Sweet Mystery of Life: The Country Stories of Roald Dahl (1989)
The Collected Short Stories of Roald Dahl (1991)
The Roald Dahl Treasury (1997)
The Great Automatic Grammatizator (1998)
Skin and Other Stories (2000)
Roald Dahl: Collected Stories (2006)
The Mildenhall Treasure (1946)
Boy: Tales of Childhood (1984)
Going Solo (1986)
Memories with Food at Gipsy House (1991)
Roald Dahl's Guide to Railway Safety (1991)
My Year (1993)
36 Hours (1965)
Breaking Point (1989)
Four Rooms (1995)
Tom and Jerry: Willy Wonka and the Chocolate Factory (2017)
Film scripts
The Bells of Hell Go Ting-a-ling-a-ling (1966, unfinished)
You Only Live Twice (1967)
The Night Digger (1971)
'Way Out (1961)
Tales of the Unexpected (1979–88)
The Honeys (1955)
Roald Dahl bibliography
Roald Dahl short stories bibliography
Roald Dahl's Book of Ghost Stories (1983)
List of Tales of the Unexpected episodes
Roald Dahl Museum and Story Centre
Roald Dahl Children's Gallery
Patricia Neal (wife)
Tessa Dahl (daughter)
Ophelia Dahl (daughter)
Lucy Dahl (daughter)
Sophie Dahl (granddaughter)
Phoebe Dahl (granddaughter)
Retrieved from "https://en.wikipedia.org/w/index.php?title=Danny,_the_Champion_of_the_World&oldid=934391798"
1975 British novels
Children's books by Roald Dahl
Roald Dahl characters
Novels by Roald Dahl
British children's novels
Jonathan Cape books
British novels adapted into films
1975 children's books
EngvarB from September 2017
Use dmy dates from September 2017

redpajama_set_name: RedPajamaCommonCrawl


text:
Lundehus is een parochie van de Deense Volkskerk in de Deense gemeente Kopenhagen. De parochie maakt deel uit van het bisdom Kopenhagen en telt 3940 kerkleden op een bevolking van 6160 (2004). De parochie werd tot 1970 gerekend onder Sokkelund Herred.

Lundehusi werd gesticht als parochie in 1938 als afsplitsing van de parochie Bispebjerg. De parochiekerk werd gebouwd in 1957. Tussen 1938 en 57 kende de parochie een tijdelijk kerkgebouw.

Parochie in Denemarken
Østerbro
Religie in Kopenhagen


text:
Q: Change Javascript src Depending On PHP Output How do you change the the Javascript src in foo.html in reaction to the output created from cond1.php via AJAX? For example, if cond1.php echoes 1 then src="something.js".
I'd like to know this because in my actual project I will be using the Google Books API and I will need to use a different src depending on the output from the PHP file.
foo.html

<!DOCTYPE html>

      <form onsubmit="makeRequest(); return false">
        <input type="text" id="inputText" name="inputText">
        <input type="submit">
      </form>

      <textarea  id="txtBox">
      </textarea>

cond1.php

<?php
$input = $_POST["inputText"];

if ($input == "") {
    echo "0";
} else {
    echo "1";
}
?>

A: Check out jQuery's getScript method, this will allow you to dynamically and conditionally load your JavaScript via ajax.

A: You can dynamically create script tag in your DOM and set it's src with ajax response.
httpRequest.onreadystatechange = function() {
  document.getElementById("txtBox").innerHTML = httpRequest.responseText;
  var scriptElem = document.createElement("script");
  scriptElem.src = httpRequest.responseText;
  document.getElementsByTagName("head")[0].appendChild(scriptElem)
};

Check if this works for you.

redpajama_set_name: RedPajamaStackExchange


text:
Zemiropsis papillaris, common name : the spotted , is a species of sea snail, a marine gastropod mollusk in the family Babyloniidae.

Description
The spotted babylon has a plump shell, which varies in size between 33 mm and 50 mm. The shell has a smooth surface and is white with reddish-brown spots in an indistinct lattice pattern. The foot is spotted with vivid red.

Distribution
This species is only found off the South African coast from False Bay to the eastern Transkei in 15-65m under water. It is endemic to this area.

References

 Dekker (2008). Gloria Maris 46 (4–5) : 106–112

External links

Babyloniidae
Gastropods described in 1825


text:
Earth: By The Numbers
by Steve Jenkins
Caldecott Honor winner Steve Jenkins introduces By the Numbers infographic readers chock full of incredible infographs and stunning, full-color cut-paper illustrations. Earth will focus on the fascinating ins-and-outs of earth science.
Carton Quantity: 48
Paperback – $5.99
Through infographics, illustrations, facts, and figures, readers will learn about the complex and wonderful place we call home, Earth.
Discover some of the most fascinating aspects of our planet through astonishing numbers: the stretch of time from Earth's formation to the present, the misleading way the surface area of a continent can appear on a map, the angle of Earth's axis that creates the seasons, what percentage of Earth's land is covered in deserts or forests or cities, and so much more.
With his signature style, Steve Jenkins explores the most fascinating fields of natural science.
Steve Jenkins
Steve Jenkins has written and illustrated many nonfiction picture books for young readers, including the Caldecott Honor-winning What Do You Do with a Tail Like This? His books have been called stunning, eye-popping, inventive, gorgeous, masterful, extraordinary, playful, irresistible, compelling, engaging, accessible, glorious, and informative. He lives in Boulder, Colorado with his wife and frequent collaborator, Robin Page. www.stevejenkinsbooks.com


text:
LETTER: Supports Sestak for Senate
By John J. Bury |
PUBLISHED: June 3, 2013 at 10:00 p.m. | UPDATED: September 23, 2021 at 7:48 a.m.
When Admiral Joe Sestak declared he would be running for the U.S. Senate, I was happy to hear it primarily because of one reason: he will take care of our veterans. Our Senators and Congressmen voted to send them to war in Iraq and Afghanistan, adding $1 trillion to our national dept for the cost of the wars. But when those same Washington, D.C. politicians were asked to help our returning war veterans with a jobs bill, Pennsylvania's Senator Toomey – who voted for the wars when as a Congressman from 1998 to 2005, voted "no" to help our veterans with the jobs bill.
Admiral Sestak always supported our veterans when he was in Congress, and we need him now in the U.S. Senate. Otherwise, we will continue to have Senator Toomey who doesn't understand either the cost of wars, or the cost of what we owe our veterans who actually fight them, A good example of Senator Toomey's lack of understanding, in 2012, a Senate bill to help sick Vietnam veterans was ignored. In my opinion, Admiral Sestak would not have ignored that bill.
John J. Bury, US Navy,
John J. Bury
Brown: Lane Johnson turns reflective after Eagles win over 49ers
Will Wood: Portnoy, the pizza guy, comes to town
Editorial: Schools should protect taxpayers, not fund balances
Main Line Banter: Restaurants, 'rabbits' and February ramblings


text:
nunoabrantes 24th February 2017
24th February 2017 9:09AM
Business Comment Wire Financial Services
The sorry tale of Ross McEwan, RBS, and the never ending UK banking embarrassment
Douglas Blakey
The Royal Bank of Scotland — still 73 percent tax-payer owned since the financial crisis — has just reported its ninth consecutive year of losses.
The bank said in its full year financial results statement that it lost £6.9bn ($8.7bn) last year, a far worse performance than the £1.9bn it lost in 2015.
Timeline for Financial crisis
Former Barclays executives charged with committing fraud during the financial crisis
These are the world's most profitable banking markets
People in Portugal are eating out again
Amid the carnage, RBS took a £2.11bn hit for the cost of restructuring, including £750m set aside for a plan it hopes will allow it to dodge requirements to sell off hundreds of branches under the Williams & Glyn brand.
Four years ago, I thought Ross McEwan was the man to pull off the turn around.
So I got it wrong. No excuses.
In a piece for the New Statesman in June 2013 – I dared to advise the doyen of City headhunters, Anna Mann, co-founder of blue-chip consultancy MWM, to go for Ross McEwan as the new CEO of Royal Bank of Scotland.
He was then a 20-1 outsider with Ladbrokes and head of RBS' retail unit.
To my shame, I did not back him at 20-1 or at 8-1 when the article appeared.
I did not back him at all in fact — but the UK government did duly appoint McEwan and he seemed a good bet to continue the Herculean job of turning around RBS.
Fast forward four years and the time has come to question if the £10m or so give or take the odd million pocketed by McEwan since his appointment is merited.
The Williams & Glyn saga
I'm out of words to describe the Williams & Glyn saga — in a 2014 editorial I called it a soap opera; in 2015 an expensive shambles and last year embarrassing mismanagement.
At McEwan's first RBS annual share holder meeting as CEO, what passes as RBS investors these days, Joe Public, were told that the 308 RBS branded branches in England and Wales and the six NatWest branches in Scotland would be sold off to form Williams & Glyn by the end of 2016.
Get the Verdict morning email
Since then, the bank has burned through a few hundred million in consultants' fees.
I've heard that the cost-income ratio of W&G started with a nine (the UK average is 76.84 percent according to S&P Global and lower is better); and that there were major problems with risk functions and technology.
I was told by one RBS staffer that RBS did not have the change capability needed — that seemed odd as I happened to know that a Change Management Consultancy had put in some of its brightest people to RBS to work on the project.
Over 100 W&G contracts were issued; several thousand staff and agency employees worked on W&G.
The end result of the W&G project is a fail.
McEwan has had a tough four years — as one of the first banking writers to call for him to get the top job at RBS, it seems harsh to be one of the first to suggest his time may be drawing to a close.
I would not however object if the New Statesman quietly removed my 2013 piece suggesting why McEwan was the right man for the job.
BusinessComment WireFinancial Services
Payments regulation is soon going to force us all to have a digital ID
Alibaba's everything-to-everyone model couldn't work in the West
With the departure of the OCC head, US fintech charter plans have fallen in to doubt


I would definitely say they are more sparkly then what the photo permits.
They have loads of different colours to choose from on there website.
as my ears can be sensitive to earrings unless they are silver or gold.
I'll be sad if I do have a reaction to them as they are so pretty.


text:
Next Midnight Madness: Die Hard
Review: 'Creed II' keeps the Rockyverse fresh
Wednesday, December 5, 2018 by Tony Libera in Movies
Sylvester Stallone and Michael B. Jordan are back in the ring. Warner Bros.
Even if the first Rocky movie was your last Rocky movie, you'll know the broader strokes of Creed II before heading into the theater. The entire series more or less rehashes the same plot over and over again, with a predictability that would wreck any other franchise. Yet somehow, over 40 years later, the Rocky formula continues to work.
That's not to say every installment is a sublime work of art. Rocky V is an unmitigated shitshow. Yet each episode does what it sets out to do with some degree of effectiveness. You can always count on a Rocky movie to be fun and sometimes even great.
Creed ended with our hero, Adonis Creed (Michael B. Jordan), going the distance with the world champion and losing by split decision, just like his mentor Rocky Balboa (Sylvester Stallone) did back in 1976. Unlike Rocky II, however, the second Creed movie opens with Adonis winning the WBC World Heavyweight Championship. This catalyzes the appearance of Creed II's true antagonists, Rocky IV's Ivan Drago (Dolph Lundgren) and his son Viktor (Florian Munteanu), who have been living a spartan lifestyle since Rocky defeated Ivan back in the '80s.
A promoter named Buddy Marcelle (Russell Hornsby) sees potential in a Creed/Drago showdown and begins to pull Adonis' strings. It isn't hard to manipulate the young champ into a fight; after all, it was Ivan who killed his father, Apollo Creed (Carl Weathers), in what was supposed to be an exhibition match. Rocky advises against the fight, but of course, Adonis doesn't listen. Again, it's not hard to guess what comes next: hubris, a defeat, an epic training montage, a bloody grand finale in Russia.
The first Creed owed a lot of its success to Ryan Coogler, and with the wunderkind writer-director otherwise engaged in a little film called Black Panther, there was some question as to whether Creed II could capture the same magic as its predecessor. It doesn't quite get there, but new director Steven Caple Jr. is no slouch, putting his own touches on the saga while keeping things consistent. Like its predecessors, Creed II takes a new look at the pugilistic hero's journey, tweaks it just enough to find some new terrain, and ultimately builds to an enjoyable, tried-and-true climax.
Within the larger framework there's also a strong series of paternal subplots. Creed II mirrors Rocky II with an unexpected pregnancy, and though it's a derivative plot point, it ties together all three families (Balboa, Creed, Drago) and helps each story achieve a nice resolution. Part of me wanted to see Adonis say, "You know what, my dad was murdered in the boxing ring. I almost got murdered by Viktor in the first fight. There are more important things than boxing, and I want to be here for my child," before turning and walking away. Of course, it's a Rocky movie, not an existential indie drama, so that wasn't going to happen, but it would have been a memorable twist.
With Creed II we've got another solid entry into the Rockyverse, and a good feeling going into the inevitable Creed III. Since the movie's release, Stallone all but flat-out stated that this will be the last appearance of Rocky Balboa. It's hard to take Sly at his word given his history with both Rocky and Rambo—but if this is the end, we do get a nice sense of closure for a character that truly affected American culture.
Either way, it's Creed's time now.
Rocky II
Director: Steven Caple Jr.
Starring: Michael B. Jordan, Sylvester Stallone, Tessa Thompson
Theater: Now showing, area theaters
CityPages Movies
More from Movies
Star Wars Episodes 4-6 July 10 by Jessica Armbruster
Trash Film Debauchery: Showgirls July 9 by Jessica Armbruster


text:
Published on novembre 2, 2022
Chelsea's Aubameyang has much to prove against Arsenal
It looked at one stage as though Pierre-Emerick Aubameyang would become the talisman of Mikel Arteta's Arsenal, yet now he is the symbol of a dysfunctional period the Gunners appear to be leaving behind.
Aubameyang signed a new three-year contract with Arsenal in September 2020 — worth an initial £250,000-a-week plus generous add-ons — with the aim of becoming « an Arsenal legend and to maybe leave a legacy. » He certainly left a legacy, although it is more complicated than anyone could have imagined back then.
Following a gradual deterioration in his relationship with Arteta, Aubameyang went from captain to castaway. He was punished, ostracised, and was then allowed to join Barcelona on a free transfer in February, where he spent six months before returning to London on the assumption he could play under one of his former bosses who still admired him, Thomas Tuchel, only for the German to be sacked by Chelsea six days later.
On Sunday, the Blues host Arsenal at Stamford Bridge with a 10-point gap between the two sides, meaning the 33-year-old will come face to face with Arteta and the team it was felt would grow better without him for the first time . The marks from that period are still visible. The tattoos certainly are. Such was the depth of feeling and the speed of transformation that this weekend will likely see Aubameyang line up wearing Chelsea's No. 9 shirt, with a tattoo on his right arm of himself (together with two his children) wearing Arsenal's No. 14.
– Stream on ESPN+: LaLiga, Bundesliga, MLS, more (US)
Even body art was a bone of contention by the end of his time at Arsenal. In February 2021, there were suggestions Aubameyang had broken COVID-19 rules by getting a tattoo on his hand, one of several disciplinary issues which gradually eroded his standing in the squad. Sources told ESPN at the time that there wasn't one big incident which prompted Arsenal to part with Aubameyang, more a series of minor breaches which undermined the professionalism Arteta was demanding from his squad.
Among the various misdemeanours, Aubameyang was reported to have missed a drug test, turned up late for multiple meetings and, as one source put it, regularly requested time away the group. Some of that was compassionate leave to visit his unwell mother, Margarita, but there was a view inside the club that he was not showing sufficient dedication while also risking COVID-19 complications related to his additional travel. He is generally viewed as a gregarious and popular character, although his flash cars and garish lifestyle can be divisive, especially for those who value humility and discipline.
Pierre-Emerick Aubameyang will face former side Arsenal for the first time since joining Chelsea. Roland Krivec/DeFodi Images via Getty Images
When it came to parting ways, Arteta was ruthless. Last December, Aubameyang was stripped of the captaincy, forced to train alone and eventually allowed to leave on a free transfer. Aubameyang was bitter. Footage leaked recently from his early days at Barcelona shows the 33-year-old delivering a withering assessment of Arteta.
« Big characters and big players…he can't deal with it, » Aubameyang said. « He needs some young players who don't say anything. »
Aubameyang has since distanced himself from those comments by claiming: « I still had a lot of bad feelings in me — Arsenal are doing great things this season and I wish all my old guys well, just not on Nov. 6. »
Allowing Aubamayeng to depart cam at a high price. Arsenal did not sign a replacement and with just Alexandre Lacazette and Eddie Nketiah to call on, the Gunners were short on firepower and just missed out on Champions League qualification.
Yet the club believed the longer-term cultural shift Arteta had implemented was worth the short-term risk and this season, following a summer of shrewd investment, that view is reaping dividends. Arsenal are top of the Premier League with Gabriel Jesus setting the tone for the Gunners in almost the opposite way to Aubameyang; often, the ex-Gabon international's contribution was a goal and little else, whereas Jesus presses relentlessly, generating space and chances for others through his relentless running and intelligent movement.
Jesus' seven-game goal drought is a concern but offset by his contribution to the rest of the team. Aubameyang's contribution was measured almost entirely in goals. He became the fastest player in Arsenal's history to reach 50 Premier League goals (in 79 games) and his clinical touch was crucial in winning the 2020 FA Cup, a key reason why he was handed such a lucrative contract later in the year. Yet after signing that deal, he scored 13 goals in 43 league games as his influence waned. This made it a little easier for some Arsenal fans to stomach Aubameyang's departure, but this weekend's clash gives the striker a chance to prove suggestions of his permanent decline were premature.
Things didn't end well between Arsenal manager Mikel Arteta and Pierre-Emerick Aubameyang. Photo by Marc Atkins/Getty Images
There was a debate at one time over whether Aubameyang would be revived playing through the middle as opposed to off the left wing, where he had been at his most effective for Arsenal, but Arteta was never fully sold on the idea. On Sunday, he will likely start as a centre-forward for Chelsea.
Aubameyang had hoped to work with Tuchel again could trigger a period of calm after a turbulent year. Tuchel had spoken glowingly of Aubameyang when in the midst of the row with Arteta, fondly remembering their relationship at Borussia Dortmund, where the striker scored 79 goals in 95 appearances until joining the Gunners in 2018.
New Chelsea boss Potter has also spoken glowingly of Aubameyang's attitude — particularly in reference to his recovery from a horrifying robbery at his family home in Barcelona which left him with a broken jaw — and has been mindful of his physical workload, dropping him to the bench for league games against Brentford and Brighton in the last fortnight. Aubameyang has just one league goal to his name for Chelsea — against Crystal Palace on Oct. 1 — and Potter will be seeking a response from his players after a chastening 4-1 defeat at his former club Brighton last weekend.
Aubameyang is the latest in a long and expensive line of forwards aiming to break the so-called « No. 9 curse » at Chelsea, which has seen Romelu Lukaku, Fernando Torres and Alvaro Morata, among others, underperform in recent years. Sources have told ESPN that Chelsea were keen on signing Aubameyang two years ago but Arsenal pulled out all the stops to retain him on that new deal. This weekend, Aubameyang has a chance to remind everyone why he was once so in demand.


text:
Home›Da'wah›National Da'wah›Public Meeting: Syria's Islamic Revolution and Egypt's Stolen Revolution
Public Meeting: Syria's Islamic Revolution and Egypt's Stolen Revolution
The Friday evening event held by Hizb-ut-Tahrir Britain on 20 September 2013 was attended by over 400 men and women, who heard lively talks and debate on the political crisis in the Middle East with a focus on Syria and Egypt.At the outset of the event, the Chair, Jamal Harwood, who is a lecturer in Finance and Economics and a regular commentator on Islamic political affairs, posed some interesting questions for the speakers: on Syria, what's the current state of the uprising, how should we see the divisions between the US and Russia and what does the future hold for the devastated country? On Egypt, the question most commentators are asking is does the arrest of Mohammad Morsi point to the failure and end of political Islam?
Ferdeous Ahmed, a regular speaker on Islamic political affairs and a management consultant, began by highlighting the significance of Bilad Ash-Sham, which includes the region of Syria, in Islamic texts. Ferdeous argued that the uprising in Syria is different from others in the region for its very Islamic nature, which the West has deceptively portrayed as extremist. Ferdeous warned that this as well as western portrayals of a sectarian conflict in Syria was politically motivated and incorrect. In reality the people of Syria had risen up against a tyrant ruler who had oppressed the masses for many years just like his father Hafez Assad in past decades. Ferdeous recalled the nature of Syria as a police state when he visited the country in the 1990s. On the apparent divisions between Russian and the US, Ferdeous argued these were delaying tactics by the so-called international powers so that they can conspire a Western-compliant political grouping in the country, which to date they have failed to do.
Mohammad Sajjad, a regular commentator, writer and analyst of political affairs in the Muslim world, gave a lively talk of the reasons for the failures of the Muslim Brotherhood Government in Egypt. He argued this had betrayed the sacrifices and sentiments of the people who had risen and called for Islam during the Egyptian upraising. Mohammad warned that the failure of the Muslim Brotherhood Government lay in working within the corrupted system which was little different from the Mubarak era. Thus the political failure of the Muslim Brotherhood was not a failure of political Islam at all. Mohammad presented examples of policies that should have been implemented to chart a truly independent and Islamic future for Egypt.
After a question and answer session Dr Abdul Wahid, Chair of the National Executive Committee, Hizb-ut-Tahrir Britain, gave a short presentation of what Muslims can do here to support the people working for real Islamic political change in the Middle East. He emphasised that our duas need to be accompanied by action, which was an intellectual struggle against the demonization of political Islam in the West. The event ended with duas.
UK niqab ban debate – Dr Nazreen ...
The American Foreign Policy Game in Syria
Invitation to Conference: Khilafah – Manifesto for Change
Demonstrators demand release of women Calling for Islam in Bangladesh
VIDEO & PICS: Middle East Uprisings – King Abdullah: Khadim of Haramain or Khadim of America?
Raymond Davis: Hizb ut-Tahrir leads Hundreds outside Pakistan High Commission London
London – National Campaign Launch Event : Know Muhammad (saw)
Open letter to the Pakistan government and its UK representative


First published in 1999, The Edge of Reason is the sequel to Helen Fielding's number one best-selling Bridget Jones's Diary. It has been turned into a film starring Renee Zellweger, Colin Firth and Hugh Grant. Bridget Jones: The Edge of Reason is followed by Bridget Jones: Mad About the Boy. The Wilderness Years are over! But not for long. At the end of Bridget Jones's Diary, Bridget hiccuped off into the sunset with man-of-her-dreams Mark Darcy. Now, in The Edge of Reason, she discovers what it is like when you have the man of your dreams actually in your flat and he hasn't done the washing-up, not just the whole of this week, but ever. Lurching through a morass of self-help-book theories and mad advice from Jude and Shazzer, struggling with a boyfriend-stealing ex-friend with thighs like a baby giraffe, an 8ft hole in the living-room wall, a mother obsessed with boiled-egg peelers, and a builder obsessed with large reservoir fish, Bridget embarks on a spiritual epiphany, which takes her from the cappuccino queues of Notting Hill to the palm- and magic-mushroom-kissed shores of . . . Bridget is back. V.g.


text:
Norton closed the door on a 16-year career as a teacher at a public high school to lead the Green Bay Area Catholic Education system's new classical school, set to open in 2016-17. On a recent July morning, Norton was arranging his temporary office and organizing papers as he begins a year of determining curriculum, hiring staff and attending to the details that come with his new title.
St. John Paul II Classical School will instruct pre-kindergartners to fourth-graders, with plans to add one grade per year to ultimately serve students through eighth grade. It will be housed in the St. Joseph School site on 12th Avenue.
"The goal is to have our school fall into the scholarly tradition the Catholic schools had at one time," Norton said. "We want education to serve as a bridge between faith and reason; a return to a system that's much more language based."
If it sounds old-school, it is. The idea is to reach back to use teaching methods formed centuries ago to train students in grammar, logic, critical thinking and intellectual debate, the new headmaster said. That includes plenty of memorization and Latin lessons.
Catechism, phonics, grammar, writing and math are emphasized in the earlier years, and later the foundations of Western civilization and American heritage are stressed, according to GRACE.
Critical thinking skills are based on the Greek philosophers, especially the Socratic method, which emphasizes the quest for objective truth.
Norton said he's long had an interest in the classical teaching method, and incorporated the system in some of his courses at Manitowoc High School, where he taught English and Advanced Placement English.
He and his wife Nancy have lived in Green Bay for 11 years and have three children, a daughter, 12; a son, 10; and another daughter, 8.
Also a member of St. Francis Xavier Catholic Cathedral, Norton was part of a parent committee that developed the idea of forming a classical school back in 2012.
The group eventually took the idea to Green Bay Catholic Diocese Bishop David Ricken and Rev. Dane Radecki, the then GRACE president. As plans rolled along, Norton said he began to think about the role of headmaster.
"It seemed like sort of a natural fit," he said. "I am a teacher who is familiar with classical training and am licensed to be a principal."
At the same time, he was satisfied and comfortable in his teaching role in Manitowoc.
"I don't have anything against public schools and left on completely good terms," Norton said. "I prayed a lot and spent time in personal reflection as I thought about it. I really felt I was called by the Holy Spirit to do this."
One of his first priorities is to hire a lead teacher. That teacher will help him develop curriculum and hire other teachers, Norton said.
Teachers likely will require some training in classical teaching methods, he said.
He also will keep busy setting up the school. Tuition, fees and fundraising goals will be consistent with other GRACE schools, and the school is accepting applications. Norton expects about 20 students per grade level the first year.
Norton said St. John Paul II school will not be part of the Wisconsin private school voucher program in 2016-17. The program allows families to use taxpayer dollars to help cover tuition costs at private or faith-based schools. The system was capped at 1,000 students statewide in Gov. Scott Walker's 2013-15 budget, but those limits are expected to be lifted in the 2015-17 state spending plan.
GRACE, the largest Catholic school system in Wisconsin, has nine schools — the new school will be the 10th.
"Bradley is an excellent fit for the role of headmaster," newly-appointed GRACE President Kim Desotell said in a written statement. "His educational training and leadership will create the desired environment intended for the classical school."
— pzarling@pressgazettemedia.com or follow her on Twitter @PGPattiZarling
ON THE NET
Visit https://gracesystem.org/ to learn more about GRACE or to register.


Wendy Williams' shamed husband, Kevin Hunter, is finally apologizing to the show star, days after new of his alleged affair and love child were exposed.
Wendy Williams' estranged husband Kevin Hunter will almost certainly step down from her show.
Former President of Peru Alan Garcia shot himself Wednesday when police came to arrest him at his home on charges of bribery.


We are a STAR certified smog check facility for the State of California. If the DMV requires a smog check for your vehicle, we can take care of you at our facility.
We smog diesels, hybrids and gasoline powered vehicles.
We have the latest version of diagnostic software for majority of vehicles. This enables us to test and perform high-end diagnostics on the latest vehicle models. The areas diagnosed include Engine, Airbags, ABS, Emission and Evaporation Control Systems. Check-Engine-Light diagnostics are crucial for cars that need to pass the smog inspection and are unable to do so due to the Check-Engine-Light being on.
#1 Auto Repair and Smog is an independent Repair and Smog facility in Campbell, California. We've earned a reputation for honesty, competency and for standing behind our work. We treat our customers the way we want to be treated – with courtesy and integrity.
Our mission is to get it right the first time, to provide you with an accurate diagnosis and estimate so you can make informed and affordable choices. We are a great alternative to the dealer as we hire ASE certified techs and provide repairs at an affordable price. We work on all makes and models and have over a decade of auto repair and diagnostic experience.
We also offer free wifi, shuttle service within 5miles and pickup/drop off.
I bought a second hand Mazda 3 and have it checked at this place. They are quick and efficient. I also get a $5 discount for oil change.
This was a good place to get a smog check. I only do once every two years, but they were fast, friendly and efficient. I would go here again!
I was there just getting gas and one of the mechanics noticed while at the pump that my front left tire needed air. When I looked down and saw how low my tire was, I knew instantly that this man saved me from either getting into a horrible accident on the highway or getting stuck on the side of the road.
Amar had me pull my car around and he filled up my tire and checked all my other tires as well just in case before he sent me on my way. He didn't expect anything in return. That's when you know you have good people working at this location. I wouldn't hesitate to return to this auto repair shop if I ever needed something in the future. Thank you so much for your help Amar!!!
I took my Mercedes GL bluetec diesel here for the A & B service. I dropped it off on Friday morning and it was done the next day just like it was promised.
They did inspection and noticed that the breaks needed to be services and took care of it, I'm glad I didn't have to waste time and come back again just to do the breaks.
We had the car back and took it for a road trip to San Diego for a weekend.
We saved a lot of money and got same service as a dealer for fraction of the cost. I'm definitely coming back for my future car needs.


Does anyone have any good ideas for a dish that would be friendly for young children and parents alike? Doesn't take more than an hour to prepare and doesn't break the bank either?
Here are some websites with raw food recipes. You'll find something good in one of these!
any whole fruit sorbet made with a juicer works, frozen fruit...yummy stuff... easiest one I can think of.
Take sorbet to a potluck?


Explore the Yorkshire Dales, made so famous by the James Herriot books, film and TV series, with a stay at Solberge Hall.
This offer includes VAT, is based on two people sharing a double or twin Classic room, and is subject to availability on selected dates. This offer cannot be used in conjunction with any other Classic Lodges's offer. Subsequent nights may be charged at a different tariff.


Specimen #2 (3" x 11-3/4" x 3-3/4") Over 7lbs. - 1pc.
Specimen #3 (7" x 3" x 2-1/4") Over 2.5lbs. - 1pc.
Black Onyx Natural Chunks (Brazil) - This Brazilian Black Onyx is being offered in its natural form as chunks. A powerful protection stone, Black Onyx absorbs and transforms negative energy, and helps to prevent the drain of personal energy. Black Onyx aids the development of emotional and physical strength and stamina, especially when support is needed during times of stress. Black Onyx fosters wise decision making.