Therefore, the model without spelling features fails to identify those low frequency IOCs for the lack of context information, while the proposed model correctly identifies those IOCs using spelling features as extra information.
model with hand-crafted spelling features may cause more extraction of false positives, i.e., tokens that have similar to IOCs but are not malicious.