[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-122512-en":3,"doc-seo-122512-105":30,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":27,"seo_description":14,"update_tm":28,"read_time":29},122512,687197207919,"Theodora","https://ap-avatar.wpscdn.com/avatar/a000253d6f5f7c60be?x-image-process=image/resize,m_fixed,w_180,h_180&k=1779446848396160552",6,"Technology","Enhancing DGA Detection with Machine Learning Algorithms","The domain generation algorithm (DGA) is a widely used malware technique for establishing reliable command-and-control (C&C) communication. By producing pseudo-random domain names, DGAs help attackers evade security controls and keep infected devices operational. This work proposes a two-pronged detection approach for character-based and word-based DGA domains. Character-based detection leverages seven classical machine learning methods with feature extraction from domain strings plus feature selection. Word-based detection uses CNN and LSTM models trained on word embeddings, achieving specialized high-performing classifiers.","Enhancing DGA Detection with Machine Learning Algorithms  \nHubert Biros and Mirosław Kantor  \nAGH University of Krakow, Kraków, Poland  \n[https://doi.org/10.26636/jtit.2025.FITCE2024.2033](https://doi.org/10.26636/jtit.2025.FITCE2024.2033)  \nAbstract 􀂶 The domain generation algorithm (DGA) is a popular technique used by malware to reliably establish a connection to a command and control (C&C) server. Pseudo-random domain names generated by DGA are used to bypass security measures and allow attackers to maintain control over malwareinfected devices. In this work, we present a two-pronged approach to detecting character-based and word-based DGA domain names, creating classifiers specifically tailored to each type. For character-based DGA detection, we employed seven traditional machine learning methods: support vector machine, extremely randomized trees, logistic regression, Gaussian naive Bayes, nearest centroid, random forests, and k-nearest neighbors. We applied a featureful approach, using features extracted from the domain names themselves. Some of these features were drawn from existing literature, while others were newly proposed by authors. Feature selection techniques were used to retain only the best-performing ones. For the more complex task of detecting word-based DGA domain names, we used CNN and LSTM models, relying solely on word embeddings derived from the domain name components. Performance evaluation shows that proposed method gives high-performing, specialized DGA classifiers, which can be combined to create a more general-purpose classifier.  \nKeywords 􀂶 character-based DGA, cybersecurity, DGA detection, DNS, machine learning-based DGA detection, malware, wordbased DGA  \n1. Introduction  \nThe domain name system (DNS) is a critical part of Internet infrastructure, translating human-readable domain names into machine-readable IP addresses. As the Internet evolves, securing the DNS against emerging threats becomes increasingly challenging. One common threat is the abuse of DNS through domain generation algorithms (DGAs), which malware uses to bypass security measures.  \nDevices infected by the malware, such as botnets or ransomware, need a reliable way to establish a connection with the command and control server (C&C) [1]–[3] . C&C plays a key role in operating malware-infected devices, allowing attackers to control victim machines and extract from them sensitive and valuable data [1] . Infected devices need a way to get the address of their C&C servers. Hard-coding the IP addresses or the domain names of these in the malware source code, is not a good solution, since once those are found by some security intelligence, blacklists can be created to shutdown the operation of the malware [4], [5] . Instead, some  \ntechnique must be used by malware creators in order to easily relocate the C&C server to a different location in case of take-down of the working C&C server [3] .  \nDGAis a popular technique used to establish a communication channel between infected devices and C&C servers [5] . For instance, many of the top 10 most popular financial malware families in the year 2023 were employed with some variant of DGA [6] . DGA is basically a piece of code that generates a large number of pseudo-random domain names that infected devices try to resolve tothe address of the C&C server. In order to generate different sets of domains every time period, DGA typically uses some kind of seed in the form of a numerical hard-coded value or some time-dependent number [7], [8] . The key idea behind DGA is that malware operators having the same DGA algorithm and seed can register some of the generated domains and allow infected machines to connect with C&C server [8] .  \nThe process of using DGA is illustrated in Fig. 1, where the hacker or person who is put in charge of the infected devices uses the DGA algorithm implemented in the malware along with the particular seed to generate a set of domain names from which he selects on","cbCairPymfmyCZ5j","https://ap.wps.com/l/cbCairPymfmyCZ5j","pdf",573742,1,14,"English","en",105,"# Introduction\n## Domain Generation Algorithms (DGAs) and C&C Communication\n## Proposed Detection Approach\n# Method Overview\n## Character-based DGA Detection\n## Word-based DGA Detection\n# Performance Evaluation\n## Combining Specialized Classifiers\n# Paper Organization","[{\"question\":\"What problem do the proposed models address in DGA-based malware?\",\"answer\":\"They detect DGA-generated domains used by malware to reach command-and-control servers, including both character-based and word-based domain generation patterns.\"},{\"question\":\"How is character-based DGA detection performed in this work?\",\"answer\":\"Seven traditional machine learning methods are applied with features extracted directly from domain names, and feature selection keeps only the best-performing ones.\"},{\"question\":\"How are word-based DGA domains detected?\",\"answer\":\"CNN and LSTM models are used, relying solely on word embeddings derived from the components of the domain name.\"}]","Enhancing DGA Detection with Machine Learning Algorithms | PDF",1785811021,35,{"code":4,"msg":31,"data":32},"ok",{"site_id":24,"language":23,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":28},"enhancing-dga-detection-with-machine-learning-algorithms","",{"@graph":36,"@context":85},[37,54,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/technology/",3,{"item":52,"name":13,"@type":43,"position":53},"https://docshare.wps.com/document/enhancing-dga-detection-with-machine-learning-algorithms/122512/",4,{"url":52,"name":13,"@type":55,"author":56,"headline":13,"publisher":58,"fileFormat":61,"inLanguage":23,"description":14,"dateModified":62,"datePublished":62,"encodingFormat":61,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":57},"Person",{"url":41,"name":59,"@type":60},"DocShare","Organization","application/pdf","2026-08-04",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What problem do the proposed models address in DGA-based malware?","Question",{"text":75,"@type":76},"They detect DGA-generated domains used by malware to reach command-and-control servers, including both character-based and word-based domain generation patterns.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"How is character-based DGA detection performed in this work?",{"text":80,"@type":76},"Seven traditional machine learning methods are applied with features extracted directly from domain names, and feature selection keeps only the best-performing ones.",{"name":82,"@type":73,"acceptedAnswer":83},"How are word-based DGA domains detected?",{"text":84,"@type":76},"CNN and LSTM models are used, relying solely on word embeddings derived from the components of the domain name.","https://schema.org",{"og:url":52,"og:type":87,"og:title":13,"og:site_name":59,"og:description":14},"article",{"robots":89,"canonical":52},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,113,118,123,128,131,135],{"id":20,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":53,"doc_module":4,"doc_module_name":46,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":111,"slug":112},50,"technology",{"id":114,"doc_module":4,"doc_module_name":46,"category_name":115,"show_sort_weight":116,"slug":117},7,"Healthcare",40,"healthcare",{"id":119,"doc_module":4,"doc_module_name":46,"category_name":120,"show_sort_weight":121,"slug":122},8,"Research & Report",30,"research-report",{"id":124,"doc_module":4,"doc_module_name":46,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":46,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":46,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":46,"category_name":137,"show_sort_weight":106,"slug":138},19,"General","general"]