# DeepDGA: Adversarially-Tuned Domain Generation and Detection

arXiv: https://arxiv.org/abs/1610.01969 · HTML: https://mlsanity.com/paper/1610.01969/

## Key facts

- Cited by 14 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 6 Oct 2016.

## Built on by (most cited first, 14 of 14)

- [Explainable Intrusion Detection Systems (X-IDS): A Survey of Current Methods, Challenges, and Opportunities](https://mlsanity.com/paper/2207.06236/) (2022)
- [The Role of Machine Learning in Cybersecurity](https://mlsanity.com/paper/2206.09707/) (2022)
- [Frontier AI's Impact on the Cybersecurity Landscape](https://mlsanity.com/paper/2504.05408/) (2025)
- [Impacts and Risk of Generative AI Technology on Cyber Defense](https://mlsanity.com/paper/2306.13033/) (2023)
- [Mitigating Adversarial Gray-Box Attacks Against Phishing Detectors](https://mlsanity.com/paper/2212.05380/) (2022)
- [DomURLs_BERT: Pre-trained BERT-based Model for Malicious Domains and URLs Detection and Classification](https://mlsanity.com/paper/2409.09143/) (2024)
- [SoK: On the Offensive Potential of AI](https://mlsanity.com/paper/2412.18442/) (2024)
- [Artificial Neural Network for Cybersecurity: A Comprehensive Review](https://mlsanity.com/paper/2107.01185/) (2021)
- [Improving DGA-Based Malicious Domain Classifiers for Malware Defense with Adversarial Machine Learning](https://mlsanity.com/paper/2101.00521/) (2021)
- [False Sense of Security: Leveraging XAI to Analyze the Reasoning and True Performance of Context-less DGA Classifiers](https://mlsanity.com/paper/2307.04358/) (2023)
- [Reinforcement Learning for an Efficient and Effective Malware Investigation during Cyber Incident Response](https://mlsanity.com/paper/2408.01999/) (2024)
- [AI Total: Analyzing Security ML Models with Imperfect Data in Production](https://mlsanity.com/paper/2110.07028/) (2021)
- [Detecting Algorithmically Generated Domains Using a GCNN-LSTM Hybrid Neural Network](https://mlsanity.com/paper/2208.03445/) (2022)
- [Towards Robust Domain Generation Algorithm Classification](https://mlsanity.com/paper/2404.06236/) (2024)

## Abstract (arXiv)

Many malware families utilize domain generation algorithms (DGAs) to establish command and control (C&C) connections. While there are many methods to pseudorandomly generate domains, we focus in this paper on detecting (and generating) domains on a per-domain basis which provides a simple and flexible means to detect known DGA families. Recent machine learning approaches to DGA detection have been successful on fairly simplistic DGAs, many of which produce names of fixed length. However, models trained on limited datasets are somewhat blind to new DGA variants. In this paper, we leverage the concept of generative adversarial networks to construct a deep learning based DGA that is designed to intentionally bypass a deep learning based detector. In a series of adversarial rounds, the generator learns to generate domain names that are increasingly more difficult to detect. In turn, a detector model updates its parameters to compensate for the adversarially generated domains. We test the hypothesis of whether adversarially generated domains may be used to augment training sets in order to harden other machine learning models against yet-to-be-observed DGAs. We detail solutions to several challenges in training this character-based generative adversarial network (GAN). In particular, our deep learning architecture begins as a domain name auto-encoder (encoder + decoder) trained on domains in the Alexa one million. Then the encoder and decoder are reassembled competitively in a generative adversarial network (detector + generator), with novel neural architectures and training strategies to improve convergence.