# Predicting Domain Generation Algorithms with Long Short-Term Memory Networks

arXiv: https://arxiv.org/abs/1611.00791 · HTML: https://mlsanity.com/paper/1611.00791/

## Key facts

- Cited by 13 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 2 Nov 2016.

## Built on by (most cited first, 13 of 13)

- [First Step Towards EXPLAINable DGA Multiclass Classification](https://mlsanity.com/paper/2106.12336/) (2021)
- [Artificial Neural Network for Cybersecurity: A Comprehensive Review](https://mlsanity.com/paper/2107.01185/) (2021)
- [Improving DGA-Based Malicious Domain Classifiers for Malware Defense with Adversarial Machine Learning](https://mlsanity.com/paper/2101.00521/) (2021)
- [False Sense of Security: Leveraging XAI to Analyze the Reasoning and True Performance of Context-less DGA Classifiers](https://mlsanity.com/paper/2307.04358/) (2023)
- [Privacy Protection of Grid Users Data with Blockchain and Adversarial Machine Learning](https://mlsanity.com/paper/2101.06308/) (2021)
- [The More, the Better? A Study on Collaborative Machine Learning for DGA Detection](https://mlsanity.com/paper/2109.11830/) (2021)
- [LLMs for Domain Generation Algorithm Detection](https://mlsanity.com/paper/2411.03307/) (2024)
- [Finding Phish in a Haystack: A Pipeline for Phishing Classification on Certificate Transparency Logs](https://mlsanity.com/paper/2106.12343/) (2021)
- [Sharing FANCI Features: A Privacy Analysis of Feature Extraction for DGA Detection](https://mlsanity.com/paper/2110.05849/) (2021)
- [Detecting Unknown DGAs without Context Information](https://mlsanity.com/paper/2205.14940/) (2022)
- [Open SESAME: Fighting Botnets with Seed Reconstructions of Domain Generation Algorithms](https://mlsanity.com/paper/2301.05048/) (2023)
- [Towards Robust Domain Generation Algorithm Classification](https://mlsanity.com/paper/2404.06236/) (2024)
- [DRIFT: Drift-Resilient Invariant-Feature Transformer for DGA Detection](https://mlsanity.com/paper/2605.10436/) (2026)

## Abstract (arXiv)

Various families of malware use domain generation algorithms (DGAs) to generate a large number of pseudo-random domain names to connect to a command and control (C&C) server. In order to block DGA C&C traffic, security organizations must first discover the algorithm by reverse engineering malware samples, then generating a list of domains for a given seed. The domains are then either preregistered or published in a DNS blacklist. This process is not only tedious, but can be readily circumvented by malware authors using a large number of seeds in algorithms with multivariate recurrence properties (e.g., banjori) or by using a dynamic list of seeds (e.g., bedep). Another technique to stop malware from using DGAs is to intercept DNS queries on a network and predict whether domains are DGA generated. Such a technique will alert network administrators to the presence of malware on their networks. In addition, if the predictor can also accurately predict the family of DGAs, then network administrators can also be alerted to the type of malware that is on their networks. This paper presents a DGA classifier that leverages long short-term memory (LSTM) networks to predict DGAs and their respective families without the need for a priori feature extraction. Results are significantly better than state-of-the-art techniques, providing 0.9993 area under the receiver operating characteristic curve for binary classification and a micro-averaged F1 score of 0.9906. In other terms, the LSTM technique can provide a 90% detection rate with a 1:10000 false positive (FP) rate---a twenty times FP improvement over comparable methods. Experiments in this paper are run on open datasets and code snippets are provided to reproduce the results.