# Automatic Detection of Malware-Generated Domains with Recurrent Neural Models

arXiv: https://arxiv.org/abs/1709.07102 · HTML: https://mlsanity.com/paper/1709.07102/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 20 Sep 2017.

## Built on by (most cited first, 3 of 3)

- [Artificial Neural Network for Cybersecurity: A Comprehensive Review](https://mlsanity.com/paper/2107.01185/) (2021)
- [Improving DGA-Based Malicious Domain Classifiers for Malware Defense with Adversarial Machine Learning](https://mlsanity.com/paper/2101.00521/) (2021)
- [Augmenting Parameter-Efficient Pre-trained Language Models with Large Language Models](https://mlsanity.com/paper/2602.02501/) (2026)

## Abstract (arXiv)

Modern malware families often rely on domain-generation algorithms (DGAs) to determine rendezvous points to their command-and-control server. Traditional defence strategies (such as blacklisting domains or IP addresses) are inadequate against such techniques due to the large and continuously changing list of domains produced by these algorithms. This paper demonstrates that a machine learning approach based on recurrent neural networks is able to detect domain names generated by DGAs with high precision. The neural models are estimated on a large training set of domains generated by various malwares. Experimental results show that this data-driven approach can detect malware-generated domain names with a F_1 score of 0.971. To put it differently, the model can automatically detect 93 % of malware-generated domain names for a false positive rate of 1:100.