# Real-Time Detection of Dictionary DGA Network Traffic using Deep Learning

arXiv: https://arxiv.org/abs/2003.12805 · HTML: https://mlsanity.com/paper/2003.12805/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 28 Mar 2020.

## Built on by (most cited first, 3 of 3)

- [Augmenting Parameter-Efficient Pre-trained Language Models with Large Language Models](https://mlsanity.com/paper/2602.02501/) (2026)
- [Gravity Falls: A Comparative Analysis of Domain-Generation Algorithm (DGA) Detection Methods for Mobile Device Spearphishing](https://mlsanity.com/paper/2603.03270/) (2026)
- [DRIFT: Drift-Resilient Invariant-Feature Transformer for DGA Detection](https://mlsanity.com/paper/2605.10436/) (2026)

## Abstract (arXiv)

Botnets and malware continue to avoid detection by static rules engines when using domain generation algorithms (DGAs) for callouts to unique, dynamically generated web addresses. Common DGA detection techniques fail to reliably detect DGA variants that combine random dictionary words to create domain names that closely mirror legitimate domains. To combat this, we created a novel hybrid neural network, Bilbo the `bagging` model, that analyses domains and scores the likelihood they are generated by such algorithms and therefore are potentially malicious. Bilbo is the first parallel usage of a convolutional neural network (CNN) and a long short-term memory (LSTM) network for DGA detection. Our unique architecture is found to be the most consistent in performance in terms of AUC, F1 score, and accuracy when generalising across different dictionary DGA classification tasks compared to current state-of-the-art deep learning architectures. We validate using reverse-engineered dictionary DGA domains and detail our real-time implementation strategy for scoring real-world network logs within a large financial enterprise. In four hours of actual network traffic, the model discovered at least five potential command-and-control networks that commercial vendor tools did not flag.