# First Step Towards EXPLAINable DGA Multiclass Classification

arXiv: https://arxiv.org/abs/2106.12336 · HTML: https://mlsanity.com/paper/2106.12336/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Builds on 7 of its 32 references that are in the map.
- First posted on arXiv 23 Jun 2021.

## Builds on (most cited first, 7 of 7)

- [Character-level Convolutional Networks for Text Classification](https://mlsanity.com/paper/1509.01626/) (2015)
- [eXpose: A Character-Level Convolutional Neural Network with Embeddings For Detecting Malicious URLs, File Paths and Registry Keys](https://mlsanity.com/paper/1702.08568/) (2017)
- [Benchmarking Relief-Based Feature Selection Methods for Bioinformatics Data Mining](https://mlsanity.com/paper/1711.08477/) (2017)
- [Explaining Deep Learning Models - A Bayesian Non-parametric Approach](https://mlsanity.com/paper/1811.03422/) (2018)
- [Predicting Domain Generation Algorithms with Long Short-Term Memory Networks](https://mlsanity.com/paper/1611.00791/) (2016)
- [Analyzing the Real-World Applicability of DGA Classifiers](https://mlsanity.com/paper/2006.11103/) (2020)
- [Making Use of NXt to Nothing: The Effect of Class Imbalances on DGA Detection Classifiers](https://mlsanity.com/paper/2007.00300/) (2020)

## Built on by (most cited first, 4 of 4)

- [False Sense of Security: Leveraging XAI to Analyze the Reasoning and True Performance of Context-less DGA Classifiers](https://mlsanity.com/paper/2307.04358/) (2023)
- [Explaining Machine Learning DGA Detectors from DNS Traffic Data](https://mlsanity.com/paper/2208.05285/) (2022)
- [Explainable Artificial Intelligence and Cybersecurity: A Systematic Literature Review](https://mlsanity.com/paper/2303.01259/) (2023)
- [Towards Robust Domain Generation Algorithm Classification](https://mlsanity.com/paper/2404.06236/) (2024)

## Abstract (arXiv)

Numerous malware families rely on domain generation algorithms (DGAs) to establish a connection to their command and control (C2) server. Counteracting DGAs, several machine learning classifiers have been proposed enabling the identification of the DGA that generated a specific domain name and thus triggering targeted remediation measures. However, the proposed state-of-the-art classifiers are based on deep learning models. The black box nature of these makes it difficult to evaluate their reasoning. The resulting lack of confidence makes the utilization of such models impracticable. In this paper, we propose EXPLAIN, a feature-based and contextless DGA multiclass classifier. We comparatively evaluate several combinations of feature sets and hyperparameters for our approach against several state-of-the-art classifiers in a unified setting on the same real-world data. Our classifier achieves competitive results, is real-time capable, and its predictions are easier to trace back to features than the predictions made by the DGA multiclass classifiers proposed in related work.