DGA Detection: Find Algorithmically Generated Domains

A domain generation algorithm (DGA) lets malware calculate where to find its controller. Instead of embedding one command-and-control domain, the sample generates hundreds or thousands of candidates. The operator registers only a few; infected hosts test the list until one resolves.

Static blocklists can stop known candidates, but a durable detection program looks for the generation behavior itself. That requires DNS telemetry, endpoint context and reputation enrichment rather than a regular expression that labels every unusual hostname as malicious.

How DGA-Based C2 Works

MITRE ATT&CK documents DGAs as T1568.002. A typical algorithm combines a seed, date, counter and top-level domain. Different families produce different outputs:

• Character DGAs generate high-entropy labels that resemble gibberish.
• Dictionary DGAs combine normal words to appear more human.
• Time-based DGAs change the candidate list hourly, daily or monthly.
• Per-host DGAs include a machine-specific seed, limiting global prediction.

The defender’s challenge is asymmetric. Attackers need one registered domain to work; defenders must recognize the failed and successful lookups around it.

Build a Multi-Signal DGA Score

Useful features fall into four groups.

Lexical features

Measure label length, character distribution, consonant-to-vowel ratio, digit frequency, repeated n-grams and Shannon entropy. Compare against the organization’s normal domain population, not a generic internet average.

DNS features

Look for high NXDOMAIN ratios, bursts of unique names, synchronized requests across endpoints, newly observed domains and short-lived answers. A successful lookup immediately after many failures is especially valuable.

Endpoint features

Identify the process, parent process, signer and user that issued the query. A browser resolving many unique domains is less surprising than an unsigned binary in a temporary directory doing the same.

Intelligence features

Enrich resolved domains and IPs with registration age, ASN, historical resolutions, malware associations and reputation. Related infrastructure can turn a weak lexical anomaly into a high-confidence incident.

A Production Detection Pipeline

Collect resolver logs with endpoint identity and normalize the queried name to lowercase punycode. Aggregate by device and process over short windows. Compute lexical features, then join DNS outcomes and enrichment.

Route the result by confidence:

• high entropy plus high NXDOMAIN ratio plus suspicious process: escalate;
• word-like domains plus synchronized fleet-wide queries: investigate;
• random cloud storage or telemetry hostnames from an approved agent: suppress with an owned allowlist.

Use DNS history for the successful candidates and domain reputation for current risk. When a cluster contains many names, the bulk checker keeps triage consistent.

False Positives and Model Drift

CDNs, tracking systems, anti-fraud SDKs and cloud applications routinely generate opaque hostnames. Maintain allowlists by verified ownership and application, never by substring alone. Expire exceptions when the software is retired.

Dictionary DGAs create the opposite problem: they can look too normal for an entropy model. Combine lexical models with behavior, especially failed lookup sequences and process lineage. Retrain baselines after major SaaS, VPN or resolver changes, and compare model performance by business unit.

Responding to a Confirmed DGA

Block confirmed domains at the resolver and proxy, isolate the originating endpoint and acquire the responsible binary. Search historical DNS logs for earlier candidates from the same host. Reverse engineering may reveal the seed and future domain sequence, but containment should not wait for that work.

Pivot from each successful domain to its IP, ASN, certificate and co-hosted names. A single DGA alert can expose a larger C2 infrastructure and other infected endpoints.

Measure What Improves Detection

Track precision, endpoints found per incident, time from first algorithmic query to alert and the proportion of detections confirmed by endpoint evidence. Monitor the volume of allowlisted services and exceptions without an active owner.

Do not optimize only for the number of DGA domains blocked. The operational goal is to identify compromised devices before the command channel becomes productive.

Conclusion

DGA detection works when lexical analysis, DNS behavior, endpoint provenance and threat intelligence reinforce one another. Start from abnormal query sequences, validate successful candidates with domain and IP reputation, and preserve the surrounding failures: they are often the clearest fingerprint of the malware’s algorithm.