A Novel Approach to DGA Detection Combining Machine Learning and Transformer-Based Techniques

Detecting Domain Generation Algorithms (DGA) is a critical challenge in cybersecurity for identifying malicious domains. This paper proposes a comprehensive approach to DGA detection by first applying traditional supervised ML techniques, followed by advanced DL models. The dataset comprises domain names, host information, and subclass labels, with domain names used as the primary feature for classification. Domain names are preprocessed and transformed into feature vectors using feature hashing. Various supervised ML classifiers, including Random Forest, SVM, Logistic Regression, and Gradient Boosting, are employed to classify domains as either DGA or non-DGA. To further enhance classification performance, the BERT transformer model, adapted to analyze domain names as sequences of characters, is combined with RNN, LSTM networks. This hybrid BERT and deep learning models captures both intricate sequential patterns and long-term dependencies in domain names, offering a more robust detection of DGA behaviors. Rigorous experiments compare the effectiveness of traditional ML models and the BERT and DL approaches, providing insights into the strengths of combining both classic and advanced methodologies for superior DGA detection.