CDAR-GNN: A Robust and Transferable Graph Neural Network for Malicious Domain Detection

Malicious domain detection plays a critical role in defending against phishing, botnets, and command-and-control (C&C) infrastructure. The dynamic and evasive nature of such domains makes traditional rule-based methods insufficient in modern network environments. Recent advances in graph-based learning have shown potential for capturing structural and behavioral patterns in DNS traffic, but most existing models assume static data distributions and clean graph structures, limiting their robustness and generalizability in practical deployments. To address these challenges, we propose CDAR-GNN, a Cross-Domain Adversarially-Robust Graph Neural Network tailored for malicious domain detection. Our framework integrates domain adversarial training with structural perturbation simulation to jointly enhance transferability and resilience against manipulated graphs. CDAR-GNN operates on heterogeneous DNS graphs composed of domain and IP entities linked through multiple real-world resolution patterns, enabling expressive yet lightweight modeling of DNS behaviors. Experimental results on two large-scale datasets demonstrate that our model significantly improves detection accuracy and robustness under cross-domain and adversarial conditions.