Detecting Algorithmically Generated Domains Using Entropy and Lexical Features

Detecting domain names generated by Domain Generation Algorithms (DGAs) is a key challenge in cybersecurity, as these domains are designed to appear unpredictable and evade standard filtering methods.This work proposes a lightweight and interpretable detection method that relies on lexical properties and entropy-based features derived from domain names.By analyzing character patterns and measuring randomness through Shannon entropy and relative entropy across bigrams, trigrams, and fourgrams, the method captures both structural and statistical differences between legitimate and algorithmic domains.Multiple machine learning classifiers were trained and evaluated, with the best results achieved using XGBoost and Random Forest.Entropy-based features were found to be highly influential in the classification process, highlighting their effectiveness in distinguishing algorithmically generated domains.The findings support the use of entropy as a practical and theoretically grounded feature for DGA detection.