Beyond Pattern Matching: A Cognitive-Driven Framework for DGA Detection via Dual-Perspective Anomaly Perception

Domain Generation Algorithms (DGAs) pose a persistent threat by enabling malware to dynamically generate numerous command-and-control domains, evading traditional blocklists. While machine learning-based detectors have achieved high accuracy, they operate as statistical pattern matchers and lack the human-like anomaly perception that enables security experts to intuitively recognize unnatural domains. This paper introduces CogNormDGA, a cognitive-driven framework that models normal domain characteristics from a defender’s perspective while also anticipating how attackers might exploit cognitive blind spots. Inspired by dual-process theory, CogNormDGA combines intuitive, pattern-based screening (System 1) with analytical, rule-based evaluation of phonotactic, morphological, and semantic violations (System 2). The cognitive principles of System 1 and System 2 are computationally realized as two distinct pathways: an Attentional Salience Network and a Linguistic Constraint Evaluator, respectively. The framework produces interpretable outputs via attention saliency maps and cognitive violation reports. Extensive experiments on 400,000 domains spanning 33 DGA families demonstrate that CogNormDGA achieves competitive detection performance (F1-score 0.941) while establishing a cognitive-driven detection paradigm that produces human-aligned explanations—a property critical for practical security. It shows promising results on low-entropy and novel DGA families. Human subject studies confirm strong alignment between the model’s internal explanations and expert reasoning. Furthermore, CogNormDGA is particularly effective against low-entropy DGA families that exploit cognitive blind spots. By bridging cognitive science and cybersecurity, our work offers an interpretable and human-aligned approach to threat detection, with promising resilience that requires further validation.