Most DNS security vendors either buy a black-box DGA feed or ship a multi-megabyte neural network. We chose a third path: a 280-line feature-based classifier that runs inline, explains every score, and costs essentially zero per query.
Why not a neural network?
Deep learning is seductive for DGA detection. LSTMs and Transformers can reach high accuracy on labeled corpora. But at resolver-side scale they bring three problems we couldn't accept:
- Opacity: when a SOC analyst asks why a domain was blocked, "the model said so" is not an acceptable answer.
- Cost: running inference per query adds latency and compute budget that grows with traffic.
- Drift: DGAs evolve quickly; retraining and redeploying a model is slower than tuning a few thresholds.
The feature set
Our classifier extracts interpretable signals from the second-level domain string:
- Shannon entropy: random-looking algorithmic domains score higher.
- N-gram frequency: we compare character pairs against a corpus of legitimate domains.
- Vowel ratio: human-readable names have more vowels than DGA output.
- Length and digit count: most DGAs use fixed-length alphanumeric strings.
- Consonant runs: long sequences of consonants are rare in real brand names.
// Simplified score combination
let score = entropy * 0.35
+ ngram_unlikelihood * 0.30
+ length_bias * 0.15
+ digit_ratio * 0.10
+ consonant_run * 0.10;
if (score > THRESHOLD) { flag_as_dga_suspect(); }
Making it tunable
Per-tenant thresholds let aggressive teams block at 0.75 while conservative teams wait for 0.95. Every flagged domain carries a JSON rationale so analysts can see the breakdown and tune accordingly.
Explainability is not a nice-to-have for DNS security. If you can't tell a customer why you blocked something, you shouldn't have blocked it.
Results so far
On our internal test set the classifier catches ~94% of known DGA families with a false-positive rate below 0.3% against top-1M benign domains. The model file is 12 KB. Inference time is sub-millisecond.