DGA Hunter Detector
Binary DGA vs legitimate domain classifier by Aria AI.
Contents
| File | Description |
|---|---|
heuristic.json |
Always-on lexical entropy detector (demo-ready) |
vocab.json |
Character vocabulary for sequence models |
config.json |
Engine config + primary model |
train_metrics.json |
Evaluation metrics |
threshold.json |
Decision threshold |
*.keras |
TensorFlow/Keras deep models (after scripts/train_models.py) |
*.joblib |
Tabular baselines (after training) |
Quick inference (no GPU / no TF required)
from pathlib import Path
import sys
sys.path.insert(0, "src")
from dgahunter.pipeline import DGAHunterPipeline
pipe = DGAHunterPipeline(Path("model"))
print(pipe.analyze(["google.com", "ajdkslaoqwe.net", "xkqpyvjd.biz"]))
Full TensorFlow / Keras training
pip install -r requirements.txt
python scripts/bootstrap.py
Trains Logistic Regression, Random Forest, XGBoost, Char-CNN, BiLSTM, CNN-LSTM, and Transformer Encoder with tf.data, then re-exports this model repo.
Metrics
See train_metrics.json and the companion dataset eval_results.json for Macro F1, ROC-AUC, PR-AUC, family holdout recall, legitimate FPR, and latency.
Intended Use
- SOC / DNS security research demos
- Portfolio evaluation of TensorFlow-based DGA detection
- Not a standalone blocklist replacement
Limitations
- Trained on synthetic DGA simulators
- English / ASCII domains only
- May misclassify unusual but legitimate long brand domains
MIT License — Aria AI Engineering Team