dga-hunter-detector

DGA Hunter Detector

Binary DGA vs legitimate domain classifier by Aria AI.

Contents

Quick inference (no GPU / no TF required)

from pathlib import Path
import sys
sys.path.insert(0, "src")
from dgahunter.pipeline import DGAHunterPipeline

pipe = DGAHunterPipeline(Path("model"))
print(pipe.analyze(["google.com", "ajdkslaoqwe.net", "xkqpyvjd.biz"]))

Full TensorFlow / Keras training

pip install -r requirements.txt
python scripts/bootstrap.py

Trains Logistic Regression, Random Forest, XGBoost, Char-CNN, BiLSTM, CNN-LSTM, and Transformer Encoder with tf.data, then re-exports this model repo.

Metrics

See train_metrics.json and the companion dataset eval_results.json for Macro F1, ROC-AUC, PR-AUC, family holdout recall, legitimate FPR, and latency.

Intended Use

• SOC / DNS security research demos
• Portfolio evaluation of TensorFlow-based DGA detection
• Not a standalone blocklist replacement

Limitations

• Trained on synthetic DGA simulators
• English / ASCII domains only
• May misclassify unusual but legitimate long brand domains

MIT License — Aria AI Engineering Team