<![CDATA[Domain Generation Algorithm (DGA) is a mechanism used by malware to algorithmically generate domain names as candidate destinations for communication with command and control servers. Domain string characteristics can be used to distinguish algorithmically generated domains from legitimate domains. This study aims to identify DGA domains based on string characteristics using Random Forest and evaluate its performance against DGA families not observed during training. The dataset consists of 20,000 balanced domains, comprising 10,000 DGA domains from 52 families and 10,000 legitimate domains. A total of 21 features were extracted, including domain length, name length, character counts and ratios, unique character counts, domain structure, and Shannon entropy. Evaluation was conducted using Random Stratified Split and Unseen Family Split. Random Stratified Split achieved 91.83% accuracy, 92.14% precision, 91.45% recall, and 91.79% F1-score. Unseen Family Split achieved 85.55% accuracy, 91.47% precision, 78.41% recall, and 84.44% F1-score. The results indicate a change in classification performance when the model encounters unseen DGA families. Feature importance identified name length and the ratio of name length to domain length as the two most important features. The findings provide an evaluation basis for DGA classification under unseen-family conditions.]]>
Copyrights © 2026
