DGA-Bilbo: CNN + LSTM for DGA Detection

Parallel CNN + LSTM architecture (Higham et al. 2021) trained on 54 DGA families. Part of the DGA Multi-Family Benchmark (Reynier et al., 2026).

Model Description

• Architecture: Parallel CNN (filters 2–6, 60 each) + LSTM(256) → ANN(100) → sigmoid
• Input: Character-level encoding, left-padded to 75 chars
• Output: Binary classification — legit (0) or dga (1)
• Framework: PyTorch
• Reference: Higham et al., 2021

Performance (54 DGA families, 30 runs each)

Metric	Value
Accuracy	0.9207
F1	0.8999
Precision	0.9303
Recall	0.8954
FPR	0.0540
Query Time	0.078 ms/domain (CPU)

Usage

from huggingface_hub import hf_hub_download
import importlib.util, torch

weights = hf_hub_download("Reynier/dga-bilbo", "bilbo_best.pth")
model_py = hf_hub_download("Reynier/dga-bilbo", "model.py")

spec = importlib.util.spec_from_file_location("bilbo_model", model_py)
mod = importlib.util.module_from_spec(spec)
spec.loader.exec_module(mod)

model = mod.load_model(weights)
results = mod.predict(model, ["google.com", "xkr3f9mq.ru"])
print(results)

Citation

@article{reynier2026dga,
  title={DGA Multi-Family Benchmark: Comparing Classical and Transformer-based Detectors},
  author={Reynier et al.},
  year={2026}
}