| --- |
| language: en |
| tags: |
| - dga |
| - cybersecurity |
| - domain-generation-algorithm |
| - text-classification |
| - pytorch |
| license: mit |
| --- |
| |
| # DGA-Bilbo: CNN + LSTM for DGA Detection |
|
|
| Parallel CNN + LSTM architecture (Higham et al. 2021) trained on 54 DGA families. |
| Part of the **DGA Multi-Family Benchmark** (Reynier et al., 2026). |
|
|
| ## Model Description |
|
|
| - **Architecture:** Parallel CNN (filters 2–6, 60 each) + LSTM(256) → ANN(100) → sigmoid |
| - **Input:** Character-level encoding, left-padded to 75 chars |
| - **Output:** Binary classification — `legit` (0) or `dga` (1) |
| - **Framework:** PyTorch |
| - **Reference:** Higham et al., 2021 |
|
|
| ## Performance (54 DGA families, 30 runs each) |
|
|
| | Metric | Value | |
| |-----------|--------| |
| | Accuracy | 0.9207 | |
| | F1 | 0.8999 | |
| | Precision | 0.9303 | |
| | Recall | 0.8954 | |
| | FPR | 0.0540 | |
| | Query Time| 0.078 ms/domain (CPU) | |
|
|
| ## Usage |
|
|
| ```python |
| from huggingface_hub import hf_hub_download |
| import importlib.util, torch |
| |
| weights = hf_hub_download("Reynier/dga-bilbo", "bilbo_best.pth") |
| model_py = hf_hub_download("Reynier/dga-bilbo", "model.py") |
| |
| spec = importlib.util.spec_from_file_location("bilbo_model", model_py) |
| mod = importlib.util.module_from_spec(spec) |
| spec.loader.exec_module(mod) |
| |
| model = mod.load_model(weights) |
| results = mod.predict(model, ["google.com", "xkr3f9mq.ru"]) |
| print(results) |
| ``` |
|
|
| ## Citation |
|
|
| ```bibtex |
| @article{reynier2026dga, |
| title={DGA Multi-Family Benchmark: Comparing Classical and Transformer-based Detectors}, |
| author={Reynier et al.}, |
| year={2026} |
| } |
| ``` |
|
|
