| --- |
| language: en |
| tags: |
| - dga |
| - cybersecurity |
| - domain-generation-algorithm |
| - text-classification |
| - pytorch |
| license: mit |
| --- |
| |
| # DGA-BiLSTM: Bidirectional LSTM + Self-Attention for DGA Detection |
|
|
| BiLSTM with Self-Attention (Namgung et al. 2021) trained on 54 DGA families. |
| Part of the **DGA Multi-Family Benchmark** (Reynier et al., 2026). |
|
|
| ## Model Description |
|
|
| - **Architecture:** Embedding → BiLSTM(128×2) → Self-Attention → FC(64) → sigmoid |
| - **Input:** Character-level encoding, right-padded to 75 chars |
| - **Output:** Binary classification — `legit` (0) or `dga` (1) |
| - **Framework:** PyTorch |
| - **Reference:** Namgung et al., Security and Communication Networks, 2021 |
|
|
| ## Performance (54 DGA families, 30 runs each) |
|
|
| | Metric | Value | |
| |-----------|--------| |
| | Accuracy | 0.8916 | |
| | F1 | 0.8556 | |
| | Precision | 0.9134 | |
| | Recall | 0.8433 | |
| | FPR | 0.0600 | |
| | Query Time| 0.067 ms/domain (CPU) | |
|
|
| ## Usage |
|
|
| ```python |
| from huggingface_hub import hf_hub_download |
| import importlib.util, torch |
| |
| weights = hf_hub_download("Reynier/dga-bilstm", "bilstm_best.pth") |
| model_py = hf_hub_download("Reynier/dga-bilstm", "model.py") |
| |
| spec = importlib.util.spec_from_file_location("bilstm_model", model_py) |
| mod = importlib.util.module_from_spec(spec) |
| spec.loader.exec_module(mod) |
| |
| model = mod.load_model(weights) |
| results = mod.predict(model, ["google.com", "xkr3f9mq.ru"]) |
| print(results) |
| ``` |
|
|
| ## Citation |
|
|
| ```bibtex |
| @article{reynier2026dga, |
| title={DGA Multi-Family Benchmark: Comparing Classical and Transformer-based Detectors}, |
| author={Reynier et al.}, |
| year={2026} |
| } |
| ``` |
|
|
