Feature-based classification of individual domain queries

An apparatus, comprising:

• one or more network interfaces to communicate with a network;
• a processor coupled to the network interfaces and configured to execute one or more processes;
• and
• a memory configured to store a process executable by the processor, the process when executed operable to:
• determine a first set of domain generation algorithm (DGA) predictions for a particular domain name by analyzing one or more extracted lexical features of the particular domain name using a first ensemble of decision trees;
• determine a second set of DGA predictions for the particular domain name by analyzing one or more extracted cluster features of a cluster of related domain names to which the particular domain name belongs using a second ensemble of decision trees;
• predict a DGA associated with the particular domain name based on the first and second sets of DGA predictions;
• and
• cause performance of a security action based on the predicted DGA associated with the particular domain name.

A tangible, non-transitory, computer-readable media having software encoded thereon, the software when executed by a device in a network operable to:

• determine a first set of domain generation algorithm (DGA) predictions for a particular domain name by analyzing one or more extracted lexical features of the particular domain name using a first ensemble of decision trees;
• determine a second set of DGA predictions for the particular domain name by analyzing one or more extracted cluster features of a cluster of related domain names to which the particular domain name belongs using a second ensemble of decision trees;
• predict a DGA associated with the particular domain name based on the first and second sets of DGA predictions;
• and
• cause performance of a security action based on the predicted DGA associated with the particular domain name.