Dictionary dga detector model

A user device comprising:

• at least one memory storing instructions;
• and
• one or more processors configured to execute the instructions to perform operations comprising:
• receiving a suspect domain name comprising a sequence of characters;
• generating a sequence of dense embedding vectors by:
• generating a sequence of numbers based on the sequence of characters,
• generating a sequence of one-hot encoding vectors based on the sequence of numbers, and
• generating a sequence of dense embedding vectors by multiplying the one-hot encoding vectors with a vector of weights;
• generating a dictionary domain generation algorithm score based on the sequence of dense embedding vectors using a feedforward neural network model, the feedforward neural network model comprising an input layer, the input layer comprising the neural node outputs of a long short-term neural network model and filter outputs of a convolutional neural network model;
• and
• performing at least one of:
• alerting a user, or
• blocking access to a website corresponding to the suspect domain name.

A computer-implemented method comprising:

• receiving a suspect domain name comprising a sequence of characters;
• generating a sequence of dense embedding vectors by:
• generating a sequence of numbers based on the sequence of characters,
• generating a sequence of one-hot encoding vectors based on the sequence of numbers, and
• generating a sequence of dense embedding vectors by multiplying the one-hot encoding vectors with a vector of weights;
• generating a dictionary domain generation algorithm score based on the sequence of dense embedding vectors using a feedforward neural network model, the feedforward neural network model comprising an input layer, the input layer comprising the neural node outputs of a long short-term neural network model and filter outputs of a convolutional neural network model;
• and
• performing at least one of:
• alerting a user, or
• locking access to a website corresponding to the suspect domain name.

A user device comprising:

• at least one memory storing instructions;
• and
• one or more processors configured to execute the instructions to perform operations comprising:
• training a long short-term neural network model, a convolutional neural network model, and a feedforward neural network model using training data comprising legitimate domain names and dictionary domain generation algorithm names'
• receiving a suspect domain name comprising a sequence of characters;
• generating a sequence of dense embedding vectors by:
• generating a sequence of numbers based on the sequence of characters,
• generating a sequence of one-hot encoding vectors based on the sequence of numbers, and
• generating a sequence of dense embedding vectors by multiplying the one-hot encoding vectors with a vector of weights;
• generating a dictionary domain generation algorithm score based on the sequence of dense embedding vectors using a feedforward neural network model, the feedforward neural network model comprising an input layer, the input layer comprising the neural node outputs of the long short-term neural network model and filter outputs of the convolutional neural network model;
• and
• performing at least one of:
• alerting a user,
• blocking access to a website corresponding to the suspect domain name,
• identifying a file comprising instructions to contact a website corresponding to the suspect domain name and deleting the file,
• freezing a user account associated with the suspect domain name, or
• wiping the user device based on the score.