An Ensemble Model for Word-based DGA Botnet Detection Using XGBoost and BERT
Xuan Hanh Vu, Xuan Dau Hoang · Advances in Electrical and Computer Engineering · 2025
DGA (Domain Generation Algorithm) is a sophisticated technique widely adopted by botnets to dynamically generate domain names for their command-and-control servers, thereby evading detection and mitigation efforts. Unlike character-based DGA botnets, word-based DGA botnets usually generate domain names by concatenating meaningful words drawn from English dictionaries. This approach significantly increases the difficulty of distinguishing algorithmically generated domain names from legitimate ones. Conventional detection methods have demonstrated strong performance against character-based DGAs. However, they are generally ineffective or even unable to detect word-based DGAs. To address this challenge, we propose a novel ensemble model that integrates eXtreme Gradient Boosting (XGBoost) with Bidirectional Encoder Representations from Transformers (BERT) for the detection of word-based DGA domain names. Comprehensive experiments conducted on datasets encompassing 13 botnet families demonstrate that the proposed ensemble framework consistently outperforms individual classifiers and existing state-of-the-art approaches, achieving a detection rate of 99.88%.