Lion Cipher Lab
Write a DGA-domain detector from scratch (lexical detection + a dictionary-DGA evasion)
- Threat Intel Analyst
- Advanced
- ~80 min
- Free · no account required
Why it matters
When malware needs to phone home, hard-coding one command-and-control (C2) domain is a fatal weakness: a defender blocks that one name and the malware is deaf. So modern families use a Domain Generation Algorithm -- a seeded routine that produces hundreds of fresh pseudo-random domains a day (think aycxpqmnbdrt.com). The attacker registers just a few of them; every infected host runs the same algorithm, tries the day's domains until one resolves, and reconnects. MITRE ATT&CK catalogs this as Dynamic Resolution: Domain Generation Algorithms (T1568.002), and it is precisely why a static domain…
What you'll learn
- what a Domain Generation Algorithm (DGA) is and why static domain blocklists cannot keep up (MITRE ATT&CK T1568.002)
- generating a self-contained, deterministic test dataset: a benign top-sites list plus a tiny seeded DGA you write as a BENIGN data generator
- engineering lexical features from scratch: Shannon entropy, an English bigram gibberishness score, length, digit ratio, consonant runs, vowel ratio
- hand-tuning a weighted scorer and reporting precision, recall, and a confusion matrix on data you can inspect line by line
- reading your false positives honestly: CDN/hash-y hostnames as the #1 lexical false-positive class, and why short url-shorteners slip under the floor
- playing the adversary: switching to a dictionary-based DGA (suppobox-style) and measuring your entropy detector collapse from ~0.97 to ~0.27 recall
- re-tuning with a dictionary word-boundary feature, and reasoning about the DNS-level context (NXDOMAIN bursts, query volume) production detection needs
- the base-rate judgment: with millions of benign domains a 1% false-positive rate is a flood, so lexical scoring is a lead generator, not a verdict
Steps in this lab
- What a DGA is, and why a domain blocklist loses the race
- Generate a self-contained dataset (and write a tiny BENIGN DGA to have something to detect)
- Build the lexical features from scratch
- Score, classify, and print precision / recall + a confusion matrix
- Look at the false positives -- the honest #1 FP class
- The adversary round: switch to a DICTIONARY DGA and watch entropy collapse
- Re-tune -- add a word-boundary feature, and reason about the DNS context you'd add next
- The judgment: when lexical wins, the base-rate trap, and where ML + DGArchive fit