ntvНаучно-технический вестник информационных технологий, механики и оптикиScientific and Technical Journal of Information Technologies, Mechanics and Optics2226-14942500-0373Университет ИТМО10.17586/2226-1494-2026-26-2-367-377ntv-599Research ArticleКОМПЬЮТЕРНЫЕ СИСТЕМЫ И ИНФОРМАЦИОННЫЕ ТЕХНОЛОГИИCOMPUTER SCIENCEПодход к обнаружению DGA-доменов на основе контекстного обучения больших языковых моделейAn approach to contextual example mining for DGA domain identification using large language modelshttps://orcid.org/0000-0002-9955-2694МенисовА. Б.MenisovA. B.

Менисов Артем Бакытжанович — доктор технических наук, старший преподаватель

Санкт-Петербург, 197198

sc 57220815185

Artem B. Menisov — D.Sc., Senior Lecturer

Saint Petersburg, 197198

vka@mil.ruhttps://orcid.org/0009-0008-5949-7820МоргуновВ. М.MorgunovV. M.

Моргунов Владимир Михайлович — кандидат технических наук, доцент, доцент

Санкт-Петербург, 197198

Vladimir M. Morgunov — PhD, Associate Professor, Associate Professor

Saint Petersburg, 197198

vka@mil.ruhttps://orcid.org/0000-0001-9361-8819ТимашовП. В.TimashovP. V.

Тимашов Павел Васильевич — кандидат технических наук, преподаватель

Санкт-Петербург, 197198

Pavel V. Timashov — PhD, Lecturer

Saint Petersburg, 197198

vka@mil.ruВоенно-космическая академия имени А.Ф. МожайскогоРоссияMozhaisky Military Aerospace AcademyRussian Federation202620042026262367377Copyright © Менисов А.Б., Моргунов В.М., Тимашов П.В., 20262026Менисов А.Б., Моргунов В.М., Тимашов П.В.Menisov A.B., Morgunov V.M., Timashov P.V.Данная работа распространяется под лицензией Creative Commons Attribution 4.0.This work is licensed under a Creative Commons Attribution 4.0 License.https://ntv.elpub.ru/jour/article/view/599

Введение. Рассмотрена проблема обнаружения доменов, сгенерированных алгоритмами генерации доменов (Domain Generation Algorithms, DGA), которые широко используются злоумышленниками для построения устойчивых каналов управления ботнетами и скрытой коммуникации. Традиционные методы основаны на ручной инженерии признаков или специализированных нейросетевых архитектурах, что снижает их устойчивость к быстро эволюционирующим DGA-семействам. Научная новизна предлагаемого подхода заключается в применении больших языковых моделей (БЯМ) с использованием механизма их контекстной адаптации для автоматического выявления скрытых закономерностей в доменных именах и их классификации. Метод. Разработанный подход основывается на использовании БЯМ, которые получают в контексте примеры легитимных и сгенерированных доменов. Для повышения эффективности адаптации предложены стратегии выбора примеров (TopK, VoteK), учитывающие метрики близости и вариативность данных. Дополнительно анализируется влияние длины доменного имени и энтропии строки на устойчивость подхода. Основные результаты. Экспериментальная часть выполнена на наборе данных, включающем 68 DGA-семейств и подмножестве легитимных доменов Tranco. В обучающую выборку вошли 54 семейства, а тестирование проводилось на 68 семействах, включая невидимые ранее 14. Результаты показали высокую эффективность подхода: Precision = 0,93, Recall = 0,95 и F1-мера = 0,94. Подтверждена способность БЯМ обобщать закономерности на новые DGA-семейства. Обсуждение. По сравнению с существующими методами, предложенный подход не требует дополнительного переобучения и отличается гибкостью за счет использования контекстной адаптации. Адаптация подхода показала устойчивость к шуму и возможность выявления новых DGA-семейств, что делает ее перспективной для применения в системах кибербезопасности. В то же время выявлена чувствительность модели к длине доменных имен и необходимость балансировки контекста. Перспективными направлениями развития являются интеграция дополнительных признаков (метаданные Domain Name System (DNS), временные ряды запросов) и адаптация подхода к потоковой обработке в реальном времени.

The article addresses the problem of detecting domains generated by Domain Generation Algorithms (DGA) which are widely used by attackers to build robust botnet control channels and covert communication. Traditional methods are based on manual feature engineering or specialized neural network architectures that reduce their robustness to evolving DGA families. The scientific novelty of the proposed approach lies in the use of Large Language Models (LLM) by leveraging their contextual adaptation mechanism to identify hidden patterns in domain names and classify them. The developed approach is based on the use of LLMs which receives examples of legitimate and generated domains within the context. To improve the efficiency, example selection strategies (TopK, VoteK), various metrics of data homogeneity and variability are used. Additionally, the influence of the domain name length and entropy on the stability of the approach is analyzed. The experimental part is performed on a dataset including 68 DGA families and a subset of legitimate Tranco domains. The training set included 54 families, and testing took place on all 68 families, including previously unseen 14 families. Results showed the efficiency of the approach: precision = 0.93, recall = 0.95 and F1-measure = 0.94. The ability of LLM to generalize rules to new DGA families is confirmed. Compared with existing methods, the proposed approach does not require additional retraining and provides flexibility due to contextual adaptation. It demonstrated resistance to noise and the capability to detect new DGA families, which makes its application promising in the field of cybersecurity. At the same time, the sensitivity of the model to the length of domain names and the need for context balancing were revealed. Promising areas of development are the integration of additional features (DNS metadata, query time series) and methods for adaptation to stream processing.

информационная безопасностьDNS-туннелированиеалгоритмы генерации доменовбольшие языковые моделиконтекстная адаптацияinformation securityDNS tunnelingdomain generation algorithmslarge language modelscontextual adaptationReferencesHassaoui M., Hanini M., Kafhali S.E. Data science in cybersecurity to detect malware-based domain generation algorithm: improvement, challenges, and prospects // Journal of Computational and Cognitive Engineering. 2024. V. 3. N 3. P. 213–225. https://doi.org/10.47852/bonviewJCCE42022875Hassaoui M., Hanini M., Kafhali S.E. Data science in cybersecurity to detect malware-based domain generation algorithm: improvement, challenges, and prospects // Journal of Computational and Cognitive Engineering. 2024. V. 3. N 3. P. 213–225. https://doi.org/10.47852/bonviewJCCE42022875Albluwi A., Albalawi U., Elfaki A.O. A DNS threat awareness practical framework using knowledge graph // Journal of Information Science and Engineering. 2025. V. 41. P. 1239–1261.Albluwi A., Albalawi U., Elfaki A.O. A DNS threat awareness practical framework using knowledge graph // Journal of Information Science and Engineering. 2025. V. 41. P. 1239–1261.Arora A., Shantanu. A review on application of GANs in cybersecurity domain // IETE Technical Review. 2022. V. 39. N 2. P. 433–441. https://doi.org/10.1080/02564602.2020.1854058Arora A., Shantanu. A review on application of GANs in cybersecurity domain // IETE Technical Review. 2022. V. 39. N 2. P. 433–441. https://doi.org/10.1080/02564602.2020.1854058Patsakis C., Casino F. Exploiting statistical and structural features for the detection of Domain Generation Algorithms // Journal of Information Security and Applications. 2021. V. 58. P. 102725. https://doi.org/10.1016/j.jisa.2020.102725Patsakis C., Casino F. Exploiting statistical and structural features for the detection of Domain Generation Algorithms // Journal of Information Security and Applications. 2021. V. 58. P. 102725. https://doi.org/10.1016/j.jisa.2020.102725Kolte S., Jare A., Babar V., Kadam S., Tekade P., Salunke D. A machine learning-based framework for real-time DNS threat detection and mitigation using ensemble models and advanced security mechanisms // Proc. of the International Conference on Electronics, AI and Computing (EAIC). 2025. P. 1–6. https://doi.org/10.1109/EAIC66483.2025.11101638Kolte S., Jare A., Babar V., Kadam S., Tekade P., Salunke D. A machine learning-based framework for real-time DNS threat detection and mitigation using ensemble models and advanced security mechanisms // Proc. of the International Conference on Electronics, AI and Computing (EAIC). 2025. P. 1–6. https://doi.org/10.1109/EAIC66483.2025.11101638Pelayo-Benedet T., Rodríguez R.J., Gañán C.H. Poster: Exploring the zero-shot potential of large language models for detecting algorithmically generated domains // Lecture Notes in Computer Science. 2025. V. 15748. P. 86–92. https://doi.org/10.1007/978-3-031-97623-0_5Pelayo-Benedet T., Rodríguez R.J., Gañán C.H. Poster: Exploring the zero-shot potential of large language models for detecting algorithmically generated domains // Lecture Notes in Computer Science. 2025. V. 15748. P. 86–92. https://doi.org/10.1007/978-3-031-97623-0_5Alorainy W.S. Echoes from the void: detecting DNS tunneling with blackhole features in encrypted scenarios with high accuracy // IEEE Access. 2025. V. 13. P. 138551–138567. https://doi.org/10.1109/ACCESS.2025.3595455Alorainy W.S. Echoes from the void: detecting DNS tunneling with blackhole features in encrypted scenarios with high accuracy // IEEE Access. 2025. V. 13. P. 138551–138567. https://doi.org/10.1109/ACCESS.2025.3595455Sharma N., Swarnkar M. DLAZE: Detecting DNS tunnels using lightweight and accurate method for zero-day exploits // IEEE Transactions on Network and Service Management. 2025. V. 22. N 3. P. 2343–2353. https://doi.org/10.1109/TNSM.2025.3541234Sharma N., Swarnkar M. DLAZE: Detecting DNS tunnels using lightweight and accurate method for zero-day exploits // IEEE Transactions on Network and Service Management. 2025. V. 22. N 3. P. 2343–2353. https://doi.org/10.1109/TNSM.2025.3541234Fu Y., Yu L., Hambolu O., Ozcelik I., Husain B., Sun J., et al. Stealthy domain generation algorithms // IEEE Transactions on Information Forensics and Security. 2017. V. 12. N 6. P. 1430–1443. https://doi.org/10.1109/TIFS.2017.2668361Fu Y., Yu L., Hambolu O., Ozcelik I., Husain B., Sun J., et al. Stealthy domain generation algorithms // IEEE Transactions on Information Forensics and Security. 2017. V. 12. N 6. P. 1430–1443. https://doi.org/10.1109/TIFS.2017.2668361Cao Y., Li S., Liu Y., Yan Z., Dai Y., Yu P., Sun L. A survey of AIGenerated Content (AIGC) // ACM Computing Surveys. 2025. V. 57. N 5. P. 1–38. https://doi.org/10.1145/3704262Cao Y., Li S., Liu Y., Yan Z., Dai Y., Yu P., Sun L. A survey of AIGenerated Content (AIGC) // ACM Computing Surveys. 2025. V. 57. N 5. P. 1–38. https://doi.org/10.1145/3704262De Bernardi G., Gaggero G.B., Patrone F., Zappatore S., Marchese M., Mongell M. Rule-based eXplainable autoencoder for DNS tunneling detection // Computers. 2025. V. 14. N 9. P. 375. https://doi.org/10.3390/computers14090375De Bernardi G., Gaggero G.B., Patrone F., Zappatore S., Marchese M., Mongell M. Rule-based eXplainable autoencoder for DNS tunneling detection // Computers. 2025. V. 14. N 9. P. 375. https://doi.org/10.3390/computers14090375Bykov N., Chernyshov Y. Detecting DNS tunnels using machine learning // Proc. of the IEEE Ural-Siberian Conference on Biomedical Engineering, Radioelectronics and Information Technology (USBEREIT). 2024. P. 92–94. https://doi.org/10.1109/usbereit61901.2024.10584043Bykov N., Chernyshov Y. Detecting DNS tunnels using machine learning // Proc. of the IEEE Ural-Siberian Conference on Biomedical Engineering, Radioelectronics and Information Technology (USBEREIT). 2024. P. 92–94. https://doi.org/10.1109/usbereit61901.2024.10584043Namgung J., Son S., Moon Y.-S. Efficient deep learning models for DGA domain detection // Security and Communication Networks. 2021. V. 2021. N 1. P. 8887881. https://doi.org/10.1155/2021/8887881Namgung J., Son S., Moon Y.-S. Efficient deep learning models for DGA domain detection // Security and Communication Networks. 2021. V. 2021. N 1. P. 8887881. https://doi.org/10.1155/2021/8887881Zhou S., Lin L., Yuan J., Wang F., Ling Z., Cui J. CNN-based DGA detection with high coverage // Proc. of the IEEE International Conference on Intelligence and Security Informatics (ISI). 2019. P. 62–67. https://doi.org/10.1109/isi.2019.8823200Zhou S., Lin L., Yuan J., Wang F., Ling Z., Cui J. CNN-based DGA detection with high coverage // Proc. of the IEEE International Conference on Intelligence and Security Informatics (ISI). 2019. P. 62–67. https://doi.org/10.1109/isi.2019.8823200Vu X.H., Hoang X.D., Chu T.H.H. A novel model based on ensemble learning for detecting DGA botnets // Proc. of the 14th International Conference on Knowledge and Systems Engineering (KSE). 2022. P. 1–6. https://doi.org/10.1109/kse56063.2022.9953792Vu X.H., Hoang X.D., Chu T.H.H. A novel model based on ensemble learning for detecting DGA botnets // Proc. of the 14th International Conference on Knowledge and Systems Engineering (KSE). 2022. P. 1–6. https://doi.org/10.1109/kse56063.2022.9953792Tapsoba A.R., Ouédraogo T.F., Zongo W.B.S. Analysis of plaintext features in DoH traffic for DGA domains detection // Lecture Notes in Networks and Systems. 2024. V. 932. P. 127–138. https://doi.org/10.1007/978-3-031-54235-0_12Tapsoba A.R., Ouédraogo T.F., Zongo W.B.S. Analysis of plaintext features in DoH traffic for DGA domains detection // Lecture Notes in Networks and Systems. 2024. V. 932. P. 127–138. https://doi.org/10.1007/978-3-031-54235-0_12Harishkumar S., Bhuvaneswaran R.S. Enhanced DGA detection in Botnet traffic: leveraging N-Gram, topic modeling, and attention BiLSTM // Peer-to-Peer Networking and Applications. 2025. V. 18. N 1. P. 55. https://doi.org/10.1007/s12083-024-01822-8Harishkumar S., Bhuvaneswaran R.S. Enhanced DGA detection in Botnet traffic: leveraging N-Gram, topic modeling, and attention BiLSTM // Peer-to-Peer Networking and Applications. 2025. V. 18. N 1. P. 55. https://doi.org/10.1007/s12083-024-01822-8Tian Y., Li Z. Dom-Bert: Detecting malicious domains with pretraining model // Lecture Notes in Computer Science. 2024. V. 14537. P. 133–158. https://doi.org/10.1007/978-3-031-56249-5_6Tian Y., Li Z. Dom-Bert: Detecting malicious domains with pretraining model // Lecture Notes in Computer Science. 2024. V. 14537. P. 133–158. https://doi.org/10.1007/978-3-031-56249-5_6Zhang J., Bu H., Wen H., Liu Y., Fei H., Xi R., et al. When LLMs meet cybersecurity: a systematic literature review // Cybersecurity. 2025. V. 8. N 1. P. 55. https://doi.org/10.1186/s42400-025-00361-wZhang J., Bu H., Wen H., Liu Y., Fei H., Xi R., et al. When LLMs meet cybersecurity: a systematic literature review // Cybersecurity. 2025. V. 8. N 1. P. 55. https://doi.org/10.1186/s42400-025-00361-wArslan M., Ghanem H., Munawar S., Cruz C. A survey on RAG with LLMs // Procedia Computer Science. 2024. V. 246. P. 3781–3790. https://doi.org/10.1016/j.procs.2024.09.178Arslan M., Ghanem H., Munawar S., Cruz C. A survey on RAG with LLMs // Procedia Computer Science. 2024. V. 246. P. 3781–3790. https://doi.org/10.1016/j.procs.2024.09.178Wu X.-K., Chen M., Li W., Wang R., Lu L., Liu J., et al. LLM Finetuning: concepts, opportunities, and challenges // Big Data and Cognitive Computing. 2025. V. 9. N 4. P. 87. https://doi.org/10.3390/bdcc9040087Wu X.-K., Chen M., Li W., Wang R., Lu L., Liu J., et al. LLM Finetuning: concepts, opportunities, and challenges // Big Data and Cognitive Computing. 2025. V. 9. N 4. P. 87. https://doi.org/10.3390/bdcc9040087Highmore C. In-context learning in large language models: a comprehensive survey // Preprints.org. 2024. 11 p. https://doi.org/10.20944/preprints202407.0926.v1Highmore C. In-context learning in large language models: a comprehensive survey // Preprints.org. 2024. 11 p. https://doi.org/10.20944/preprints202407.0926.v1

The authors declare that there are no conflicts of interest present.