Security Operations · Advanced

Domain Generation Algorithm (DGA)

An algorithm in malware that generates many pseudo-random domain names to locate its command-and-control servers.

Definition

Both the malware and the attacker run the same algorithm, so the attacker only needs to register one of thousands of daily domains. This defeats static domain blocklists. Defenders detect DGAs by looking for high-entropy domain names, many NXDOMAIN responses and machine-learning classification.

Related terms