Research Article

Hybrid Model for DGA Detection in Cybersecurity: Fast Text, CNN, BiLSTM, and Multihead Attention

Volume: 18 Number: 2 June 30, 2026
Turkish Journal of Mathematics and Computer Science Cover
Turkish Journal of Mathematics and Computer Science
PDF Download

Hybrid Model for DGA Detection in Cybersecurity: Fast Text, CNN, BiLSTM, and Multihead Attention

Abstract

Domain Generation Algorithms (DGAs) are a crucial threat in modern cybersecurity; they enable malware to generate dynamically pseudorandom domain names for command-and-control (C&C) communication to evade blacklisting detection mechanisms. Many concealing techniques are used to address network botnets; thus, DGAs continue to pose detection challenges requiring more robust approaches. This work presents a comprehensive and effective hybrid deep learning model integrating FastText embeddings, Convolutional Neural Networks (CNNs), Bidirectional Long Short-Term Memory (BiLSTM) networks, and Multihead Attention mechanisms for strong DGA detection. Our methodology uses FastText’s subword-level semantic representations to capture morphological patterns, CNNs for the local feature extraction, BiLSTM for bidirectional context and sequential dependency modeling, and attention mechanisms to identify prominent sequence dependencies. We evaluate the hybrid model on a large-scale dataset comprising the University of Murcia Domain Generation Algorithm (UMUDGA) with 500.000 datasets, in addition to 500.000 datasets from 360 Netlab, combined with Alexa top 1 million legitimate domain names, resulting in 99.49% accuracy, 99.75% precision, 99.23% recall, 99.49% F1-score, and 99.97% ROC-AUC. Comparative analysis with baseline methods demonstrates competitive and improved performance under the evaluated settings, showing strong generalization capability of the proposed hybrid architecture in detecting with efficiency both known and previously unseen DGA families. Our model addresses the limitations of traditional machine learning and deep learning approaches; it provides a scalable solution potentially suitable for real-time DGA detection in cybersecurity applications.

Keywords

References

  1. Anderson, H.S.,Woodbridge, J., Filar, B., DeepDGA: adversarially-tuned domain generation and detection, Proc. ACMWorkshop on Artificial Intelligence and Security (AISec), Vienna, Austria, (2016), 13–21.
  2. Antonakakis, M., Perdisci, R., Nadji, Y., Vasiloglou, N., Abu-Nimeh, S. et al., From throw-away traffic to bots: detecting the rise of DGA-based malware, Proc. 21st USENIX Security Symposium, (2012), 491–506.
  3. Bojanowski, P., Grave, E., Joulin, A., Mikolov, T., Enriching word vectors with subword information, Trans. Assoc. Comput. Linguist., 5(2017), 135–146.
  4. Chen, J.L., Qiu, J.F., Chen, Y.H., A hybrid DGA DefenseNet for detecting DGA domain names based on FastText and deep learning techniques, IEEE Access, 10(2022), 42116–42128.
  5. Greg´orio, J.R., Cansian, A.M., Neves, L.A., Salvadeo, D.H.P., Deep convolutional neural network and character level embedding for DGA detection, Proc. 26th Int. Conf. on Enterprise Information Systems (ICEIS), (2024), 167–174.
  6. Mozilla, cipherscan/top1m, GitHub. [Online]. Available: https://github.com/mozilla/cipherscan/tree/master/top1m
  7. Namgung, J., Son, S., Moon, Y.S., Efficient deep learning models for DGA domain detection, Secur. Commun. Netw., 2021(2021), 1–18.
  8. 360 Netlab, DGA feed. [Online]. Available: http://data.netlab.360.com/dga/

Details

Primary Language

English

Subjects

Deep Learning, Neural Networks, Cybersecurity and Privacy (Other)

Journal Section

Research Article

Authors

Publication Date

June 30, 2026

Submission Date

December 13, 2025

Acceptance Date

February 3, 2026

Published in Issue

Year 2026 Volume: 18 Number: 2

DOI

https://doi.org/10.47000/tjmcs.1836055

IZ

https://izlik.org/JA49ZE62EN

Cite

RIS / Bibtex
APA
Ben Ali, A., Toklu, S., Mugigayi, F., & Mahamat, D. (2026). Hybrid Model for DGA Detection in Cybersecurity: Fast Text, CNN, BiLSTM, and Multihead Attention. Turkish Journal of Mathematics and Computer Science, 18(2), 598-606. https://doi.org/10.47000/tjmcs.1836055
AMA
1.Ben Ali A, Toklu S, Mugigayi F, Mahamat D. Hybrid Model for DGA Detection in Cybersecurity: Fast Text, CNN, BiLSTM, and Multihead Attention. TJMCS. 2026;18(2):598-606. doi:10.47000/tjmcs.1836055
Chicago
Ben Ali, Abdhine, Sinan Toklu, Fahadi Mugigayi, and Djalabi Mahamat. 2026. “Hybrid Model for DGA Detection in Cybersecurity: Fast Text, CNN, BiLSTM, and Multihead Attention”. Turkish Journal of Mathematics and Computer Science 18 (2): 598-606. https://doi.org/10.47000/tjmcs.1836055.
EndNote
Ben Ali A, Toklu S, Mugigayi F, Mahamat D (June 1, 2026) Hybrid Model for DGA Detection in Cybersecurity: Fast Text, CNN, BiLSTM, and Multihead Attention. Turkish Journal of Mathematics and Computer Science 18 2 598–606.
IEEE
[1]A. Ben Ali, S. Toklu, F. Mugigayi, and D. Mahamat, “Hybrid Model for DGA Detection in Cybersecurity: Fast Text, CNN, BiLSTM, and Multihead Attention”, TJMCS, vol. 18, no. 2, pp. 598–606, June 2026, doi: 10.47000/tjmcs.1836055.
ISNAD
Ben Ali, Abdhine - Toklu, Sinan - Mugigayi, Fahadi - Mahamat, Djalabi. “Hybrid Model for DGA Detection in Cybersecurity: Fast Text, CNN, BiLSTM, and Multihead Attention”. Turkish Journal of Mathematics and Computer Science 18/2 (June 1, 2026): 598-606. https://doi.org/10.47000/tjmcs.1836055.
JAMA
1.Ben Ali A, Toklu S, Mugigayi F, Mahamat D. Hybrid Model for DGA Detection in Cybersecurity: Fast Text, CNN, BiLSTM, and Multihead Attention. TJMCS. 2026;18:598–606.
MLA
Ben Ali, Abdhine, et al. “Hybrid Model for DGA Detection in Cybersecurity: Fast Text, CNN, BiLSTM, and Multihead Attention”. Turkish Journal of Mathematics and Computer Science, vol. 18, no. 2, June 2026, pp. 598-06, doi:10.47000/tjmcs.1836055.
Vancouver
1.Abdhine Ben Ali, Sinan Toklu, Fahadi Mugigayi, Djalabi Mahamat. Hybrid Model for DGA Detection in Cybersecurity: Fast Text, CNN, BiLSTM, and Multihead Attention. TJMCS. 2026 Jun. 1;18(2):598-606. doi:10.47000/tjmcs.1836055