Domain Entropy & DGA Malware Analyzer
Calculate character-level Shannon entropy, consonant-vowel distribution, and linguistic perplexity in real time to classify suspicious strings against known malware Domain Generation Algorithm (DGA) profiles.
Frequently Asked Questions
What is a Domain Generation Algorithm (DGA) and how do malware families use them?
A Domain Generation Algorithm (DGA) is a mathematical routine embedded in malware families (such as Conficker, Necurs, Gameover Zeus, and Mirai) that generates dozens or thousands of pseudo-random domain names daily. The malware attempts to connect to these domains to receive Command and Control (C2) instructions from operators, frustrating static IP/domain blocklists.
How is Shannon Entropy used to identify algorithmic domain names?
Shannon entropy measures the statistical uncertainty and information density in a character string. Natural English dictionary words and legitimate brand names exhibit low entropy (typically 2.0 to 3.2 bits per character). In contrast, randomly generated cryptographic strings exhibit high entropy (typically 3.8 to 4.8+ bits per character).
What metrics beyond Shannon entropy distinguish DGAs from legitimate brands?
In addition to Shannon entropy, security engines analyze: (1) consonant-to-vowel ratios, (2) repeating bi-gram and tri-gram frequencies compared to English language corpora, (3) domain length distributions, and (4) historical registration velocity across cheap ccTLDs.
Why do attackers frequently register DGAs under specific new gTLDs or ccTLDs?
Botnet operators must register dozens of domains daily across their algorithmic pool. They naturally gravitate toward extensions with rock-bottom first-year promo pricing ($0.99 to $1.99) and automated API provisioning with minimal registrant identity verification.