File	Description
`heuristic.json`	Always-on lexical entropy detector (demo-ready)
`vocab.json`	Character vocabulary for sequence models
`config.json`	Engine config + primary model
`train_metrics.json`	Evaluation metrics
`threshold.json`	Decision threshold
`*.keras`	TensorFlow/Keras deep models (after `scripts/train_models.py`)
`*.joblib`	Tabular baselines (after training)

Quick inference (no GPU / no TF required)

python

from pathlib import Path
import sys
sys.path.insert(0, "src")
from dgahunter.pipeline import DGAHunterPipeline

pipe = DGAHunterPipeline(Path("model"))
print(pipe.analyze(["google.com", "ajdkslaoqwe.net", "xkqpyvjd.biz"]))

Full TensorFlow / Keras training

bash

pip install -r requirements.txt
python scripts/bootstrap.py

Trains Logistic Regression, Random Forest, XGBoost, Char-CNN, BiLSTM, CNN-LSTM, and Transformer Encoder with tf.data, then re-exports this model repo.

Metrics

See train_metrics.json and the companion dataset eval_results.json for Macro F1, ROC-AUC, PR-AUC, family holdout recall, legitimate FPR, and latency.

Intended Use

SOC / DNS security research demos
Portfolio evaluation of TensorFlow-based DGA detection
Not a standalone blocklist replacement

Limitations

Trained on synthetic DGA simulators
English / ASCII domains only
May misclassify unusual but legitimate long brand domains

MIT License — Aria AI Engineering Team

alirezaaminzadeh/dga-hunter-detector

DGA Hunter Detector

Contents

Quick inference (no GPU / no TF required)

Full TensorFlow / Keras training

Metrics

Intended Use

Limitations

alirezaaminzadeh/
dga-hunter-detector