Why Random Domains Are a Telltale Sign
Threat actors often need stable channels to steer infected machines, but stable names are also easy for defenders to block. Domain generation algorithms (DGAs) solve that problem for attackers: instead of hardcoding a fixed rendezvous point, malware computes a fresh batch of random-looking domains each day, and the attacker registers just one of them. For defenders, that rotation makes it impractical to rely on static blocklists, since a domain's malicious reputation may only propagate after the malware has already moved on.
Yet the randomness itself is a weakness. Legitimate domains tend to be built from words and familiar abbreviations — think "cloud" and "flare" — while DGA output is character soup. That distinction is exactly what a machine learning model can be trained to spot.
Detecting Algorithmic Domains at Scale
Cloudflare's detection pipeline starts with data from its 1.1.1.1 public DNS resolver, which sees a vast share of global query traffic. Only new or newly seen domain names that successfully resolve are passed to the classifier — a single successful lookup anywhere on that network is enough to trigger analysis. This approach lets Cloudflare catch a DGA domain as soon as it becomes active, rather than waiting for threat intelligence feeds to catch up.
The model itself is a transformer-based neural network, the same architecture class behind modern large language models. Domain names are rich in human-language structure, so pre-training on language gives the model a strong prior for what a normal name looks like. When a new domain is scored, its characters are tokenized and fed through the model, which outputs a probability that the name was algorithmically generated. A score above the configured threshold labels the domain as DGA.
Training data was curated from two sources: known DGA domain names for the positive class and a large sample of real queries from the 1.1.1.1 resolver for the negative class. The final training set included over 250,000 names, weighted toward legitimate domains to reflect real-world class imbalance. Cloudflare evaluated three architectures — LSTM, LightGBM, and a transformer — and selected the transformer based on its highest accuracy and F1 score, exceeding 99% accuracy on held-out test data. The F1 metric matters here because on an imbalanced dataset, a naive model that always predicts the majority class would still look accurate; F1 penalizes that behavior.
DNS Tunneling: Another Abuse of the Protocol
DNS tunneling takes the opposite approach to DGAs. Instead of hiding the destination, it hides the data being exchanged, encoding it inside DNS queries and responses. Because DNS is almost never blocked entirely, tunneling lets malware exfiltrate data or receive commands through a channel that most firewalls allow. The queries themselves often look suspiciously long or structured, but identifying them requires inspecting DNS payloads, not just domain names.
Machine learning can also help here. Cloudflare's approach to tunneling detection uses models trained on features of DNS queries, looking for patterns that deviate from normal resolution behavior — such as unusual query lengths, high query volumes to a single name, or response payloads that carry encoded data. As with the DGA case, the goal is to classify behavior the moment it appears, using the global vantage point of the resolver network to spot threats across many organizations simultaneously.
Deployment Without Friction
Both models operate behind the scenes, processing DNS queries that already flow through Cloudflare's network. For the DGA model, only successfully resolved, newly observed names are scored, keeping the computational load manageable. This design means detection happens as soon as a malicious domain is contacted from anywhere using the 1. 1.1.1 resolver, without requiring endpoint software or changes to how users access the internet.
By combining character-level language understanding with a global view of DNS traffic, Cloudflare aims to disrupt command-and-control infrastructure faster than domain rotation can outpace it.
Characterizing Tunnels, Not Just Queries
DNS tunneling works by repurposing the DNS protocol itself as a covert data channel. Instead of resolving a normal hostname like www.cloudflare.com to an IP address, an attacker who controls an authoritative name server can encode arbitrary data in query names and response records. The malware sends a query whose name is actually an encoded payload; the authoritative server decodes it, and can reply with data embedded in record types such as TXT. Because each query name is effectively unique — it's a chunk of transmitted data, not a hostname — recursive resolvers pass it up the chain to the attacker's server, completing a bi-directional pipe.
A typical tunneling query looks like a long, random string:
3rroeuvx6bkvfwq7dvruh7adpxzmm3zfyi244myk4gmswch4lcwmkvtqq2cryyi.qrsptavsqmschy2zeghydiff4ogvcacaabc3mpya2baacabqtqcaa2iaaaaocjb.br1ns.example.com
Response records can carry up to 255 characters each, and the content is similarly random-looking.
| TXT | jdqjtv64k2w4iudbe6b7t2abgubis |
The difficulty is that not every high-entropy DNS name is malicious. Many legitimate applications encode identifiers into subdomains. A security appliance checking in with its vendor might generate a query like:
00641f74-8518-4f03-adc2-792a34ea2612.bbbb.example.com
That leading portion is a UUID — a unique installation ID, not a covert payload. During research and labeling, Cloudflare's team found that content delivery networks, video streaming services, advertising and tracking systems, and security tools all produce DNS queries with large numbers of random-looking subdomains. The challenge, then, is distinguishing a genuine tunnel from an appliance heartbeat or a CDN edge hostname.
A Two-Stage Filter
Cloudflare's approach is a two-stage model. The first stage is a gradient-boosted decision tree that makes a fast binary call: does this domain look like it could be tunneling? Decision trees are lightweight and well-suited to yes/no questions with mixed binary and nominal features, and gradient boosting combines many weak predictors into a strong one.
Only domains flagged as potential tunnels reach the second stage. That stage is a neural network that incorporates data from Cloudflare's 1.1.1.1 resolver, and it makes finer-grained distinctions. The goal is to separate true malicious tunneling from domains that legitimately have a huge number of subdomains — security appliances, antivirus update check-ins, and similar false-positive sources.
The neural network takes 28 input features and classifies each domain into one of 17 application categories, including DNS tunneling, IT appliance beacons, and email delivery or spam-related traffic.
Figure 2: A diagram of the neural network layers generated by keras.utils.plot_model().
The model is deliberately small — roughly 2,000 trainable weights. That's a stark contrast to the pretrained model families discussed later in this series, which have tens to hundreds of millions of predefined weights.
Figure 3: Feature plots for domains with high-entropy subdomains. Each angle around the circle is a feature; the distance from the center is its value. Overlapping shapes show why fine-grained classification matters.
When a new domain is observed, its features are computed and fed to the network. The 17 outputs are prediction scores for each application type. If the "malicious DNS tunneling" output is the highest, the domain is labeled a security threat. The model's job is to magnify otherwise subtle differences in feature values into a reliable decision.
Deployment Path
In production, the system consumes logs from Cloudflare's secure web gateway. Every DNS query goes through the first-stage decision tree. Only those flagged as possible tunnels are escalated to the second-stage neural network, where additional features refine the prediction.
Putting Humans in the Loop
Machine learning is not the end of the story. Cloudflare's threat operations and research team, Cloudforce One, became generally available in September 2022, and it layers expert analysis on top of these ML models. The combination of automated classification and human investigation is the direction the company is taking for further threat detection improvements, as explored in the next part of this series.
