Abstract: A method of detecting a domain generation algorithm (DGA) may include categorizing a plurality of domain name system (DNS) queries received from a client device based on a perplexity score to obtain a group of categorized DNS queries. The method may further include verifying that the DNS queries correspond to a number of unique qualified names (qnames) or fully quantified domain names (FQDNs) within the group of categorized DNS queries. The method may further include transmitting to a DGA cache a number of entries including an identification of the client device transmitting the DNS queries and a perplexity score, the identification of the client device and the perplexity score defining a family of DNS queries that are produced by the DGA. The method may further include blocking subsequent DNS queries from the client device based on entries within a blocklist.