Abstract: A computer-implemented method for detecting malicious content is disclosed that includes operations of receiving a character set as an input, where the character set represents a domain name, generating a deep machine learning output by analyzing the character set with a first plurality of layers arranged in a deep machine learning architecture, generating a wide machine learning output by analyzing the character set with a second plurality of layers arranged in a wide machine learning architecture, and jointly processing the deep machine learning output and the wide machine learning output resulting in a comparison score that is indicative of a probability that the character set was generated by a domain generation algorithm (DGA).

Abstract: A computer-implemented method for detecting malicious content is disclosed that includes operations of: receiving a character set as an input, converting the input into an integer array containing indexes of each character, and creating an input vector from the integer array, the input vector being a dense numerical representation of the character set. The input vector is passed to a machine learning model to generate a plurality of features based on the character set, the plurality of features comprising at least two of: a length of the character set, a Shannon Entropy of the character set, n-gram similarity score of the character set with English dictionary words, n-gram similarity score of the character set with a set of legitimate domains, and an online web traffic ranking service. A dense input vector is formed by concatenating the plurality of features to the input vector, and then processed to obtain a comparison score.

Abstract: Techniques are described for providing users of a data intake and query system with pre-trained ML models capable of identifying malicious threats (e.g., malware, botnets, ransomware, etc.) in users' computing environments based on an analysis of Domain Name System (DNS) log data collected from DNS servers in users' environments. DNS log data is ingested by a data intake and query system and processed to obtain searchable timestamped event data. This event data can then be used as input to ML models provided by a security ML application described herein to detect potential occurrences of malicious activity within users' computing environments.