# DGA Algorithm Types and Reverse Engineering

## Common DGA Types

### Arithmetic-Based
- Use mathematical operations on seed values
- Often seeded with current date
- Example: Conficker — uses date + index to generate domain characters via modular arithmetic
- RE approach: Identify seed source, trace character generation loop

### Hash-Based
- Generate domain by hashing seed material (MD5, SHA1, CRC32)
- Hash output used to select characters
- Example: Murofet — MD5 of date concatenation
- RE approach: Identify hash function, find seed construction

### Wordlist-Based
- Combine real dictionary words to form pronounceable domains
- Harder to detect statistically
- Example: Suppobox — combines adjective + noun patterns
- RE approach: Identify embedded word lists, combination algorithm

### Permutation-Based
- Start from a seed domain and apply permutations
- Character substitution, insertion, transposition
- Example: Kwyjibo
- RE approach: Identify seed domain, permutation rules

## Reverse Engineering Approach

1. **Find the generation function** — Look for loops generating strings character-by-character
2. **Identify the seed** — Date/time, hardcoded constant, external input (twitter post, etc.)
3. **Trace the algorithm** — Map mathematical operations on seed to character selection
4. **Identify TLD selection** — Often from hardcoded array of TLDs
5. **Count domains per period** — How many domains generated per day/week/month
6. **Implement predictor** — Reimplement algorithm to predict future domains

## Detection Strategies

| Method | Detects | Misses |
|--------|---------|--------|
| Character entropy | Random-character DGA | Wordlist DGA |
| Bigram analysis | Non-linguistic patterns | Dictionary DGA |
| NXDomain volume | Active DGA resolution | Pre-registered DGA |
| DNS query timing | Bulk resolution patterns | Slow-drip queries |
| Machine learning | All types (with training) | Novel algorithms |