Using the power of Cloudflare’s global network to detect malicious domains using machine learning

This post details the application of machine learning, specifically transformer-based neural networks, to detect malicious domains. It covers the training of models using DNS resolver data and known DGA domains, achieving over 99% accuracy. It also describes the deployment of these models to process DNS query names from the 1.1.1.1 resolver for real-time detection of DGA domains. Additionally, it introduces a two-stage model for detecting DNS tunneling, distinguishing it from benign applications that use similar query patterns.