---
base_model: meta-llama/Meta-Llama-3-8B
library_name: peft
license: mit
language:
- en
metrics:
- accuracy
- precision
- recall
- f1
datasets:
- AbuSayed1/DGA-DATASET
---

## Llama3 8B Fine-Tuned for Domain Generation Algorithm Detection

This model is a fine-tuned adaptation of Meta's Llama3 8B, tailored for detecting **Domain Generation Algorithms (DGAs)**. DGAs, commonly employed by malware, generate dynamic domain names for **command-and-control (C&C)** servers, posing a significant challenge in cybersecurity.

## Model Description

- **Base Model**: Llama3 8B
- **Task**: DGA Detection
- **Fine-Tuning Approach**: Qlora based supervised Fine-Tuning (SFT) with domain-specific data.
- **Dataset**: A combined dataset comprising 59 malware families and legitimate domains consisting of three different sources: one dataset for benign domains, which includes the Alexa Top 1 Million Sites collection of reputable domains; and two datasets for DGA domains, sourced from Bambenek Consulting’s malicious algorithmically-generated domains and the 360 Lab DGA Domains.
- **Performance**:
  - **Accuracy**: Known domain 98.6%, Unknown domain 80-99.5%
  - Excels in detecting unknown DGAs.

This model leverages the extensive semantic understanding of Llama3 to classify domains as either **malicious (DGA-generated)** or **legitimate** with high precision and recall.

## Data

The model was trained with 2.5 million domains, split between 1.5 million DGA domains and 1 million normal domains. 

Dataset Link: https://huggingface.co/datasets/AbuSayed1/DGA-DATASET

The GitHub repository https://github.com/MDABUSAYED/StratosphereLinuxIPS/tree/LLM/modules/flowalerts/LLM describe how the model was trained and evaluated.


## Citation


**APA:**

Sayed, M. A., Rahman, A., Kiekintveld, C., & Garcia, S. (2024). Fine-tuning Large Language Models for DGA and DNS Exfiltration Detection. arXiv preprint arXiv:2410.21723.