Pelayo-Benedet, Tomás; Rodríguez, Ricardo J.
A Systematic Literature Review of Adversarial Domain Generation and Defense Journal Article
In: Machine Learning with Applications, vol. 24, pp. 100888, 2026, ISSN: 2666-8270.
Abstract | Links | BibTeX | Tags: Adversarial Learning, Domain Generation Algorithm, Generative Adversarial Networks, Systematic Literature Review
@article{PelayoBenedet2026a,
title = {A Systematic Literature Review of Adversarial Domain Generation and Defense},
author = {Tomás Pelayo-Benedet and Ricardo J. Rodríguez},
url = {https://webdiis.unizar.es/~ricardo/files/papers/PelayoBenedetR-MLWA-26.pdf},
doi = {10.1016/j.mlwa.2026.100888},
issn = {2666-8270},
year = {2026},
date = {2026-06-01},
journal = {Machine Learning with Applications},
volume = {24},
pages = {100888},
abstract = {Domain Generation Algorithms (DGAs) have long allowed malware to maintain persistent command and control channels by evading static blocklists. However, this dynamic has evolved into a sophisticated arms race: DGAs are no longer simply random but are now optimized to actively deceive detection systems. This paper presents a systematic literature review analyzing 32 primary studies (2016–2025) at the intersection of algorithmically generated domain detection and adversarial machine learning. We construct a comprehensive taxonomy of the evasion landscape, mapping the progression from simple character perturbations to advanced generative adversarial networks and semantic mimicry. Our analysis reveals two systemic flaws in the state of the art. First, we identify a significant deployment gap, where proposed defenses ignore operational realities, such as strict latency limits and the need for false positive rates below $0.1%$. Second, we highlight a serious reproducibility crisis driven by a lack of public code and standardized datasets. We conclude by proposing a roadmap to standardize assessment frameworks and bridge the gap between theoretical soundness and operational feasibility.},
keywords = {Adversarial Learning, Domain Generation Algorithm, Generative Adversarial Networks, Systematic Literature Review},
pubstate = {published},
tppubtype = {article}
}
Domain Generation Algorithms (DGAs) have long allowed malware to maintain persistent command and control channels by evading static blocklists. However, this dynamic has evolved into a sophisticated arms race: DGAs are no longer simply random but are now optimized to actively deceive detection systems. This paper presents a systematic literature review analyzing 32 primary studies (2016–2025) at the intersection of algorithmically generated domain detection and adversarial machine learning. We construct a comprehensive taxonomy of the evasion landscape, mapping the progression from simple character perturbations to advanced generative adversarial networks and semantic mimicry. Our analysis reveals two systemic flaws in the state of the art. First, we identify a significant deployment gap, where proposed defenses ignore operational realities, such as strict latency limits and the need for false positive rates below $0.1%$. Second, we highlight a serious reproducibility crisis driven by a lack of public code and standardized datasets. We conclude by proposing a roadmap to standardize assessment frameworks and bridge the gap between theoretical soundness and operational feasibility.