  Numerous malware families rely on domain generation algorithms (DGAs) to
establish a connection to their command and control (C2) server. Counteracting
DGAs, several machine learning classifiers have been proposed enabling the
identification of the DGA that generated a specific domain name and thus
triggering targeted remediation measures. However, the proposed
state-of-the-art classifiers are based on deep learning models. The black box
nature of these makes it difficult to evaluate their reasoning. The resulting
lack of confidence makes the utilization of such models impracticable. In this
paper, we propose EXPLAIN, a feature-based and contextless DGA multiclass
classifier. We comparatively evaluate several combinations of feature sets and
hyperparameters for our approach against several state-of-the-art classifiers
in a unified setting on the same real-world data. Our classifier achieves
competitive results, is real-time capable, and its predictions are easier to
trace back to features than the predictions made by the DGA multiclass
classifiers proposed in related work.
