Search papers, labs, and topics across Lattice.
This paper introduces Gravity Falls, a semi-synthetic dataset of smishing links from 2022-2025, capturing a single threat actor's DGA evolution across four technique clusters. It then evaluates the performance of traditional (Shannon entropy, Exp0se) and ML-based (LSTM, COSSAS DGAD) DGA detectors against this dataset, using Top-1M domains as benign baselines. The key finding is that detector performance is highly tactic-dependent, with significant drops in recall as the DGA tactics evolve from randomized strings to dictionary concatenation and themed combo-squatting.
Existing DGA detectors, both heuristic and ML-based, struggle to keep up with the evolving tactics used in mobile spearphishing, highlighting a critical gap in current security measures.
Mobile devices are frequent targets of eCrime threat actors through SMS spearphishing (smishing) links that leverage Domain Generation Algorithms (DGA) to rotate hostile infrastructure. Despite this, DGA research and evaluation largely emphasize malware C2 and email phishing datasets, leaving limited evidence on how well detectors generalize to smishing-driven domain tactics outside enterprise perimeters. This work addresses that gap by evaluating traditional and machine-learning DGA detectors against Gravity Falls, a new semi-synthetic dataset derived from smishing links delivered between 2022 and 2025. Gravity Falls captures a single threat actor's evolution across four technique clusters, shifting from short randomized strings to dictionary concatenation and themed combo-squatting variants used for credential theft and fee/fine fraud. Two string-analysis approaches (Shannon entropy and Exp0se) and two ML-based detectors (an LSTM classifier and COSSAS DGAD) are assessed using Top-1M domains as benign baselines. Results are strongly tactic-dependent: performance is highest on randomized-string domains but drops on dictionary concatenation and themed combo-squatting, with low recall across multiple tool/cluster pairings. Overall, both traditional heuristics and recent ML detectors are ill-suited for consistently evolving DGA tactics observed in Gravity Falls, motivating more context-aware approaches and providing a reproducible benchmark for future evaluation.
