Bigram and trigram features break a domain into two character and three character sequences for analysis. These ngram patterns help a model compare the structure of a domain with normal language or known benign naming patterns. Generated domains often look statistically different, which makes these features useful for classification.
How bigram and trigram features work
Bigram and trigram features turn a domain into short character sequences so a classifier can evaluate how the string is built, not just whether it contains a suspicious word. By comparing adjacent character patterns, the model learns whether the domain follows normal naming structure or looks mechanically generated, which is often the first hint that the string is synthetic rather than human-chosen.
Why n-gram structure is useful for domain analysis
Character n-grams capture local patterning that is easy for humans to miss. Legitimate domains tend to reuse pronounceable fragments, familiar affixes, and stable spelling patterns, while generated domains often show unusual transitions, repetitive chunks, or awkward character combinations. That makes bigrams and trigrams valuable when the signal is not a single malicious keyword but the overall texture of the name.
What these features reveal about generated domains
These features are especially useful because many generated domains are designed to look plausible at a glance. A string can avoid obvious blacklist terms and still stand out statistically through rare character pairings, low language similarity, or repetitive sequence distributions. In practice, the model is measuring how closely the domain resembles ordinary linguistic structure, which helps distinguish randomised or algorithmically produced names from normal branding or vocabulary.
Where bigram and trigram features fit in detection pipelines
Bigram and trigram features usually work best as one input to a broader classification system, not as a standalone verdict. They are strongest when combined with length, lexical similarity, registration context, DNS behaviour, and other indicators that help separate benign but unusual names from genuinely suspicious ones. That broader view matters because some legitimate domains are short, novel, or brand-specific and may still look statistically uncommon.
Risk and Threat Considerations
Domains with generated-looking structure can be used to support phishing, malware delivery, or command-and-control infrastructure because they are cheap to create and easy to vary at scale. Character-based features help spot that pattern early, but they are probabilistic, so false positives can rise when brands, abbreviations, or non-English names naturally deviate from common language patterns.
Failure mechanism: An attacker can register many synthetically produced domains that evade simple keyword checks but still preserve statistical cues in character sequencing. If defenders rely only on allowlists or string matching, those domains may blend into traffic until they are already being used for abuse.
Impact: Missed detection can enable credential harvesting, session theft, malware staging, or longer-lived infrastructure for fraud and phishing campaigns. Overly aggressive blocking can also disrupt legitimate domains that are genuinely unusual, so tuning and corroboration matter.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP API Security Top 10 address the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1566 — Phishing | Domain generation supports phishing infrastructure and lure delivery patterns. |
| Recommendation — Map suspicious domains to phishing tradecraft and correlate with delivery and credential-harvest indicators. | ||
| CIS Controls v8 | CIS-14 — Security Awareness and Skills Training | Domain abuse is often assessed in user-facing detection and reporting workflows. |
| Recommendation — Train users to report suspicious domains and pair reporting with DNS monitoring and filtering. | ||
| NIST CSF 2.0 | DE.CM-01 — Continuous Monitoring | Character-pattern detection fits ongoing monitoring for anomalous domains and communications. |
| Recommendation — Monitor DNS and email telemetry for anomalous domain patterns and feed findings into detection rules. | ||
| OWASP API Security Top 10 | API8 — Security Misconfiguration | Generated domain analysis can surface misconfigurations in exposed services and lookalike naming patterns. |
| Recommendation — Review exposed endpoints and naming patterns to reduce confusion and prevent lookalike abuse. | ||
| NIST SP 800-53 Rev 5 | SI-4 — System Monitoring | Sequence-based domain detection is a monitoring control that detects suspicious external communications. |
| Recommendation — Use SI-4 monitoring to flag anomalous domain strings and investigate suspicious outbound connections. | ||
Practitioner Guidance
Why practitioners should care: Bigram and trigram features are most useful when the goal is to separate structurally normal domains from names that are statistically odd in ways humans would not spot quickly. They give analysts a lightweight signal for triage, ranking, and model input, especially in large-scale DNS or email security workflows.
What to watch for: Treat n-gram output as a scoring feature, not a conclusion. The best results come when it is validated against known benign samples, local naming conventions, and the wider context of the request or connection, so that unusual but legitimate domains are not treated as malicious by default.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org