1. A computer-implemented method comprising: at a first computing device, obtaining a plurality of sample domain names and labeling each of the plurality of sample domain names as a domain generation algorithm (DGA) domain, a non-DGA domain or a suspicious domain; training a classifier in a first stage based on the plurality of sample domain names without a proxy log; obtaining a plurality of sample proxy logs including proxy logs of DGA domains and proxy logs of non-DGA domains; training the classifier in a second stage based on the plurality of sample domain names and the plurality of sample proxy logs; obtaining a plurality of live traffic proxy logs; testing the classifier by classifying the plurality of live traffic proxy logs as DGA proxy logs; and using the trained and tested classifier to identify network communication of a second computing device as malware network communication with DGA domains via a network interface unit of the second computing device.
2. The method of claim 1 , wherein training the classifier in the first stage comprises: obtaining DGA domains and non-DGA domains from whitelists and blacklists; obtaining suspicious domains from a domain contacted by an isolated malicious program; and obtaining unknown DGA domains from output of a Domain Name System anomaly detection process.