14. The apparatus of claim 10 , wherein the one or more processors are configured to: obtain proxy logs of the malware network communication; extract statistical features from the proxy logs of the malware network communication; form a second input feature vector from the statistical features extracted from the proxy logs of the malware network communication; and identify the network communication as the malware network communication with DGA domains by applying the trained and tested classifier to the second input feature vector.
10. The apparatus of claim 8 , wherein the one or more processors are configured to train the classifier in the second stage by: generating an artificial proxy log of a DGA domain by selecting a proxy log of a DGA domain comprising a first domain name from the plurality of sample proxy logs and replacing the first domain name with a second domain name classified as a DGA domain name; and adding the artificial proxy log to the plurality of sample proxy logs.