8. An apparatus comprising: one or more processors; one or more memory devices in communication with the one or more processors; and a network interface unit coupled to the one or more processors, wherein the one or more processors are configured to: obtain a plurality of sample domain names and labeling each of the plurality of sample domain names as a domain generation algorithm (DGA) domain, a non-DGA domain or a suspicious domain; train a classifier in a first stage based on the plurality of sample domain names without a proxy log; obtain a plurality of sample proxy logs including proxy logs of DGA domains and proxy logs of non-DGA domains; train the classifier in a second stage based on the plurality of sample domain names and the plurality of sample proxy logs; obtain a plurality of live traffic proxy logs; test the classifier by classifying the plurality of live traffic proxy logs as DGA proxy logs; and use the trained and tested classifier to identify network communication of another computing device as malware network communication with DGA domains via a network interface unit of the other computing device.
8. An apparatus comprising: one or more processors; one or more memory devices in communication with the one or more processors; and a network interface unit coupled to the one or more processors, wherein the one or more processors are configured to: obtain a plurality of sample domain names and labeling each of the plurality of sample domain names as a domain generation algorithm (DGA) domain, a non-DGA domain or a suspicious domain; train a classifier in a first stage based on the plurality of sample domain names without a proxy log; obtain a plurality of sample proxy logs including proxy logs of DGA domains and proxy logs of non-DGA domains; train the classifier in a second stage based on the plurality of sample domain names and the plurality of sample proxy logs; obtain a plurality of live traffic proxy logs; test the classifier by classifying the plurality of live traffic proxy logs as DGA proxy logs; and use the trained and tested classifier to identify network communication of another computing device as malware network communication with DGA domains via a network interface unit of the other computing device. 10. The apparatus of claim 8 , wherein the one or more processors are configured to train the classifier in the second stage by: generating an artificial proxy log of a DGA domain by selecting a proxy log of a DGA domain comprising a first domain name from the plurality of sample proxy logs and replacing the first domain name with a second domain name classified as a DGA domain name; and adding the artificial proxy log to the plurality of sample proxy logs.