What’s in a name. . . generator?

Domain generation algorithms can be used for registering spamming and phishing sites, as well as by botnets for domain flux. In this paper we study Kwyjibo, a more sophisticated domain/word generation algorithm that is able to produce over 48 million distinct pronounceable words. We show through four different implementations how Kwyjibo might be deployed and how its size can be reduced to under 163KiB using a technique we call ‘lossy distribution compression’. This means that Kwyjibo is both powerful as well as small enough to be used by malware on mobile devices.