Domain Generation Algorithms (DGA) facilitate botnet command-and-control (C2) evasion by generating large volumes of pseudo-random domains. Existing detectors typically exploit either character-level statistical patterns or pretrained language-model embeddings, limiting their ability to capture complementary representations. This study proposes a hybrid architecture combining (1) an 8×73 binary matrix representation of domain names derived from ASCII bit decomposition and processed by a CNN, and (2) contextual embeddings from fine-tuned DistilBERT. The two branches are integrated using single-head cross-attention with gated feature fusion. Experiments on UTLDGA dataset (303,200 domains with 70/15/15 split) and controlled replication of three representative methods  show that the proposed hybrid achieves F1=0.9764 and ROC-AUC=0.9939 across five random seeds. It consistently outperforms the CNN-only baseline, with F1 gains of 1.53–1.58%. Zero-shot evaluation on UMUDGA, DGArchive, and Netlab360, covering 71 unseen families, achieves an overall detection rate of 85.33%. Ablation results across 13 configurations confirm complementary contributions: CNN captures discriminative bit-level patterns, whereas fine-tuned DistilBERT provides subword contextual priors, with cross-attention fusion yielding further gains.

Domain generation algorithm,DGA botnet detection,Binary matrix representation,CNN,DistilBERT