DNS Exfiltration Detector
I found that a public DNS exfiltration benchmark's attack data contains no attacks, rebuilt it from the raw packet captures, and showed where a model trained on it breaks.
CASE STUDY →The model learned “long and random,” not “exfiltration.”



