DNS Exfiltration Detector

MEASURED RESULT99.98% detection

A leakage-audited Random Forest pipeline built around windowed query-name behavior, validated at a fixed 5% false-positive rate.

Pythonscikit-learnScapytcpdumpWireshark

SYSTEM VIEW / 01

A visual explanation of the system's core behavior.

HELD-OUT DETECTION @ 5% FPR51,536 WINDOWS

1007550250

18.5%

Response metadata

99.98%

Windowed query behavior

NO DUPLICATE WINDOWSPERMUTATION NULLPAYLOAD HOLDOUT

51,536held-out windows

5%fixed false-positive rate

99.98%detection rate

01 / PROBLEM

What had to change.

Response-side metadata missed the behavior that actually distinguishes DNS exfiltration. The original feature design detected only 18.5% of malicious windows at the target operating point.

02 / BUILD

How the system works.

Windowed query-name features capture entropy, label shape, volume, and timing behavior. Live traffic is captured with tcpdump and parsed through Scapy into the same schema used for training.

03 / PROOF

Why the result holds up.

The result was tested against duplicate-window leakage, a permutation null, and leave-one-payload-type-out validation before being reported on the held-out set.

IMPLEMENTATION NOTES

Query-side behavioral windows
Permutation-null validation
Real-vs-lab traffic drift analysis

Want the code and full documentation?

View source on GitHub ↗