Detection
Finished September 2026I found that a public DNS exfiltration benchmark's attack data contains no attacks, rebuilt it from the raw packet captures, and showed where a model trained on it breaks.
My detector scored 99.98% at a 5% false-positive rate. When I checked stricter thresholds, detection dropped to zero below about 4%. Tracing why led to the dataset: the published attack CSVs are background LAN chatter, identical row for row to the benign traffic. The model was recognizing which capture a window came from.
The raw PCAPs were recorded with a 96-byte snaplen, which cut every exfil query off mid-name, and the dataset's extractor threw those queries away. I wrote my own extractor. It takes name length from the UDP header, which survives truncation, computes lexical features on the same 30-character prefix for both classes, and labels exfil by the attacker's resolver IP instead of by content.
On the rebuilt data, a one-line rule (flag names longer than 60 characters) catches 99.99% of the exfil with zero false positives on 89,533 benign queries. A Random Forest gets 100% at 0.11% FPR, including on whole capture files and payload types it never trained on.
The benchmark attack is loud, about 60 base64 characters per label, so the model learned "long and random." Against synthetic exfil with 8-character hex labels it catches 2.2%. My original four leakage checks all passed, because they compared attack to benign inside the same broken data. Next: real dnscat2 and iodine traffic in my homelab, with my Pi-hole log as benign traffic.
Details