dns_exfil

Merge Stage 2 DNS analysis scores and calculate final exfiltration verdicts.

Capture live DNS queries with tcpdump for a configurable duration, save the traffic to a PCAP file, and process it through the existing PCAP reader. Use when a user explicitly requests timed live DNS capture from a network interface.

Compute DGA probabilities using a pre-trained RandomForest model.

Score DNS queries for anomalies using the trained embedding similarity model.

Calculate DNS subdomain entropy scores for exfiltration and DGA detection.

Generate a Markdown security report from aggregated DNS exfiltration scores.

Normalize DNS input from PCAP or CSV into one unified JSON dataset.

Reads DNS packets from existing PCAP/PCAPng files.