Menü
Normalize DNS input from PCAP or CSV into one unified JSON dataset.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Basierend auf der SOC-Berufsklassifikation
Merge Stage 2 DNS analysis scores and calculate final exfiltration verdicts.
Capture live DNS queries with tcpdump for a configurable duration, save the traffic to a PCAP file, and process it through the existing PCAP reader. Use when a user explicitly requests timed live DNS capture from a network interface.
Compute DGA probabilities using a pre-trained RandomForest model.
Score DNS queries for anomalies using the trained embedding similarity model.
Calculate DNS subdomain entropy scores for exfiltration and DGA detection.
Generate a Markdown security report from aggregated DNS exfiltration scores.
| name | dns-extractor |
| description | Normalize DNS input from PCAP or CSV into one unified JSON dataset. |
Normalize DNS input from two sources into one unified JSON dataset.
Source A: decode raw DNS payloads from pcap_reader_agent output.
Source B: read CSV directly from the Kaggle dns-tunneling dataset.
Output is consumed by all three Stage-2 analysis agents.
extract_dns_queries(packets: list[dict] = None, csv_path: str = None) -> list[dict]
pcap_reader_agent produces raw_packets.json.data/input/dns_tunneling.csv is the input source.| Parameter | Type | Required | Description |
|---|---|---|---|
packets | list[dict] | no* | Output list from read_pcap_file |
csv_path | str | no* | Path to Kaggle CSV file |
*At least one of packets or csv_path must be provided.
Returns a list of dicts written to data/output/dns_queries.json.
Every item contains exactly these fields:
| Field | Type | Description |
|---|---|---|
query_id | integer | Sequential ID starting at 1 |
timestamp | float | Unix epoch (0.0 for CSV rows) |
src_ip | string | Source IP ("0.0.0.0" for CSV rows) |
domain | string | Full domain, lowercase, no trailing dot |
query_type | string | "A", "AAAA", "TXT", "CNAME", "MX", etc. |
subdomain | string | Everything left of the registered domain (may be "") |
tld | string | Top-level domain, e.g. "com", "net" |
label_count | integer | Number of DNS labels in the full domain |
domain_length | integer | Total character length of the full domain |
digit_ratio | float | Ratio of digit characters in subdomain (0.0 if empty) |
label | string | "benign", "malicious", or "unknown" |
count | integer | Repeat frequency of this (domain, src_ip) pair |
source | string | "pcap" or "csv" |
scapy>=2.5.0
tldextract>=3.4.0
pandas>=2.0.0
from tools.pcap_reader import read_pcap_file
from tools.dns_extractor import extract_dns_queries
# PCAP mode
packets = read_pcap_file("data/input/demo.pcap")
queries = extract_dns_queries(packets=packets)
# CSV mode
queries = extract_dns_queries(csv_path="data/input/dns_tunneling.csv")
# Both merged
queries = extract_dns_queries(packets=packets,
csv_path="data/input/dns_tunneling.csv")
print(f"Extracted {len(queries)} DNS queries")
TLDExtract(suffix_list_urls=None) for deterministic,
offline Public Suffix List behavior.timestamp, src_ip, query_type are set to defaults
(0.0, "0.0.0.0", "A") since the dataset does not include them.data/output/dns_queries.json.