Merge Stage 2 DNS analysis scores and calculate final exfiltration verdicts.
Capture live DNS queries with tcpdump for a configurable duration, save the traffic to a PCAP file, and process it through the existing PCAP reader. Use when a user explicitly requests timed live DNS capture from a network interface.
Compute DGA probabilities using a pre-trained RandomForest model.
Score DNS queries for anomalies using the trained embedding similarity model.
Calculate DNS subdomain entropy scores for exfiltration and DGA detection.
Generate a Markdown security report from aggregated DNS exfiltration scores.
Normalize DNS input from PCAP or CSV into one unified JSON dataset.
Reads DNS packets from existing PCAP/PCAPng files.