Problem
DNS telemetry analyser that scores queries on label entropy, label length, NXDOMAIN response rate, and per-zone query volume to separate domain-generation algorithms and DNS tunnelling from ordinary resolution, with tunable thresholds.
DNS SecurityExfiltrationEntropy AnalysisThreat DetectionNetwork SecurityAnomaly DetectionCase study / interactive demo
Case study
From problem to working system
My role
Security engineer and full-stack developer
Solution
DNS telemetry analyser that scores queries on label entropy, label length, NXDOMAIN response rate, and per-zone query volume to separate domain-generation algorithms and DNS tunnelling from ordinary resolution, with tunable thresholds.
Architecture
The implementation combines the following technologies and system concerns.
DNS SecurityExfiltrationEntropy AnalysisThreat DetectionNetwork SecurityAnomaly Detection
How it was built
- Computed Shannon entropy per character over the leftmost label, which is the signal that separates generated domains from human-registered ones.
- Detected data encoded into query names by label length and base64 alphabet conformance, the mechanics of DNS tunnelling.
- Used NXDOMAIN rate as a DGA indicator, since an algorithm cycling candidate domains fails to resolve most of them.
- Separated tunnelling from beaconing by per-zone query volume, because the same entropy signal means different things at 6 queries and at 1,800.
Security decisions
No project-specific security control is documented in the current project record. The case study avoids claiming controls that were not verified.
Major challenges
- Computed Shannon entropy per character over the leftmost label, which is the signal that separates generated domains from human-registered ones.
- Detected data encoded into query names by label length and base64 alphabet conformance, the mechanics of DNS tunnelling.
- Used NXDOMAIN rate as a DGA indicator, since an algorithm cycling candidate domains fails to resolve most of them.
Verified evidence
Results and measurable impact
- Computed Shannon entropy per character over the leftmost label, which is the signal that separates generated domains from human-registered ones.
Screenshots and access
Product view
Interactive Demo
A scoped, fully functional recreation of this project's core feature runs below, live in your browser. Reset it, resize it, or expand it to full screen.
dns-sentinel.zainkhalilkhan.com
DNS Sentinel
Security platform
Sandbox telemetry
DNS SentinelWorkspace5 updates
DNS Sentinel · Exfiltration & DGAshare of queries crossing the alert threshold
5 flagged
DNS is the channel that is almost never blocked, which makes it the channel of choice for beaconing and exfiltration. Each query is scored on per-character entropy of the leftmost label, label length, NXDOMAIN rate, and query volume to one zone, then thresholds are tuned to trade recall against alert volume.
Queries scored
9
Flagged
5
suspicious or malicious
False positives
0
benign traffic flagged
Missed
0
malicious not flagged
Label entropy per query, highest firstthreshold 3.4 bits/char
Clean separation at this tuning: every malicious query is flagged and no benign query is.
Query scoring9 scored
Zain Khalil Khan
Client-side sandbox. State is in memory and nothing is sent to a server.