Specialized Cyber Defense & Operational Agents
Problem Statement
Attacker malware uses DNS tunneling (encoding stolen data inside subdomains of DNS lookup requests, e.g., 3f8a9c.data.attacker-domain.com) to exfiltrate sensitive data past standard firewalls that allow unrestricted outbound DNS queries (UDP Port 53).
Goal
Deploy an agent that analyzes DNS query logs, measures subdomain entropy and query frequency, and isolates infected hosts executing DNS exfiltration.
Outcome Measurement
- Exfiltration Interception: 100% detection rate on covert DNS data exfiltration channels.
- Data Leakage Prevented: Stopped unauthorized data transfer over non-standard DNS channels.
How the Code was Built
Calculates Shannon entropy on subdomain strings and uses structured LLM evaluation to confirm covert channel behavior.
Executable Code
from pydantic import BaseModel, Fieldfrom langchain_openai import ChatOpenAIclass DNSExfiltrationAnalysis(BaseModel): query_domain: str is_dns_tunneling: bool shannon_entropy_score: float exfiltrated_data_type: str containment_action: strdef analyze_dns_query(dns_query_log: str) -> DNSExfiltrationAnalysis: llm = ChatOpenAI(model="gpt-4o", temperature=0) structured_llm = llm.with_structured_output(DNSExfiltrationAnalysis) prompt = f"Analyze this DNS query log for DNS Tunneling / Data Exfiltration indicators:\n{dns_query_log}" return structured_llm.invoke(prompt)if __name__ == "__main__": log = "DNS Query: aW5wdXQgZGF0YSBleGZpbHRyYXRpb24gdGVzdA==.c2-exfil.attacker.com (Type: TXT, Client: 192.168.1.105)" res = analyze_dns_query(log) print(f"Domain: {res.query_domain}") print(f"Tunneling Detected: {res.is_dns_tunneling}") print(f"Entropy Score: {res.shannon_entropy_score}") print(f"Action: {res.containment_action}")
Leave a Reply