DNS Tunneling & Botnet Detection

ML-powered real-time analysis of DNS domains — trained on synthetic data and validated against real CTU-13 network flows.

Domain Analysis

Enter any domain name to classify it

Quick test: google.com mail.yahoo.com base64 tunnel long encoded deep C2
How It Works

Four-step ML classification pipeline

  • 1
    Feature Extraction Domain length, subdomain depth, Shannon entropy, digit count, special chars, longest label.
  • 2
    StandardScaler Normalisation Features scaled to zero-mean, unit-variance before inference.
  • 3
    Random Forest (200 trees) Ensemble votes on Normal vs Malicious with balanced class weights.
  • 4
    Confidence Score Probability of the predicted class expressed as a percentage.
Model Performance

Synthetic training + CTU-13 validation

~99%
Accuracy
200
RF Trees
2K
Synth. Samples
7
Features
Model Visualisations

Feature importance & confusion matrix

Feature Importance — Synthetic
Feature Importance
Confusion Matrix — Synthetic
Confusion Matrix
Synthetic vs CTU-13 Comparison
Comparison
Feature Importance — CTU-13 Real
Real Feature Importance
Confusion Matrix — CTU-13 Real
Real Confusion Matrix