The Vision: Behavioral DNS Analysis
Traditional security relies on blacklists, but malware evolves faster than lists. I built this modular pipeline to detect **C2 Beacons** and **DGA (Domain Generation Algorithms)** using mathematical randomness (Shannon Entropy) and timing consistency checks.
The Multi-Stage Pipeline
The project transforms raw network traffic into intelligence through four distinct stages:
- Data Extraction: Parsing raw .pcap files with Pyshark, filtering specifically for UDP Port 53 traffic.
- Heuristic Analysis: Calculating Shannon Entropy to spot DGA and measuring Inverse Jitter for beacon detection.
- Intelligence Enrichment: Automatically querying suspicious domains via the **VirusTotal API**.
- Visual Dashboard: Generating a 3-panel executive report for immediate SOC response.
Mistakes & Roadblocks (The Hard Way)
Building a high-performance analyzer came with significant technical hurdles.
Resource Exhaustion: Processing massive PCAP files was crashing the system memory.
The Fix: Implemented specific BPF (Berkeley Packet Filter) rules in Pyshark to ignore all non-DNS traffic at the kernel level.
Human vs. Machine: Distinguishing between a human browsing the web and a C2 beacon was difficult.
The Fix: Developed an **Inverse Jitter** algorithm; humans have high variance, while machines exhibit machine-like periodicity.
API Rate Limiting: VirusTotal queries were hitting the free tier limit almost instantly.
The Fix: Created a heuristic threshold; only domains with a risk score > 20 are promoted for API enrichment.
Key Takeaways
- **Mathematical Randomness**: Shannon Entropy is a powerful ally in detecting automated malware patterns.
- **API Orchestration**: Learned to manage external intelligence feeds without compromising local performance.
- **Visual Intelligence**: Information is useless if not actionable; clear dashboarding is a security requirement.
The Final Result
A fully functional Python-based security tool that transforms raw packet data into a Visual Executive Intelligence Report, marking malicious domains with real-time reputation status.