A DNS tunnel hides stolen data inside subdomain labels of ordinary-looking DNS queries (e.g. 7fk2m9qz...evil-c2.example), because DNS traffic is rarely blocked by firewalls. Real hostnames are dictionary-like and low-entropy; base32-encoded exfil payloads look statistically close to random noise. The classic detector is the Shannon entropy of the label's character distribution:
H(label) = -Σ p(c) · log2(p(c)) over each character c
p(c) = frequency of c in the label
H is measured in bits/character
uniform random base32 (32 symbols) → H → log2(32) = 5.0
common English word fragments → H ≈ 2.8 – 3.6
This dashboard generates the same two live query streams as the 3D version — legit hostnames from a word list, and base32 tunnel labels sized by the "bytes per label" slider — but visualizes the detector statistically instead of spatially:
- Strip chart (top): every query's entropy plotted against time as it arrives, colored by outcome, with the current threshold drawn as a horizontal line.
- Histogram (bottom-left): the live distribution of recent benign vs. tunnel entropies. Drag the dashed threshold line left/right to retune the detector directly on the data.
- ROC curve (bottom-right): a real sweep — the threshold is swept across the observed entropy range and the true-positive / false-positive rate is recomputed at each step from the actual sample sets, tracing the detector's whole operating curve. The bright dot marks where your current threshold sits on that curve.
Raising the threshold slides the operating point down the ROC curve toward the origin (fewer false positives, but more tunnel queries slip through); lowering it slides toward the top-right corner (catches more tunneling, but starts flagging legitimate long/random-looking hostnames).