DNS Tunneling Exfiltration Detector

DNS tunneling smuggles stolen data out of a network inside ordinary-looking DNS queries, one of the quieter techniques behind real cyber-espionage campaigns because DNS traffic is rarely filtered at the firewall. This simulation streams two classes of query — legitimate hostnames and base32-style encoded exfiltration labels — from a compromised host through a resolver toward a covert command server in real 3D, computing each label's Shannon entropy live and testing it against an adjustable detection threshold. Tune the legit and tunnel traffic rates, the payload size per query, and the entropy cutoff to watch the true-positive, false-negative and false-positive rates respond exactly as they would for a real entropy-based DNS security control.