Adaptive Institute
Course projectIn reviewPublic reviewReviews in progress

DNS tunnelling detector for a campus network

AI-PRF-0049v1.1.0CybersecurityCandidate C-0213stage open 2026-10-08 → 2026-10-22

Summary

Flags DNS tunnelling from query length, entropy and request rate per host, and queues each alert with the queries that triggered it. Evaluated on the replayable campus traffic set with three tunnelling tools injected.

Claims to check

  1. C1Detects all three injected tunnelling tools in the test set
  2. C2False alerts stay under 2 per 10,000 hosts per day on clean traffic
  3. C3Runs on a single 4-core machine at campus traffic volume

Evidence submitted

Code
Repository at tag v1.1.0, 2,140 lines, MIT licence
Demo
Replay of 24 h of campus traffic with alerts
Write-up
6 pages: method, thresholds, evaluation, limits
Test data
Replayable campus set + injected tunnels (labelled)

Automated checks

CHECKS / AI-PRF-0049v1.1.04 OF 5 PASSCLEAN ENV
  1. pass iodine tunnel detected · alert at 00:03:12
  2. pass dnscat2 tunnel detected · alert at 00:01:48
  3. pass dns2tcp tunnel detected · alert at 00:05:31
  4. pass False alerts on clean day · 1.4 per 10,000 hosts
  5. FAIL CDN hostnames excluded · 3 alerts on a video CDN

Checks run by the Institute on submission. A pass here is not a verdict.

Version history

  1. v1.1.02026-10-07Allowlist for long CDN hostnames, after community review
  2. v1.0.02026-09-21Submitted

Reviews already filed

  • RV-2026-0099CommunityB. SiregarRequest changes10/15 · read v1.0.0
  • RV-2026-0101CommunityY. HakimAccept14/15 · read v1.1.0
See them on the ledger
The rubric, in full
  1. Works as briefed. Does it run from the instructions and do what the brief asks, on the test data? Must pass
  2. Claims match evidence. Is every claim in the write-up backed by a test, data or a demo you could rerun?
  3. Reproducible. Did a clean environment reproduce the reported results with the documented steps? Must pass
  4. Limits stated. Are failure cases and the limits of scope written down where a reader will see them?
  5. Responsible use. Are data sources cited and permitted, and are risks and human oversight addressed where relevant?

0 Missing · 1 Weak · 2 Meets · 3 Strong. Below Meets needs a written reason.

Your review

Public review of AI-PRF-0049

Reviewing as P. Widodo · Candidate C-0213 stays anonymous to every reviewer until the decision. Everything you file here is published on the ledger under your name.

1 Conflict of interest
2 What you reviewed
3 Criteria0 / 15

Score each criterion against the public rubric. Must-pass criteria need Meets or better before you can accept.

  1. 01Works as briefedMust pass

    Does it run from the instructions and do what the brief asks, on the test data?

  2. 02Claims match evidence

    Is every claim in the write-up backed by a test, data or a demo you could rerun?

  3. 03ReproducibleMust pass

    Did a clean environment reproduce the reported results with the documented steps?

  4. 04Limits stated

    Are failure cases and the limits of scope written down where a reader will see them?

  5. 05Responsible use

    Are data sources cited and permitted, and are risks and human oversight addressed where relevant?

4 Verdict

Say what you checked, what you found, and what would change your verdict. Address the work, not the person.

0 / 120 min
No verdict yet

Filed reviews cannot be edited. To correct one, file an amendment; both stay on the ledger.