Flag the flow: AI-powered anomaly detection for data exfiltration in network traffic

DNS-based data exfiltration represents a critical cybersecurity threat that exploits the ubiquity of DNS protocol communications to establish covert channels for unauthorized data transfer. This study presents a systematic comparative evaluation of eight lightweight machine learning classifiers for real-time DNS exfiltration detection, addressing critical gaps in adversarial robustness and practical deployment considerations. Using a dataset of 1,068,892 DNS query-response pairs (74.62% benign, 25.38% malicious), including malicious traffic captured from three exfiltration tools (iodine, dnsexfiltrator, and CobaltStrike) selected from a broader collection of nine tools, we evaluated Random Forest, Extra Trees, Gradient Boosting, Decision Tree, Logistic Regression, Linear SVM, Gaussian Naive Bayes, and Multi-layer Perceptron classifiers under dual configurations: complete feature sets (31 attributes) and adversarially-resilient configurations with timing-dependent and packet-size features removed. While tree-based ensemble methods achieved near-perfect performance metrics (99.99-100% accuracy), these results likely indicate overfitting to dataset-specific artifacts rather than genuine learning capability. Feature importance analysis revealed a heavy reliance on easily manipulated attributes such as TTL values (97.58% importance) and packet sizes, confirming that such models may memorize patterns rather than learn robust detection principles. In contrast, linear classifiers demonstrated more realistic performance (85-95% accuracy) with superior generalization capabilities under adversarial conditions. The findings challenge conventional performance-focused evaluation approaches, illustrating that models with moderate but stable accuracy may be better suited for production deployment against adaptive adversaries than classifiers reporting near-perfect metrics.