A random forest is a supervised learning model that builds multiple decision trees and combines their predictions into a more robust final prediction. Each tree is trained on a random subset of the data, using features to predict an outcome. section 9.3
For DNS threat hunting, the model can classify requests as normal DNS traffic (class 0) or DNS-tunneling activity (classes 1–4). Its usefulness depends on preparation: collect relevant events, extract features, and supply good-quality labeled training data. section 9.3.3 section 9.7
A repeatable workflow is:
- Train the classifier on PCA-generated training data and labels. section 9.3.1
- Apply the training-fitted scaler and PCA transformation to test data rather than refitting them. section 9.3.2
- Predict classes, then evaluate results with accuracy, F1 score, and a confusion matrix. section 9.3.2
- Run the model on collected DNS requests and investigate events mapped to tunneling classes. section 9.3.3 section 9.3.6
Investigating suspicious DNS names
After classifying production DNS events, filter for classes other than 0 and inspect fully qualified domain names. Requests containing microsofts.info were predominantly mapped to a DNS-tunneling class, while 63 events were mapped to normal traffic and warranted review. section 9.3.6
Listing 9.20 Creating and training a Random Forest Classifier model on X_train_pca
from sklearn.ensemble import RandomForestClassifier #1
rf = RandomForestClassifier(n_estimators=100, \
random_state=42) #2
rf.fit(X_train_pca, y_train) #3
Creates a 100-tree scikit-learn classifier, fixes a random seed, and fits it to PCA-transformed training features and labels. section 9.3.1
