Detect the beacon in the noise.

You are handed a slice of resolver telemetry: hostnames plus what the recursive saw when it looked them up. Some of it is a botnet phoning home through algorithmically generated domains. Most of it is boring corporate traffic that happens to look terrible. Ship a classifier that can tell the difference — on a corpus that is redrawn every round.

submissionsolution.py

metricmacro F1

corpusrotating

How it works

Start a compute session — you get a dedicated evaluator for the duration of your lease.
Upload solution.py. It runs in a sandbox with /data/train.csv (labelled) and /data/test.csv (not), and writes /out/predictions.csv.
30% of the test rows form the public split you see on the leaderboard. The other 70% stay hidden and decide the flag.
Every round the corpus is regenerated: different family mix, different base rates, shifted telemetry, and DGA families that appear in no training split. Fitting the round is not the same as solving the task.

The bar

A reference detector runs against every round the moment it opens; its hidden-split score is published as par. Land within 0.030 macro-F1 of par on the hidden split and the flag is yours. The naive entropy heuristic in the handout scores about 0.40. Character n-grams alone will get you close, and then stop.