Rules & contract

One row is one hostname as seen by a recursive resolver over 24 hours.

column	meaning
id	row key; your predictions join on this
domain	the fully-qualified hostname
ttl	TTL on the returned record, seconds
n_resolved_ips	distinct A records seen
n_distinct_asns	distinct ASNs behind those records
nxdomain_ratio	fraction of lookups that NXDOMAINed
query_count_24h	lookups in the window
first_seen_days_ago	age of the first observation
n_unique_clients	distinct internal clients that asked
label	train only — 1 = malicious/DGA

Telemetry columns contain missing values and a fraction of corrupted readings. A small share of labels are wrong; the sensor is not an oracle, and neither is your score.

• Submit a single solution.py, under 512 KiB.
• It runs as python solution.py with /data/train.csv and /data/test.csv readable, and must write /out/predictions.csv with columns id,label.
• Paths are also in NULLSIGHT_TRAIN, NULLSIGHT_TEST, NULLSIGHT_OUT — read them so the same file runs locally.
• Available: numpy, pandas, scipy, scikit-learn, joblib. Nothing else, and no network: the sandbox has no route out, so you cannot download weights or phone home.
• Missing rows score as benign. Probabilities are thresholded at 0.5 if you emit them, but you are better off choosing your own cut.

• Metric is macro F1 over both classes.
• 30% of test rows are the public split shown on the leaderboard. The rest are hidden.
• The flag needs your hidden score within 0.030 of that round's par, and never below 0.900.
• 40 runs per round, 60s apart. Grid-searching the leaderboard is not a strategy.

• Attacking the arena is out of scope. The flag is not on the box your code runs on — the labels and the flag never enter the sandbox.
• Do not try to reach other teams' containers or the Docker daemon. This is a modelling challenge; it is scored as one.
• Deterministic, self-contained code only. No fetching anything at runtime; there is nowhere to fetch from.