from pcapx.core.detections.utils import shannon_entropy

def detect_dns_behavior(dns_queries):
    findings = []

    for q in dns_queries:
        label = q.split(".")[0]
        entropy = shannon_entropy(label)

        if len(label) > 20 and entropy > 4.0:
            findings.append({
                "behavior": "HIGH_ENTROPY_DNS",
                "domain": q,
                "entropy": round(entropy, 2)
            })

    return findings
