1. A method comprising: constructing, from a record of a packet in a Domain Name System (DNS) communication between a DNS client and a DNS server, an input feature; computing, using the packet, a metadata item supporting the input feature; classifying, using a processor and a memory to execute a trained cognitive classification model, and by supplying the input feature and the supporting metadata item as inputs to the cognitive classification model, a transmission of the packet as malicious use of DNS tunneling between the DNS client and the DNS server; outputting, from the cognitive classification model, a classification of the packet as malicious, and a confidence value in the malicious classification; and causing, by generating a notification, the DNS client to cease the malicious use of the DNS tunneling.