Использование DNS-туннелирования для передачи вредоносного программного обеспечения

Abstract

Purpose of the article: to develop a way to increase the level of protection of an information system from an attack using DNS tunneling. Method: using entropy to identify domains and subdomains used when transferring data through a DNS tunnel. The result: a method of data transmission through the DNS protocol bypassing the information security tools is considered. A malicious file was transferred using DNS tunneling, and an analysis was made of the operation of information protection tools during transmission. Information security tools do not detect the transfer of a malicious file via the DNS protocol, but they do if it is transferred in clear text. The concept of information entropy, its role in data processing is given. By calculating the entropy for domain names, the domain used in the transmission of a malicious file through the DNS tunnel was identified. It is concluded that entropy can be used not only to detect data transfer through the DNS tunnel, but also to detect the activity of malicious software that uses random domain and subdomain names in its work. The scientific novelty lies in the fact that malicious activity is detected without using the knowledge base. There is no need to signature check each DNS request, it is enough to calculate the entropy to detect an attack.