Detecting DNS Tunneling Using Ensemble Learning

Abstract

Domain Name System (DNS) is one of the building blocks of the Internet that plays the key role of translating domain names into IP addresses. DNS can be vulnerable to security threats affecting DNS servers or exploiting the DNS protocol. In this paper, we address DNS protocol exploitation that causes data breaches via DNS tunneling, where an attacker employs techniques to exfiltrate sensitive data from a victim network. This usually happens by breaking the target data into small chunks and encoding them into DNS queries. The malicious DNS queries are then communicated from the target to the attacker machine. These DNS queries will finally be decoded and put together at the attacker side to recover the breached data. Since DNS is a fundamental service, it cannot be blocked in order to mitigate these DNS tunneling attacks. Conventional signature-based intrusion detection systems are not very effective to detect these anomalies, either. Using some of the available DNS tunneling tools we first show how this phenomenon can occur. Then, we discuss our technique which employs a special ensemble of machine learning algorithms to build a robust classifier to detect such attacks. Our ensemble classifier achieves high accuracy and near-zero false positives on a training set based on real benign data and generated malicious DNS traffic.