DNS Tunneling Research Articles

A Long Short Term Memory Model for Character-based Analysis of DNS Tunneling Detection

DNS tunneling is the attempt to create a hidden tunnel through a domain name service. Such a tunnel would jeopardize the targeted network and open the door for illegal access, control, and data exfiltration. The information security research community showed the variety of techniques that have been proposed to detect the tunnel. The majority of these efforts were relying on machine learning techniques where features of tunneling are considered such as length of DNS query, size, and entropy of the query. However, an additional analysis of the lexical information of the DNS query has been depicted recently and showed remarkable performance. This paper aims to examine the role of Long Short Term Memory (LSTM) model in terms of DNS lexical analysis. Two benchmark datasets related to DNS have been used. In addition, a character mapping mechanism has been used to replace every possible character with an integer number. Consequentially, the mapped representation has been fed into an LSTM model for DNS tunneling detection. Results showed that the proposed method was able to obtain a weighted average F1-score of 98% for both datasets respectively. Such results are competitive in the context of the state of the art and demonstrate the efficacy of the lexical analysis within the DNS tunneling detection task.

Conformal predictions for probabilistically robust scalable machine learning classification

Conformal predictions make it possible to define reliable and robust learning algorithms. But they are essentially a method for evaluating whether an algorithm is good enough to be used in practice. To define a reliable learning framework for classification from the very beginning of its design, the concept of scalable classifier was introduced to generalize the concept of classical classifier by linking it to statistical order theory and probabilistic learning theory. In this paper, we analyze the similarities between scalable classifiers and conformal predictions by introducing a new definition of a score function and defining a special set of input variables, the conformal safety set, which can identify patterns in the input space that satisfy the error coverage guarantee, i.e., that the probability of observing the wrong (possibly unsafe) label for points belonging to this set is bounded by a predefined ε\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\\varepsilon$$\\end{document} error level. We demonstrate the practical implications of this framework through an application in cybersecurity for identifying DNS tunneling attacks. Our work contributes to the development of probabilistically robust and reliable machine learning models.

DNS tunnels detection via DNS-images

DNS tunneling is a typical attack adopted by cyber-criminals to compromise victims’ devices, steal sensitive data, or perform fraudulent actions against third parties without their knowledge. The fraudulent traffic is encapsulated into DNS queries to evade intrusion detection. Unfortunately, traditional defense systems based on Deep Packet Inspection cannot always detect such traffic. As a result, DNS tunneling is one problem that has worried the cybersecurity community over the past decade.In this paper, we propose a robust and reliable Deep Learning-based DNS tunneling detection approach to mine valuable insight from DNS query payloads. More precisely, several features are first extracted by the DNS flow, and then they are arranged as bi-dimensional images. A Convolutional Neural Network is used to automatically and adaptively learn spatial hierarchies of features to be used in a fully connected neural network for traffic classification. The proposed approach may result in an extremely interesting task in predictive security approaches to attack detection.The effectiveness of the proposal is evaluated in several experiments using a real-world traffic dataset. The obtained results show that our approach achieves 99.99% of accuracy and performs better than state-of-the-art solutions.

Detecting DNS over HTTPS based data exfiltration

DNS is often used by attackers as a covert channel for data exfiltration, also known as DNS tunneling. Since the plaintext DNS lookup leads to privacy issues, DNS over HTTPS (DoH) has recently been standardized and deployed. DoH encapsulates DNS in HTTPS to encrypt DNS traffic between clients and recursive resolvers. Attackers can also use DoH for subtle data exfiltration. However, existing DNS tunneling detection methods for plaintext DNS are usually ineffective for DoH tunneling. In this paper, we propose a method to detect DoH-based data exfiltration. We analyze TLS fingerprints of DoH clients and build classifiers with flow-based features to detect DoH tunneling. Our experiment discusses the influence of various factors on the detection results in detail, including adversarial considerations by exploring the potential evasion. Experimental results demonstrate that the proposed method is effective, and it is very difficult to evade detection due to the difficulty of feature imitation. Besides, our method can still provide the defender with helpful information for attack investigation even if the attacker evades detection.

Использование DNS-туннелирования для передачи вредоносного программного обеспечения

Purpose of the article: to develop a way to increase the level of protection of an information system from an attack using DNS tunneling. Method: using entropy to identify domains and subdomains used when transferring data through a DNS tunnel. The result: a method of data transmission through the DNS protocol bypassing the information security tools is considered. A malicious file was transferred using DNS tunneling, and an analysis was made of the operation of information protection tools during transmission. Information security tools do not detect the transfer of a malicious file via the DNS protocol, but they do if it is transferred in clear text. The concept of information entropy, its role in data processing is given. By calculating the entropy for domain names, the domain used in the transmission of a malicious file through the DNS tunnel was identified. It is concluded that entropy can be used not only to detect data transfer through the DNS tunnel, but also to detect the activity of malicious software that uses random domain and subdomain names in its work. The scientific novelty lies in the fact that malicious activity is detected without using the knowledge base. There is no need to signature check each DNS request, it is enough to calculate the entropy to detect an attack.

Application of Artificial Intelligence to Network Forensics: Survey, Challenges and Future Directions

Network forensics focuses on the identification and investigation of internal and external network attacks, the reverse engineering of network protocols, and the uninstrumented investigation of networked devices. It lies at the intersection of digital forensics, incident response and network security. Network attacks exploit software and hardware vulnerabilities and communication protocols. The scope of a network forensic investigation can range from Internet-wide down to a single device’s network traffic. Network analysis tools (NATs) aid security professionals and law enforcement in the capturing, identification and analysis of network traffic. However, in most instances, the sheer volume of data to be analyzed is enormous and, despite some built-in NAT automation, the investigation of network traffic is often an arduous process. Furthermore, significant expert time remains wasted in the investigation of a high frequency of false positive alerting from automated systems. To address this globally impacting problem, artificial intelligence based approaches are becoming increasingly employed to automatically detect attacks and increase network traffic classification accuracy. This paper provides a comprehensive survey of the state-of-the-art in network forensics and the application of expert systems, machine learning, deep learning, and ensemble/hybrid approaches to a range of application areas in the field. These include network traffic analysis, intrusion detection systems, Internet-of-Things devices, cloud forensics, DNS tunneling, smart grid forensics, and vehicle forensics. In addition, the current challenges and future research directions for each of the aforementioned application areas is discussed.

Novel Approach for Dns Tunneling Attack Detection Using Image Classification

Novel Approach for Dns Tunneling Attack Detection Using Image Classification

Detecting Malicious DNS Queries Over Encrypted Tunnels Using Statistical Analysis and Bi-Directional Recurrent Neural Networks

The exponential rise in the number of malicious threats targeting computer networks and digital services puts network infrastructure in jeopardy. Domain name protocol attacks are one of the most pervasive network attacks posing a threat to networks, whereby attackers send harmful information to the network; this type of threat is identified as DNS tunneling. The DNS protocol has recently gained increased attention from cyber-attackers, targeting organizations with a web presence or reliance on e-commerce businesses. Cyber-attackers can subtly exploit the contents of encrypted DNS packets that are sent across covert network tunnels, which are difficult for firewalls and blacklist detection methods to detect. Therefore, efficient methods for detecting DNS intrusions in the network are required. Machine learning (ML), deep learning (DL), and computational intelligence models have proved to be increasingly effective in dealing with these cyber-attacks, especially when using an appropriate dataset. This paper proposes an intrusion detection model to detect malicious DNS over HTTPS (DoH) queries among network covert tunnels, using statistical analysis and Bi-directional Recurrent Neural Network (BRNN) techniques, based on the flow level of the network traffic. The proposed approach was tested and evaluated based on a realistic dataset called CIRA-CIC-DoHBrw-2020, provided by the Canadian Institute for Cybersecurity. Experiments have shown that the robustness of the model is strong, with a detection rate of 100%. Furthermore, the proposed model achieved high performance in terms of the accuracy rate in detecting malicious DoH queries, with low false-negative and false-positive rates. Furthermore, the number of features used is fewer than other approaches, making it perform faster in the training and testing phases.

A hybrid method of genetic algorithm and support vector machine for DNS tunneling detection

With the expansion of the business over the internet, corporations nowadays are investing numerous amounts of money in the web applications. However, there are different threats could make the corporations vulnerable for potential attacks. One of these threats is harnessing the domain name protocol for passing harmful information, this kind of threats is known as DNS tunneling. As a result, confidential information would be exposed and violated. Several studies have investigated the machine learning in order to propose a detection approach. In their approaches, authors have used different and numerous types of features such as domain length, number of bytes, content, volume of DNS traffic, number of hostnames per domain, geographic location and domain history. Apparently, there is a vital demand to accommodate feature selection task in order to identify the best features. This paper proposes a hybrid method of genetic algorithm feature selection approach with the support vector machine classifier for the sake of identifying the best features that have the ability to optimize the detection of DNS tunneling. To evaluate the proposed method, a benchmark dataset of DNS tunneling has been used. Results showed that the proposed method has outperformed the conventional SVM by achieving 0.946 of f-measure

Development of a Robust Cooperative Adaptive Cruise Control With Dynamic Topology

This research proposed a robust Cooperative Adaptive Cruise Control (CACC) to overcome the shortcoming of the existing CACC controllers in dealing with unexpected events, such as malware attack, phishing attack, and DNS tunneling attack, where perception and data received via communication contradict with the reality. The proposed controller combines the advantage of two information flow topologies – All-Predecessor Following (APF) and Predecessor-Leader Following (PLF) control methods – to improve the capability of CACC platoons. The string stability of the proposed CACC controller was proven. The robustness to time delay switch (TDS) attacks was assessed using simulation. The normal cruise was simulated to show the capability of the proposed controller in a wide range of speeds. TDS attacks, which encompassed four different unexpected events, were tested to verify the robustness of the proposed CACC. Results confirmed that the proposed CACC controller is string stable and robust against these TDS attacks without crashing or causing jerks. It also showed that the proposed CACC controller outperformed a state-of-the-art CACC controller.

Methods for detecting bot nets in computer systems

Object. The process of the botnets detection in the corporate area networks based on network traffic analysis and on the of computer systems software’s behavior. Subject. Methods for botnets detection in computer systems. Goal. Increasing of the botnet detection efficiency by developing new methods for its detection in the corporate networks. Results. A new approach for the botnet detection in the corporate area networks based on the analysis of the bots’ behavior is proposed. The detection of botnets is accomplished by applying the developed two methods: by means of network-level and host-level analysis. The first method allows you to analyze the behavior of the software on the host, which may indicate the possible presence of the bot directly on the host and the detection of malicious software, while the second method involves monitoring and analysis of DNS traffic, which also allows to make a conclusion about infection of network hosts with botnets. Based on the proposed methods, an effective tool for botnet detection - BotGRABBER - was developed. It is capable of detecting bots that use such evasion methods as IP mapping, fast flux, domain flux, and DNS tunneling. Conclusions. The usage of the developed system allows to detect the hosts infected with botnet and localize malware with high efficiency - up to 96%, and also shows low rate of false positives 3-5%. A feature of the proposed approach is that the detection of botnets is "invisible" to botnet owners.

DNS Tunneling: a Review on Features

One of the significant threats that faces the web nowadays is the DNS tunneling which is an attack that exploit the domain name protocol in order to bypass security gateways. This would lead to lose critical information which is a disastrous situation for many organizations. Recently, researchers have pay more attention in the machine learning techniques regarding the process of DNS tunneling. Machine learning is significantly impacted by the utilized features. However, the lack of benchmarking standard dataset for DNS tunneling, researchers have captured the features of DNS tunneling using different techniques. This paper aims to present a review on the features used for the DNS tunneling.

DNS Tunneling Detection Method Based on Multilabel Support Vector Machine

DNS tunneling is a method used by malicious users who intend to bypass the firewall to send or receive commands and data. This has a significant impact on revealing or releasing classified information. Several researchers have examined the use of machine learning in terms of detecting DNS tunneling. However, these studies have treated the problem of DNS tunneling as a binary classification where the class label is either legitimate or tunnel. In fact, there are different types of DNS tunneling such as FTP-DNS tunneling, HTTP-DNS tunneling, HTTPS-DNS tunneling, and POP3-DNS tunneling. Therefore, there is a vital demand to not only detect the DNS tunneling but rather classify such tunnel. This study aims to propose a multilabel support vector machine in order to detect and classify the DNS tunneling. The proposed method has been evaluated using a benchmark dataset that contains numerous DNS queries and is compared with a multilabel Bayesian classifier based on the number of corrected classified DNS tunneling instances. Experimental results demonstrate the efficacy of the proposed SVM classification method by obtaining an f-measure of 0.80.

Exploitation of DNS Tunneling for Optimization of Data Exfiltration in Malware-free APT Intrusions

One of the main goals of targeted attacks include data exfiltration. Attackers penetrate systems using various forms of attack vectors but the hurdle comes in exfiltrating the data. APT attackers even reside in a host for long periods of time whilst seeking the best option to exfiltrate data. Most data exfiltration techniques are prone to detection by intrusion detection system. Therefore, data exfiltration methodologies that generate little noise if any at all are attractive to attackers and can go undetected for long periods owing the low threshold of generated noise in form network traffic and system calls. In this paper, we present malware-free intrusion, an attack methodology which does not explicitly use malware to exfiltrate data. Our attack structure exploits the use of system services and resources not limited to RDP, PowerShell, Windows accessibility backdoor and DNS tunneling. Results show that it’s possible to exfiltrate data from vulnerable hosts using malwarefree intrusion as an infection vector and DNS tunneling as a data exfiltration technique. We test the attack on both Windows and Linux system over different networks. Mitigation techniques are suggested based on traffic analysis captured from the established secure DNS tunnels on the network.

Profiling DNS tunneling attacks with PCA and mutual information

Profiling DNS tunneling attacks with PCA and mutual information

Performance assessment and analysis of DNS tunneling tools

DNS tunnels are built by proper tools that allow embedding data on DNS queries and responses. Each tool has its own strategies that affect the network performance in a unique way. In this article, we propose an architectural analysis of the current state-of-the-art of DNS tunneling tools. Then, we provide a comparative evaluation of such tools in term of performance, as a first step towards the possibility to relate each tool with a specific pattern of the DNS traffic. To this aim, we define an assessment of the tools in three different network configurations based on three performance metrics. We finally analyse the testing results and provide a first characterization of the performance of each tool.