DNS Tunnels Research Articles

An ontological approach to the detection of anomalies in vehicular ad hoc networks

In a vehicular environment, by becoming connected, vehicles are subject to more threats in comparison to traditional information systems, with the difference that, as a cyber-physical system, anomalies and intrusions could have repercussions in the physical world. In this work, we have developed an ontological anomaly-detection approach (OADA). The anomalies studied in this work mainly concern: network scans, DNS tunnel attacks, and telemetry data anomalies. Our contribution relates to a study of the attributes of interest for the algorithm used during the detection phase, namely the hierarchical temporal memory algorithm (HTM). The packets exchanged by the vehicle are grouped in instant description windows. These windows are then analyzed to extract a set of attributes. These are linked to the properties of network traffic, such as flow or latency. They are subject to the process of detecting anomalies and intrusions, carried out thanks to the algorithm with HTM. For each entry, the algorithm produces a score that allows us to decide if a window is abnormal and to lift an alert if that is the case. We evaluated our system using a communications and anomalies emulation tool. We use the corpus of data produced thanks to Autobot. We seek to determine from among the best scores of Matthews correlation coefficient (MCC) and Detection efficiency score (DES) which were the parameters for which HTM detects all anomalies with the greatest possible coverage. The obtained results prove that HTM can detect all anomalies for each window duration.

GraphTunnel: Robust DNS Tunnel Detection Based on DNS Recursive Resolution Graph

GraphTunnel: Robust DNS Tunnel Detection Based on DNS Recursive Resolution Graph

Real time detection of malicious DoH traffic using statistical analysis

The DNS protocol plays a fundamental role in the operation of ubiquitous networks. All devices connected to these networks need DNS to work, both for traditional domain name to IP address translation, and for more advanced services such as resource discovery. DNS over HTTPS (DoH) solves certain security problems present in the DNS protocol. However, malicious DNS tunnels, a covert way of encapsulating malicious traffic in a DNS connection, are difficult to detect because the encrypted data prevents performing an analysis of the content of the DNS traffic.In this study, we introduce a real-time system for detecting malicious DoH tunnels, which is based on analyzing DoH traffic using statistical methods. Our research demonstrates that it is feasible to identify in real-time malicious traffic by analyzing specific parameters extracted from DoH traffic. In addition, we conducted statistical analysis to identify the most significant features that distinguish malicious traffic from benign traffic. Using the selected features, we achieved satisfactory results in classifying DoH traffic as either benign or malicious.

DNS tunnelling detection by fusing encoding feature and behavioral feature

For a long time, DNS tunnels have played a pivotal role in advanced persistent threat (APT) attacks, posing a threat to the real-world network environment. Existing approaches either use single packets or grouped packets as the basic unit for detecting DNS tunnelling traffic. Currently, single-packet-based methods usually focus on the encoding features of the DNS packet payload, which results in a high false alarm rate in real-world environments. Approaches using grouped-packets as the basis detection unit are difficult to apply to real-time inspection environments and cannot perform a finer-grained inspection of packets. To address these issues, we propose a DNS tunnelling detection method that uses a combination of encoding and behavioral features on DNS query & response pairs (Q&R). Q&R pairs achieve good balance between the information conveyed and the detection time required. We then train a powerful XGBoost classifier to fuse the features and conduct the classification of benign DNS traffic and DNS tunnelling traffic. We evaluate our approach with an authoritative DNS dataset (the base dataset) and a generalized test dataset that we curated with real-world attack simulations and collections of secure enterprise traffic. Our method achieves 99.68% accuracy on the base dataset and 98.82% accuracy on the generalized test dataset, which is better than the compared state-of-art methods. The efficiency is 66.77% higher than the baseline grouped-packets-based method. We also test our method in a real-world network environment and detect 7 malicious DNS tunnelling events.

Data Exfiltration Detection on Network Metadata with Autoencoders

We designed a Network Exfiltration Detection System (NEDS) to detect data exfiltration as occurring in ransomware attacks. The NEDS operates on aggregated metadata, which is more privacy-friendly and allows analysis of large volumes of high-speed network traffic. The NEDS aggregates metadata from multiple, sequential sessions between pairs of hosts in a network, which captures exfiltration by both stateful and stateless protocols. The aggregated metadata include averages per session of both packet count, request entropy, duration, and payload size, as well as the average time between sequential sessions and the amount of aggregated sessions. The NEDS applies a number of autoencoder models with unsupervised learning to detect anomalies, where each autoencoder model targets different protocols. We trained the autoencoder models with real-life data collected at network sensors in the National Detection Network as operated by the National Cyber Security Centre in the Netherlands, and configured the detection threshold by varying the false positive rate. We evaluated the detection performance by injecting exfiltration over different channels, including DNS tunnels and uploads to FTP servers, web servers, and cloud storage. Our experimental results show that aggregation significantly increases detection performance of exfiltration that happens over longer time, most notably, DNS tunnels. Our NEDS can be applied to detect exfiltration either in near-real-time data analysis with limited false positive rates, or in captured data to aid in post-incident analysis.

Malicious DNS Tunnel Tool Recognition Using Persistent DoH Traffic Analysis

DNS over HTTPS (DoH) protocol can mitigate the risk of privacy breaches but makes it difficult to control network security services due to the DNS traffic encryption. However, since malicious DNS tunnel tools for the DoH protocol pose network security threats, network administrators need to recognize malicious communications even after the DNS traffic encryption has become widespread. In this paper, we propose a malicious DNS tunnel tool recognition system using persistent DoH traffic analysis based on machine learning. The proposed system can accomplish continuous knowledge updates for emerging malicious DNS tunnel tools on the machine learning model. The system is based on hierarchical machine learning classification and focuses on DoH traffic analysis. The evaluation results confirm that the proposed system is able to recognize the six malicious DNS tunnel tools in total, not only well-known ones, including dns2tcp, dnscat2, and iodine, but also the emerging ones such as dnstt, tcp-over-dns, and tuns with 98.02% classification accuracy.

KRTunnel: DNS channel detector for mobile devices

Nowadays, DNS channel attacks on mobile devices have become a challenging threat. Attackers usually attack mobile devices and steal information with the help of DNS channel. It is difficult for users to detect this kind of attack, especially when attackers covert sensitive information in the DNS response. In this paper, we proposed a method for DNS tunnel detection based on isolated forest for Android. We constructed a framework for mobile devices to collect DNS tunnel traffic. Based on the analysis of DNS tunnel traffic generated on mobile devices, we extracted features based on DNS request and response and constructed the feature set. We proposed a DNS tunnel detector, KRTunnel, for mobile devices. Experiments showed that KRTunnel can identify unseen DNS tunnel traffic with the accuracy of 98.1%.

DNS tunnels detection via DNS-images

DNS tunneling is a typical attack adopted by cyber-criminals to compromise victims’ devices, steal sensitive data, or perform fraudulent actions against third parties without their knowledge. The fraudulent traffic is encapsulated into DNS queries to evade intrusion detection. Unfortunately, traditional defense systems based on Deep Packet Inspection cannot always detect such traffic. As a result, DNS tunneling is one problem that has worried the cybersecurity community over the past decade.In this paper, we propose a robust and reliable Deep Learning-based DNS tunneling detection approach to mine valuable insight from DNS query payloads. More precisely, several features are first extracted by the DNS flow, and then they are arranged as bi-dimensional images. A Convolutional Neural Network is used to automatically and adaptively learn spatial hierarchies of features to be used in a fully connected neural network for traffic classification. The proposed approach may result in an extremely interesting task in predictive security approaches to attack detection.The effectiveness of the proposal is evaluated in several experiments using a real-world traffic dataset. The obtained results show that our approach achieves 99.99% of accuracy and performs better than state-of-the-art solutions.

Использование DNS-туннелирования для передачи вредоносного программного обеспечения

Purpose of the article: to develop a way to increase the level of protection of an information system from an attack using DNS tunneling. Method: using entropy to identify domains and subdomains used when transferring data through a DNS tunnel. The result: a method of data transmission through the DNS protocol bypassing the information security tools is considered. A malicious file was transferred using DNS tunneling, and an analysis was made of the operation of information protection tools during transmission. Information security tools do not detect the transfer of a malicious file via the DNS protocol, but they do if it is transferred in clear text. The concept of information entropy, its role in data processing is given. By calculating the entropy for domain names, the domain used in the transmission of a malicious file through the DNS tunnel was identified. It is concluded that entropy can be used not only to detect data transfer through the DNS tunnel, but also to detect the activity of malicious software that uses random domain and subdomain names in its work. The scientific novelty lies in the fact that malicious activity is detected without using the knowledge base. There is no need to signature check each DNS request, it is enough to calculate the entropy to detect an attack.

Application Behavior Identification in DNS Tunnels Based on Spatial-Temporal Information

Due to the capability of passing through heavily censored networks or gateway equipped with the traffic-monitoring module, DNS tunnel has been the dominant covert communication technique for command and control between the victim and the attacker in network attack events. Although the discovery of DNS tunnel has been intensively studied, the internal application behavior identification for DNS tunnels still remains a challenging problem. The fine-gained identification can help to reveal more behavior information wrapped in DNS tunnels. In this study, we investigate the spatial-temporal information from the raw packets to identify the internal application behaviors in DNS tunnels. Multi-dimensional features on packet length and timing for DNS tunnels with different internal application behaviors are incorporated with a machine-learning algorithm to identify the internal application behaviors in DNS tunnels. We consider 4 common types of application behaviors in our research, including browsing webpages, emailing, downloading data, and controlling the remote servers. The experimental results show that the proposed scheme can achieve higher identification accuracy with a much lower packet consuming rate when compared with the state-of-the-art internal protocol identification scheme. The experiment results depict that our proposed scheme is better in terms of F-score, which can reach 99% with only 100 packets.

Research on Application of Feature Analysis Method in DNS Tunnel Detection

Traditional DNS tunnel detection methods based on load analysis and traffic monitoring have a high false positive rate and cannot effectively respond to new DNS tunnel attacks. To this end, a log-based statistical method is proposed to detect DNS tunnel attacks. Compare and analyse the differences between DNS tunnel attack behaviours and normal DNS parsing behaviour from the perspective of DNS sessions, extract the multi-dimensional features dominated by cache hit ratios, compose DNS session evaluation vectors, and use random forest classification algorithms to construct DNS session evaluation vector detection classifiers A DNS tunnel attack detection model based on characteristic statistical behaviours is established. The actual test results show that this method has a small false positive rate and low false negative rate, and it also has a high detection ability for unknown DNS tunnel attacks.

Refined identification of hybrid traffic in DNS tunnels based on regression analysis

Refined identification of hybrid traffic in DNS tunnels based on regression analysis

Exploitation of DNS Tunneling for Optimization of Data Exfiltration in Malware-free APT Intrusions

One of the main goals of targeted attacks include data exfiltration. Attackers penetrate systems using various forms of attack vectors but the hurdle comes in exfiltrating the data. APT attackers even reside in a host for long periods of time whilst seeking the best option to exfiltrate data. Most data exfiltration techniques are prone to detection by intrusion detection system. Therefore, data exfiltration methodologies that generate little noise if any at all are attractive to attackers and can go undetected for long periods owing the low threshold of generated noise in form network traffic and system calls. In this paper, we present malware-free intrusion, an attack methodology which does not explicitly use malware to exfiltrate data. Our attack structure exploits the use of system services and resources not limited to RDP, PowerShell, Windows accessibility backdoor and DNS tunneling. Results show that it’s possible to exfiltrate data from vulnerable hosts using malwarefree intrusion as an infection vector and DNS tunneling as a data exfiltration technique. We test the attack on both Windows and Linux system over different networks. Mitigation techniques are suggested based on traffic analysis captured from the established secure DNS tunnels on the network.

Performance assessment and analysis of DNS tunneling tools

DNS tunnels are built by proper tools that allow embedding data on DNS queries and responses. Each tool has its own strategies that affect the network performance in a unique way. In this article, we propose an architectural analysis of the current state-of-the-art of DNS tunneling tools. Then, we provide a comparative evaluation of such tools in term of performance, as a first step towards the possibility to relate each tool with a specific pattern of the DNS traffic. To this aim, we define an assessment of the tools in three different network configurations based on three performance metrics. We finally analyse the testing results and provide a first characterization of the performance of each tool.

New research about covering communication based on protocol of IPSec over DNS

By discussing covering communication technology and the poor compatibility of IPSec protocol network,the paper proposed a new VPN protocol of IPSec over DNS based on IPSec tunnel and DNS tunnel,and analyzed its structure and procedure.The performance test data show that it provides a safer network security solution with the integration of these two technologies.