DNS Tunneling Detection by Cache-Property-Aware Features

Abstract

Many enterprises are under threat of targeted attacks aiming at data exfiltration. To launch such attacks, in recent years, attackers with their malware have exploited a covert channel that abuses the domain name system (DNS) named DNS tunneling. Although several research efforts have been made to detect DNS tunneling, the existing methods rely on features that advanced tunneling techniques can easily obfuscate by mimicking legitimate DNS clients. Such obfuscation would result in data leakage. To tackle this problem, we focused on a "trace" left by DNS tunneling that cannot be easily hidden. In the context of data exfiltration by DNS tunneling, the malware connects directly to the DNS cache server and the generated DNS tunneling queries produce cache misses with absolute certainty. In this study, we propose a DNS tunneling detection method based on the cache-property-aware features. Our experiments show that one of the proposed features can efficiently characterize the DNS tunneling traffic. Furthermore, we introduce a rule-based filter and a long short-term memory (LSTM)-based filter using this proposed feature. The rule-based filter achieves a higher rate of DNS tunneling attack detection than the LSTM one, which instead detects the attack more quickly, while both maintain a low misdetection rate.

Cybersecurity Alert Prioritization in a Critical High Power Grid With Latent Spaces

“…The aggregation of alerts is a crucial aspect of attack prevention [40]- [42]. One singular incident, such as a gratuitous ARP or a single scan, could hint that an attack is in progress if it belongs to a sequence.…”

Transparent Forwarders: An Unnoticed Component of the Open DNS Infrastructure

“…Also, they differ from DNS redirection, which changes response records for the sake of advertisement [24,41] or censorship [5,25]. Lastly, they are not part of DNS tunneling, which carries ancillary information [19] not related to name resolution.…”

Identificação De Túneis DNS Em Nuvem Computacional Usando Detecção De Anomalias

“…Wang et al (2021) abordou várias técnicas de detecção de tunelamento DNS entre 2006 e 2020, classificando parâmetros entre pacotes e fluxos DNS, assim como diferenciando os métodos de detecção entre regras, assinaturas e baseados em ML. Bai et al (2021) e Ishikura et al (2021) focaram na combinação eficiente entre seleção e extração de parâmetros identificadores de tunelamento DNS e algoritmos com o maior nível de acurácia possível. Em Chen et al (2021), houve a definição de duas categorias de parâmetros: pacotes DNS, processados em tempo real e em sessões DNS, que dispensam análise de carga útil dos pacotes, porém com alta complexidade computacional.…”

“…Time-to-live TTL: é importante que o tráfego DNS encapsulado tenha o menor TTL possível para que as solicitações ao domínio malicioso não sejam armazenadas em cache no resolvedor local, forçando altas taxas de cache miss (falha em encontrar o subdomínio nos registros do servidor resolvedor), Ishikura et al 2021.…”

“…Através dos túneis C2 é possível a transferência de comandos remotos entre o atacante e a máquina afetada, além da manipulação de dados privados de forma indevida. (Ishikura et al, 2021).…”