DNS Tunneling Detection Techniques – Classification, and Theoretical Comparison in Case of a Real APT Campaign

Abstract

Domain Name System (DNS) plays an important role as a translation protocol in everyday use of the Internet. The purpose of DNS is to translate domain names into IP addresses and vice versa. However, its simple architecture can easily be misused for malicious activities. One huge security threat concerning DNS is tunneling, which helps attackers bypass the security systems unnoticed. A DNS tunnel can be used for three purposes: as a command and control channel, for data exfiltration or even for tunneling another protocol through it. In this paper, we surveyed different techniques for DNS tunneling detection. We classified those first based on the type of data and then within the categories based on the type of analysis. We conclude with a comparison between the various detection techniques. We introduce one real Advanced Persistent Threat campaign that utilizes DNS tunneling, and theoretically compare how well the surveyed detection techniques could detect it.

Intrusion and Anomaly Detection in Industrial Automation and Control Systems

“…DNS tunneling is one of the techniques that allow creating a two-way communication channel by encoding data on both DNS queries (as part of the queried domain name) and DNS responses (in the resource record data). Various ML-based approaches have been proposed in the literature for detecting DNS tunneling, mainly using payload analysis (based on packet header fields) or traffic analysis (based on DNS session metrics) [Yassine et al, 2018] [Nadler et al, 2019] [Nuojua et al, 2017] [Yu et al, 2016. The remaining of this section discusses how those techniques can be leveraged in the proposed framework.…”

“…Each record was labeled and marked as anomalous if either the request or response contains one of the malicious domain names -therefore, this feature was not considered for any algorithm. The full list of used features, in line with previous works [Yassine et al, 2018] [ Nadler et al, 2019] [Nuojua et al, 2017] [Yu et al, 2016, is enumerated in Table 6.2. Their feature histograms, depicted in Figures 6.8, 6.9 and 6.10, show their pairwise distribution.…”

Detection of Application-Layer Tunnels with Rules and Machine Learning

“…In order to avoid being identified, attackers usually build a covert channel in the form of an application-layer tunnel to implement C&C communications. Therefore, many kinds of network threats can be detected by identifying application-layer tunnels [1]. The application-layer tunnel refers to encapsulating data packets of a protocol into the payload of the data packets of an application layer protocol and is in a form of "Protocol over Protocol" [2][3][4].…”