DNSxD: Detecting Data Exfiltration Over DNS

Abstract

According to a 2017 SANS report, 1 in 20 organisations fall victim to data exfiltration. Data exfiltration, often the final stage of a cyber attack has damaging consequences for the victim organisation. The use of the Domain Name System (DNS) protocol for data exfiltration was first discussed in 1998. Twenty years on, this covert transmission method has become more sophisticated as malicious actors adapt to evade detection techniques. The popularity of DNS for data exfiltration is due to the essential nature of the protocol for network communication. This paper addresses the issue of DNS-based data exfiltration proposing a detection and mitigation method leveraging the Software-Defined Network (SDN) architecture. Popular DNS data exfiltration attacks and current exfiltration detection mechanisms are analysed to generate a feature-set for DNS data exfiltration detection. The DNSxD application is presented and its performance evaluated in comparison with the current exfiltration detection mechanisms.

DNS Tunneling Detection by Cache-Property-Aware Features

“…This is because our goal was to prevent information leakage by detecting DNS clients infected with malware in targeted attacks. As discussed in Section II-C, some researchers have focused on domain names and proposed filters whose design guideline was to identify the domain names used to perform DNS tunneling [11], [14], [18], [20], [21]. The shortcoming of such methods is that they fail when the attackers and their malware change tactics and utilize several domain names for the attacks.…”

“…DET [38] [20], [23], [24] DNScat [39] or DNScat2 [26] [12], [17], [18], [20], [22], [24] DNSExfiltrator [40] [20], [24] DNSMessenger [41] [23] DNSpionage [42] [23] dns2tcp [33] [9], [15], [16], [21], [22], [24] FrameworkPOS [43] [21], [23] iodine [32]…”

“…During a DNS tunneling attack, the cache hit ratio is expected to decrease because the malicious DNS queries generated to exfiltrate data cause cache misses, as discussed in Section II-A. To the best of our knowledge, this characteristic of DNS tunneling has not been [11], [17], [20] P Ratio of numerical characters to total characters in FQDN [17] P Time interval between query and response [17] P Time interval between responses of specific domain [17] P Access counts of resource records [14], [17] T Averages and variances of query size, response size, and time interval between a query and its response [15], [ [11], [14], [18], [20], [21]…”

Cache-Property-Aware Features for DNS Tunneling Detection

“…The payload analysis is an evaluation of a DNS query and/or the corresponding DNS response, while the traffic analysis is an evaluation of DNS traffic over a monitoring period (e.g., in terms of time, number of samples, etc.). The features of interest in payload analysis are, for example, unigram or bigram character frequencies of domains or subdomains [4], [5], FQDN length [11], [15], entropy [11], [13], [15], the first 512 bytes of a DNS response [12], and the number of labels [15]. Regarding traffic analysis, the usual features of interest are, for example, the number of flows [6], Jensen-Shannon divergence computed from DNS query payloads [7], access counts of resource records [8], average time interval between a query and its response [9], a combination of Principal Component Analysis (PCA) and mutual information [10], the number of queries per domain [13], and average query length per domain [14].…”

“…The features of interest in payload analysis are, for example, unigram or bigram character frequencies of domains or subdomains [4], [5], FQDN length [11], [15], entropy [11], [13], [15], the first 512 bytes of a DNS response [12], and the number of labels [15]. Regarding traffic analysis, the usual features of interest are, for example, the number of flows [6], Jensen-Shannon divergence computed from DNS query payloads [7], access counts of resource records [8], average time interval between a query and its response [9], a combination of Principal Component Analysis (PCA) and mutual information [10], the number of queries per domain [13], and average query length per domain [14]. These features are fed to machine learning models or used as thresholds to build countermeasures for DNS tunneling detection.…”