Unsupervised learning and rule extraction for Domain Name Server tunneling detection

Abstract

The paper deals with k-means clustering and logic learning machine (LLM) for the detection of Domain Name Server (DNS) tunneling. As the LLM shows more versatility in rule generation and classification precision with respect to traditional decision trees, the approach reveals to be robust to a large set of system conditions. The detection algorithm is designed to be applied over streaming data, without accurate tuning of algorithms' parameters. An extensive performance evaluation is provided with respect to different tunneling tools and applications; silent intruders are considered. Results show robustness on a test set that exhibits a different behavior from training. KEYWORDS covert channel, rule extraction, unsupervised learning 1 Internet Technology Letters. 2019;2:e85.wileyonlinelibrary.com/journal/itl2

Rule-based Out-Of-Distribution Detection

“…Splits are generated continuously, as soon as new samples are collected. Incremental techniques may be also used to accelerate the computation of statistically-based features (mean, variance, skewness and kurtosis), as in the RUL and DNS problems detailed later on [23]. Like in incremental techniques, once a new sample is available, a new (operational) bunch of n s samples is built, by adding the new sample and by disregarding the most far away point in the past (of n s positions).…”