A DNS Tunneling Detection Method Based on Deep Learning Models to Prevent Data Exfiltration

Zhang, Jiacheng; Li, Yang; Yu, Shui; Ma, Jianfeng

doi:10.1007/978-3-030-36938-5_32

Cited by 20 publications

(6 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Compute-intensive detection methods. In recent years, deep learning-based (DL) DNS exfiltration detection methods have been proposed [30], [20], [21]. Chen et al [21] proposed a DL architecture based on the combination of a CNN and LSTM models.…”

Section: Offline Detection Methods By Designmentioning

confidence: 99%

Information Based Heavy Hitters for Real-Time DNS Data Exfiltration Detection

Ozery,

Nadler,

Shabtai

2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Data exfiltration over the DNS protocol and its detection have been researched extensively in recent years. Prior studies focused on offline detection methods, which although capable of detecting attacks, allow a large amount of data to be exfiltrated before the attack is detected and dealt with. In this paper, we introduce Information-based Heavy Hitters (ibHH), a real-time detection method which is based on live estimations of the amount of information transmitted to registered domains. ibHH uses constant-size memory and supports constant-time queries, which makes it suitable for deployment on recursive DNS servers to further reduce detection and response time. In our evaluation, we compared the performance of the proposed method to that of leading state-of-the-art DNS exfiltration detection methods on real-world datasets comprising over 250 billion DNS queries. The evaluation demonstrates ibHH's ability to successfully detect exfiltration rates as slow as 0.7B/s, with a false positive alert rate of less than 0.004, with significantly lower resource consumption compared to other methods.

show abstract

Section: Offline Detection Methods By Designmentioning

confidence: 99%

Information Based Heavy Hitters for Real-Time DNS Data Exfiltration Detection

Ozery,

Nadler,

Shabtai

2024

Proceedings 2024 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

show abstract

“…The results of the hidden layers reach a single node output layer with a sigmoid activation function. Similar to [9], we use integer encoding with padding on the prefix as input to the CNN model.…”

Section: Methodsmentioning

confidence: 99%

Malicious DNS Tunneling Detection in Real-Traffic DNS Data

Lambion

Josten

Olumofin³

et al. 2020

2020 IEEE International Conference on Big Data (Big Data)

View full text Add to dashboard Cite

While originally not intended for data transfer, the Domain Name System (DNS) is currently used to this end anyway, in a process called DNS tunneling (DNST). Malicious users exploit DNST for data exfiltration from infected machines, posing a critical security threat. We train and evaluate state-of-the-art convolutional neural network, random forest, and ensemble classifiers to detect tunneling in DNS traffic. Finally, we assess the classifiers' performance and robustness by exposing them to one day of real-traffic data.

show abstract

“…The proposed approach is evaluated using a dataset of real-world DNS traffic and shows promising results in detecting DNS tunneling attacks with high accuracy. The work of [28] applies both Convolutional Neural Networks (CNNs) and Recurrent Neural Networks (RNNs) for detecting DNS tunneling traffic. The authors have shown that these algorithms can effectively spot and identify malicious patterns.…”

Section: Related Workmentioning

confidence: 99%

Towards a Near-Real-Time Protocol Tunneling Detector Based on Machine Learning Techniques

Sobrero,

Clavarezza,

Ucci

et al. 2023

JCP

View full text Add to dashboard Cite

In the very recent years, cybersecurity attacks have increased at an unprecedented pace, becoming ever more sophisticated and costly. Their impact has involved both private/public companies and critical infrastructures. At the same time, due to the COVID-19 pandemic, the security perimeters of many organizations expanded, causing an increase in the attack surface exploitable by threat actors through malware and phishing attacks. Given these factors, it is of primary importance to monitor the security perimeter and the events occurring in the monitored network, according to a tested security strategy of detection and response. In this paper, we present a protocol tunneling detector prototype which inspects, in near real-time, a company’s network traffic using machine learning techniques. Indeed, tunneling attacks allow malicious actors to maximize the time in which their activity remains undetected. The detector monitors unencrypted network flows and extracts features to detect possible occurring attacks and anomalies by combining machine learning and deep learning. The proposed module can be embedded in any network security monitoring platform able to provide network flow information along with its metadata. The detection capabilities of the implemented prototype have been tested both on benign and malicious datasets. Results show an overall accuracy of 97.1% and an F1-score equal to 95.6%.

show abstract

A DNS Tunneling Detection Method Based on Deep Learning Models to Prevent Data Exfiltration

Cited by 20 publications

References 12 publications

Information Based Heavy Hitters for Real-Time DNS Data Exfiltration Detection

Information Based Heavy Hitters for Real-Time DNS Data Exfiltration Detection

Malicious DNS Tunneling Detection in Real-Traffic DNS Data

Towards a Near-Real-Time Protocol Tunneling Detector Based on Machine Learning Techniques

Contact Info

Product

Resources

About