DNS Tunneling: a Review on Features

With the development of web applications nowadays, intrusions represent a crucial aspect in terms of violating the security policies. Intrusions can be defined as a specific change in the normal behavior of the network operations that intended to violate the security policies of a particular network and affect its performance. Recently, several researchers have examined the capabilities of machine learning techniques in terms of detecting intrusions. One of the important issues behind using the machine learning techniques lies on employing proper set of features. Since the literature has shown diversity of feature types, there is a vital demand to apply a feature selection approach in order to identify the most appropriate features for intrusion detection. This study aims to propose a hybrid method of Genetic Algorithm and Support Vector Machine. GA has been as a feature selection in order to select the best features, while SVM has been used as a classification method to categorize the behavior into normal and intrusion based on the selected features from GA. A benchmark dataset of intrusions (NSS-KDD) has been in the experiment. In addition, the proposed method has been compared with the traditional SVM. Results showed that GA has significantly improved the SVM classification by achieving 0.927 of f-measure.

Section: Introductionmentioning

confidence: 99%

A hybrid method of genetic algorithm and support vector machine for intrusion detection

Tally¹,

Amintoosi

2021

“…Regardless, DNS is still an imperative component within the world wide web for conducting necessary operations such as the surfing and communications [7]. Its key success is represented by providing flexible way for reaching out a specific server through a straightforward name instead of the complicated form of IP address [8][9][10][11][12]. For instance, rather than typing a long and complicated combinations of IP addresses such as '120.90.10.1', it is more convenient to type the 'ServerDomainName.com'.…”

Section: Introductionmentioning

confidence: 99%

A hybrid method of genetic algorithm and support vector machine for DNS tunneling detection

Al-Ibraheemi

AL-Ibraheemi²,

Amintoosi

2021

With the expansion of the business over the internet, corporations nowadays are investing numerous amounts of money in the web applications. However, there are different threats could make the corporations vulnerable for potential attacks. One of these threats is harnessing the domain name protocol for passing harmful information, this kind of threats is known as DNS tunneling. As a result, confidential information would be exposed and violated. Several studies have investigated the machine learning in order to propose a detection approach. In their approaches, authors have used different and numerous types of features such as domain length, number of bytes, content, volume of DNS traffic, number of hostnames per domain, geographic location and domain history. Apparently, there is a vital demand to accommodate feature selection task in order to identify the best features. This paper proposes a hybrid method of genetic algorithm feature selection approach with the support vector machine classifier for the sake of identifying the best features that have the ability to optimize the detection of DNS tunneling. To evaluate the proposed method, a benchmark dataset of DNS tunneling has been used. Results showed that the proposed method has outperformed the conventional SVM by achieving 0.946 of f-measure

“…Manually processing of this huge amount of unstructured textual data and information is very costly in term of time-consuming and expensive process. Accordingly, taking advantages of this type of data and information is very hard for the reason of its availability in various forms such as unstructured or semi-structured text data forms [2,3]. The majority of indexed resources of this textual data are mainly extracted from online reports and documents, e-mails, online textual blogs, memos, digital letters, etc [3].…”

Section: Introductionmentioning

confidence: 99%

“…Accordingly, taking advantages of this type of data and information is very hard for the reason of its availability in various forms such as unstructured or semi-structured text data forms [2,3]. The majority of indexed resources of this textual data are mainly extracted from online reports and documents, e-mails, online textual blogs, memos, digital letters, etc [3]. Textual data resources may possibly consist of data collected from multiple information contributors with different representations and usually handled by heterogeneous analytical models.…”

Section: Introductionmentioning

confidence: 99%

Sentimental classification analysis of polarity multi-view textual data using data mining techniques

Yassir

Mohammed

Alkhazraji

et al. 2020

The data and information available in most community environments is complex in nature. Sentimental data resources may possibly consist of textual data collected from multiple information sources with different representations and usually handled by different analytical models. These types of data resource characteristics can form multi-view polarity textual data. However, knowledge creation from this type of sentimental textual data requires considerable analytical efforts and capabilities. In particular, data mining practices can provide exceptional results in handling textual data formats. Besides, in the case of the textual data exists as multi-view or unstructured data formats, the hybrid and integrated analysis efforts of text data mining algorithms are vital to get helpful results. The objective of this research is to enhance the knowledge discovery from sentimental multi-view textual data which can be considered as unstructured data format to classify the polarity information documents in the form of two different categories or types of useful information. A proposed framework with integrated data mining algorithms has been discussed in this paper, which is achieved through the application of X-means algorithm for clustering and HotSpot algorithm of association rules. The analysis results have shown improved accuracies of classifying the sentimental multi-view textual data into two categories through the application of the proposed framework on online polarity user-reviews dataset upon a given topics.