DNS tunneling detection through statistical fingerprints of protocol messages and machine learning

Abstract

The use of covert-channel methods to bypass security policies has increased considerably in the recent years. Malicious users neutralize security restriction by encapsulating protocols like peer-to-peer, chat or http proxy into other allowed protocols like Domain Name Server (DNS) or HTTP. This paper illustrates a machine learning approach to detect one particular covert-channel technique: DNS tunneling.Despite packet inspection may guarantee reliable intrusion detection in this context, it may suffer of scalability performance when a large set of sockets should be monitored in real time. Detecting the presence of DNS intruders by an aggregation-based monitoring is of main interest as it avoids packet inspection, thus preserving privacy and scalability. The proposed monitoring mechanism looks at simple statistical properties of protocol messages, such as statistics of packets inter-arrival times and of packets sizes. The analysis is complicated by two drawbacks: silent intruders (generating small statistical variations of legitimate traffic) and quick statistical fingerprints generation (to obtain a detection tool really applicable in the field).Results from experiments conducted on a live network are obtained by replicating individual detections over successive samples over time and by making a global decision through a majority voting scheme. The technique overcomes traditional classifier limitations. An insightful analysis of the performance leads to discover a unique intrusion detection tool, applicable in the presence of different tunneled applications. ¶ The n s with an order of magnitude more (n s D 10 4 ) captures features with a higher measurement stability, thus allowing to reach the steady state after K=811 samples.

Statistical fingerprint‐based intrusion detection system (SF‐IDS)

“…This paper shares with the literature, , and the other papers mentioned in the previous section concerning SABID, not only the idea of detecting something by using statistical analysis. For instance “looking at simple statistical properties of protocol messages, such as statistics of packet inter‐arrival times and of packets sizes” may be useful to perform monitoring actions. “The key idea is that the information carried by packets at the network layer, such as packet‐size and inter‐arrival time between consecutive packets, are enough to infer the nature of the application protocol that generated those packets.” This sentence, referred in the work of Dusi et al to tunnels, may be literally applied to malware in this paper.…”

“…As far as statistical analysis based detection, 2 papers are particularly meaningful for the topic of this paper, even if they are not strictly related to malware detection: the works of Dusi et al and Aiello et al Both contributions are aimed at detecting application‐layer tunnels throughout statistical fingerprints. Dusi et al presents a statistical classification mechanism called Tunnel Hunter devoted to recognize a generic application protocol tunneled on top of HTTP or of SSH.…”

“…The accuracy is 100 % for HTTP tunnels and above 99 % for SSH ones. Aiello et al aim at detecting DNS tunnels. The accuracy for a mix of applications is close to 99 % .…”

DNS Tunneling Detection Method Based on Multilabel Support Vector Machine

“…Similarly, Aiello et al [8] have proposed a machine learning technique in order to detect the DNS tunneling. The proposed method examines simple statistical features of protocol messages, such as statistics of packets interarrival times and of packets' sizes.…”

“…The key characteristic behind the MLT lies in the historical data that should be provided in order to make the machine train and build the statistical model. Several researchers have examined the use of machine learning in terms of detecting DNS tunneling such as [7][8][9]. However, these studies have treated the problem of DNS tunneling as a binary classification where the class label is either legitimate or tunnel.…”