Flow-Based Detection of DNS Tunnels

Abstract

DNS tunnels allow circumventing access and security policies in firewalled networks. Such a security breach can be misused for activities like free web browsing, but also for command & control traffic or cyber espionage, thus motivating the search for effective automated DNS tunnel detection techniques. In this paper we develop such a technique, based on the monitoring and analysis of network flows. Our methodology combines flow information with statistical methods for anomaly detection. The contribution of our paper is twofold. Firstly, based on flow-derived variables that we identified as indicative of DNS tunnelling activities, we identify and evaluate a set of non-parametrical statistical tests that are particularly useful in this context. Secondly, the efficacy of the resulting tests is demonstrated by extensive validation experiments in an operational environment, covering many different usage scenarios.

DNS tunneling detection through statistical fingerprints of protocol messages and machine learning

“…This is necessary to drive the feature selection made by the C4.5 decision tree classifier. Anomaly-based detection may be more adaptive than ML as it simply looks at sudden changes of flows statistics [4,13], while providing good detection rates [12]. A recent approach to DNS tunneling detection exploits anomaly-based analysis of flow statistics [12].…”

“…We consider the adoption of the Brodsky-Darkhovsky method as similarly carried out in [12]. We consider the adoption of the Brodsky-Darkhovsky method as similarly carried out in [12].…”

“…Figure 7 shows the time evolution of m q (the average size of the queries) with and without p2p tunneling at mix of 10%. They may be the rationale behind the low detection rates of some cases evidenced in Table II of [12]. A threshold around 93 bytes appears to be applicable to detect the tunnel.…”

“…For the problem under investigation, we resort to the simple statistics of x in order to avoid packet inspection and to guarantee quick feature building. A recent approach to DNS tunneling detection exploits anomaly-based analysis of flow statistics [12]. Anomaly-based detection may be more adaptive than ML as it simply looks at sudden changes of flows statistics [4,13], while providing good detection rates [12].…”

Statistical Frameworks for Detecting Tunnelling in Cyber Defence Using Big Data

“…This is a hard and important computational problem in cyber defence [2]. Specifically, we consider detecting tunnelling [3], [4] in the case where the attacker has obtained legitimate credentials. Because an attacker may be detectable if they do not follow existing connections, they must create tunnels from their entry point to the target.…”