Unsupervised learning and rule extraction for Domain Name Server tunneling detection. Issue 2 (10th December 2018)

• Record Type: Journal Article
• Authors: Aiello, Maurizio; Mongelli, Maurizio; Muselli, Marco; Verda, Damiano
• Is Part Of: Internet technology letters. Volume 2:Issue 2(2019)
• Page Start: n/a
• Page End: n/a
• Publication Date: 2018-12-10
• Subjects: covert channel -- rule extraction -- unsupervised learning; Internet -- Periodicals; 004.67805
• DOI: 10.1002/itl2.85
• Languages: English
• ISSNs: 2476-1508

Abstract

Abstract : The paper deals with k ‐means clustering and logic learning machine (LLM) for the detection of Domain Name Server (DNS) tunneling. As the LLM shows more versatility in rule generation and classification precision with respect to traditional decision trees, the approach reveals to be robust to a large set of system conditions. The detection algorithm is designed to be applied over streaming data, without accurate tuning of algorithms' parameters. An extensive performance evaluation is provided with respect to different tunneling tools and applications; silent intruders are considered. Results show robustness on a test set that exhibits a different behavior from training.