Refined identification of hybrid traffic in DNS tunnels based on regression analysis. Issue 1 (10th May 2020)

• Record Type: Journal Article
• Authors: Bai, Huiwen; Liu, Guangjie; Zhai, Jiangtao; Liu, Weiwei; Ji, Xiaopeng; Yang, Luhui; Dai, Yuewei
• Is Part Of: ETRI journal. Volume 43:Issue 1(2021)
• Page Start: 40
• Page End: 52
• Publication Date: 2020-05-10
• Subjects: DNS tunnels -- ratios of two mixed protocols -- regression model -- temporal‐spatial analysis; Telecommunication -- Periodicals; Electronics -- Periodicals; Electronics; Telecommunication; Periodicals; Periodicals; 621.38205
• DOI: 10.4218/etrij.2019-0299
• Languages: English
• ISSNs: 1225-6463

Abstract

Abstract : DNS (Domain Name System) tunnels almost obscure the true network activities of users, which makes it challenging for the gateway or censorship equipment to identify malicious or unpermitted network behaviors. An efficient way to address this problem is to conduct a temporal‐spatial analysis on the tunnel traffic. Nevertheless, current studies on this topic limit the DNS tunnel to those with a single protocol, whereas more than one protocol may be used simultaneously. In this paper, we concentrate on the refined identification of two protocols mixed in a DNS tunnel. A feature set is first derived from DNS query and response flows, which is incorporated with deep neural networks to construct a regression model. We benchmark the proposed method with captured DNS tunnel traffic, the experimental results show that the proposed scheme can achieve identification accuracy of more than 90%. To the best of our knowledge, the proposed scheme is the first to estimate the ratios of two mixed protocols in DNS tunnels.