Detection of DNS Tunneling by Feature-Free Mechanism
Chia-Min Lai, Bo-Ching Huang, Shin‐Ying Huang, Ching-Hao Mao, Hahn-Ming Lee · 2018
DNS is a very popular protocol which is responsible for translate domain name to IP address. Attacker can exploit DNS to hide data in DNS tunnel as the organization would not block DNS packets in order to access the Internet. We proposed a DNS tunneling detector, which constructed with neural network framework with features-free characters. Hence the detector can implement in real world without worrying about the high variation samples in the wild. Our detector achieved high performance that can distinguish DNS packets is tunneling or not without false positive.