DNS Tunneling Detection with Supervised Learning
Richard Preston · 2019
This paper presents an advanced analytic capable of detecting general DNS tunneling behavior with high precision and recall. It explores the application of supervised machine learning to a recently introduced technique for analyzing DNS traffic: classifying primary domains instead of queries. This approach is enabled by a partially synthetic dataset generated with a structurally configurable DNS tunneling tool.