- The Domain Name System (DNS) is an essential network service translating human-friendly host names into numerical IP addresses. Prior to almost any network communication, a communication with a DNS server is, the most likely, needed. For this reason, DNS cyber-attacks are now one of the most challenging threats in the information security community due to its wide availability and the fact that it's not monitored in terms of security - not intended for data transfer. Particularly, DNS tunnelling embedding data in DNS queries and response is receiving a lot of attention in the research field over the last years. Recent studies have focused on DNS tunnelling detection using machine learning. The aim of this paper is to provide a comprehensive survey of some different techniques proposed recently in the literature for detecting DNS tunnels using machine learning, while highlighting on the main findings and comparing their obtained results.
DNS translates easy memorized domain names to numerical
IP addresses which is an essential service related to network
and Internet Functionality. For this purpose, DNS protocol
uses special message formats and types, like queries and
replies. DNS and communicate on port 53 using usually UDP
and TCP when the request is larger than 512 octets. RFC 1035
[
To determine the requested services (web pages, mail servers…), 83 DNS record types (2016) can be used. Common DNS records include: A, PTR, MX, CNAME, TXT, NS, and SOA records.
A DNS server can be authoritative – holding the DNS
information - for one zone (example: domain.com) or it can be
a local DNS cache serving client DNS queries. DNS queries
are of two types [
From a security perspective, DNS stands out among most protocols for covert channels for several reasons.
First, because DNS is not intended for data transfer, DNS traffic is often allowed without being inspected by network security devices and almost ignored in network security policies, which makes DNS a prone for attacks and misuse.
Second, DNS includes some flexible fields used by attackers like TXT record and other.
In 1998 [
In 18 December 2017, The Etisalat UAE [
The global DNS threat survey [
The remaining of this paper is structured as follows. Section 2 deals with DNS tunnelling description, the way data can be exfiltrated and by which tools; Section 3 highlights DNS tunnelling detection techniques using machine learning. Section 4 compares the surveyed methods; and finally, section 5 finally outlines the conclusion.
Tunnelling [
DNS tunnelling is a client-server model requiring a client to be compromised through malware, phishing or social engineering with the only requirement of access to internal DNS server. At the infected DNS client level, a persistent backdoor with a DNS Tunnel will thus be established.
DNS tunnels can be used to exfiltrate important and
confidential data from any organizations network (Data
Exfiltration) or in form of Command and control channel [
C&C is a communication channel between the target host
and the command and control server. It embeds data and
commands in DNS queries and responses. Also, it includes full
remote access of the compromised host. In 2012 [
A lot of malware families have been discovered using DNS
tunnelling to hide their communication: Morto [
As illustrated in [Fig. 1], DNS tunnelling requires a compromised client system to have external network connectivity and a Rogue DNS server controlled by the malicious user that can act as an authoritative server to execute the server-side tunnelling and data payload executable programs. After being infected by a malware, the DNS client starts issuing recursive DNS queries addressed to a domain name controlled by the threat actor. The local DNS server then forwards the queries iteratively to authoritative servers which should appear as normal to the local firewall. As shown in Figure 1, sensitive Data “67AC45001DEF34” can be easily exfiltrated through the DNS query itself back to the malicious user rogue DNS Server.
There are many tools [
The Most commonly used DNS tools [
DNScat [
Iodine [
DNS2tcp [
OzymanDNS [
Now that we highlighted on the DNS tunnelling technique and tools, detecting DNS tunnels seems to be a challenging task for researchers, as we will show in the next section.
As mentioned earlier, the most challenging concern in today’s business is to keep ahead with the growing and changing security threats especially the massive rise in threats such “DNS Tunnelling”.
DNA tunnelling detection techniques can be grouped, as per
Franham [
In payload analysis, the analysis will be for one or more requests and responses for tunnel Indicators. The attributes used are: size of request and response, entropy of hostnames, statistical analysis, uncommon record types and policy violation.
In traffic analysis, multiple requests and responses will be analysed over Time. Traffic attributes used here include among others: volume of DNS per IP address and per domain, number of hostnames per domain, geographic location of DNS server, domain history.
Recently, as a response toward the DNS tunnelling concern, researchers are tending to use Machine Learning Techniques (MLTs) to detect tunnelling. As mentioned earlier, MLTs will be highlighted the most and surveyed in this paper.
Machine learning is a subfield of artificial intelligence used to understand data structure and fit it into models that can be used by people. It allows computers to train on data inputs and statistical features.
Machine Learning is mostly used for an efficient tunnelling detection. It provides a way to define normal behaviour in a network, so it can detect anomalies that indicate the presence of DNS tunnels. Several MLTs exist: Support Vector Machine (SVM), Naïve Bayes (NB), Decision Tree (DT), K-nearest Neighbor (KNN) and others.
Different Machine Learning algorithms are used in the field of data science classified mainly into two categories: The Supervised learning and unsupervised learning.
The Supervised learning is where instances are given with known labels and it includes algorithms such logistic and linear regression, classification and support vector machine; with the latter one, the instances are unlabelled. A well-known algorithm in unsupervised learning is k-means clustering.
Maurizio Aiello et al. [
The performance evaluation shows that the approach is reliable and good results are obtained despite the simplicity of the mechanism.
In [
Anirban Das et al. [
“Logistic Regression” is the model used to detect data exfiltration with DNS tunnelling and “K-Means” for the tunnelling.
The 2 machine learning models show high detection and small false positive rate:
Logistic regression detects exfiltration with very small false positive rate of 0.189%
K-means detect Tunnelling with true positive rate of 91.68% and false positive rate of 0.40%.
Jingkun liu et al. [
To compare the binary mechanism, the authors used 3 algorithms: Support Vector Machine (SVM), Logistical regression (LR), and Decision Tree (DT) and the results shows detection accuracy and precision of 99.96%.
Van Thuan Do et al. [
Two methods have been selected: OCSVM (One Class Support Vector Machine) and K-Means. Beside the challenge of the small size of DNS dataset, the detection using OCSVM is superior to the one using K-Means especially that K-means is a cluster classifier that work better when the clusters are even which is not the case of DNS tunnelling.
OCSVM with the Radial Basis Function kernel obtained the higher and best result with 96% F-measure.
Few papers in the literature addressed methods comparison.
Nonetheless, a comparative analysis for detecting DNS
tunnelling using Machine learning techniques was presented
by Mahmoud Sammour et al. in [
SVM achieved 83% F-measure, NB 79% and 78% by DT.
Saeed Shafieian et al. [
Signature-based intrusion detection isn’t effective. Therefore, the authors proposed a technique that employs an ensemble of machine learning algorithms that are different in nature. The algorithms used are: Random Forests, K-Nearest (K-NN) and Multi-layer perception (MLP).
Results show the following: • • • • • • • •
Ensemble of machine learning classifiers performs better than single one.
The Ensemble of RF and Multi-layer perceptron have near false positive in detecting DNS tunneling.
Weight of classifier and the combination rule affect the performance.
Adding more classifiers can reduce the performance. SVM has outperformed the NB and DT by achieving the highest F-measure.
DNS tunneling detection in Mobile networks using OCSVM is superior to the one using K-Means.
Logistic regression and K-Means are used for data exfiltration and C&C tunnel detection with low false positive and high detection rate.
Bayes Classifier of supervised learning can be used as a reliable and fast DNS tunnelling detector.
F-Measure 99.6% Based on the surveyed works in this paper, Table 1 summarizes and compares the main aspects of each methods. As shown in Table 1, methods tend to use different known algorithms. Results shows reliable DNS tunneling techniques using Bayes, K-means and logistic regression. OCSVM is better than K-Means and SVM is better than Bayes and DT. Binary classification outperforms SVM, DT and logistic regression.
An ensemble of machine learning classifiers performs better than single one: RF and Multi-layer perceptron have near-zero false positive.
In this paper, we surveyed some of DNS tunnelling detection techniques using machine learning and the approaches cover different range of tunnelling detection to better define the scope of research. With this variety, it is a challenging task to identify the most suitable classifier, which would fit the process of detecting DNS tunnelling. Throughout this survey, we have shown several challenges for researchers in the field: Results for different machine learning method don't provide the same performance metrics and use different datasets.