DNS Tunneling Detection Using Feedforward Neural Network

Abstract

This paper addresses a problem of detecting Domain Name System (DNS) tunneling in a computer network. Unauthorized data transfer exploits DNS tunneling technique to conceal network activity in a regular DNS traffic. Contemporary intrusion prevention equipment does not provide reasonable protection from sensitive information stealing. Given the DNS queries from both legitimate and adversary clients this paper proposes a machine-learning method of distinguishing tunneling strategies. More precisely, it describes a multi-label model of feedforward neural network that classifies some of well-known tunneling strategies counting legitimate traffic. The paper contains analysis of classification quality and accuracy of the developed model.