DNS Covert Channel Detection via Behavioral Analysis: a Machine Learning Approach
This addresses the challenge of detecting covert channels in heterogeneous networks for security applications, though it is incremental as it builds on existing machine learning techniques.
The paper tackled the problem of detecting DNS covert channels in network traffic by proposing a machine learning approach that analyzes behavioral profiles and anomaly indicators. The method achieved detection of all malicious variants with a low false-positive rate in a 15-day experimental session.
Detecting covert channels among legitimate traffic represents a severe challenge due to the high heterogeneity of networks. Therefore, we propose an effective covert channel detection method, based on the analysis of DNS network data passively extracted from a network monitoring system. The framework is based on a machine learning module and on the extraction of specific anomaly indicators able to describe the problem at hand. The contribution of this paper is two-fold: (i) the machine learning models encompass network profiles tailored to the network users, and not to the single query events, hence allowing for the creation of behavioral profiles and spotting possible deviations from the normal baseline; (ii) models are created in an unsupervised mode, thus allowing for the identification of zero-days attacks and avoiding the requirement of signatures or heuristics for new variants. The proposed solution has been evaluated over a 15-day-long experimental session with the injection of traffic that covers the most relevant exfiltration and tunneling attacks: all the malicious variants were detected, while producing a low false-positive rate during the same period.