Detecting DNS Tunnels Using Character Frequency Analysis
arXiv:1004.4358
Abstract
High-bandwidth covert channels pose significant risks to sensitive and proprietary information inside company networks. Domain Name System (DNS) tunnels provide a means to covertly infiltrate and exfiltrate large amounts of information passed network boundaries. This paper explores the possibility of detecting DNS tunnels by analyzing the unigram, bigram, and trigram character frequencies of domains in DNS queries and responses. It is empirically shown how domains follow Zipf's law in a similar pattern to natural languages, whereas tunneled traffic has more evenly distributed character frequencies. This approach allows tunnels to be detected across multiple domains, whereas previous methods typically concentrate on monitoring point to point systems. Anomalies are quickly discovered when tunneled traffic is compared to the character frequency fingerprint of legitimate domain traffic.
In Proceedings of the 9th Annual Security Conference, Las Vegas, NV, April 7-8, 2010
Cited by in corpus (7)
- Entropy-based Prediction of Network Protocols in the Forensic Analysis of DNS Tunnels
- DNS Covert Channel Detection via Behavioral Analysis: a Machine Learning Approach
- Data Retrieval over DNS in SQL Injection Attacks
- A Covert Data Transport Protocol
- Identifying DNS-tunneled traffic with predictive models
- NgViz: Detecting DNS Tunnels through N-Gram Visualization and Quantitative Analysis
- Approximate String Matching for DNS Anomaly Detection