DNS Tunneling Detection Techniques – Classification, and Theoretical Comparison in Case of a Real APT Campaign

摘要

Domain Name System (DNS) plays an important role as a translationprotocol in everyday use of the Internet. The purpose of DNS is to translate domainnames into IP addresses and vice versa. However, its simple architecturecan easily be misused for malicious activities. One huge security threat concerningDNS is tunneling, which helps attackers bypass the security systems unnoticed.A DNS tunnel can be used for three purposes: as a command and controlchannel, for data exfiltration or even for tunneling another protocol through it. Inthis paper, we surveyed different techniques for DNS tunneling detection. Weclassified those first based on the type of data and then within the categories basedon the type of analysis. We conclude with a comparison between the various detectiontechniques. We introduce one real Advanced Persistent Threat campaignthat utilizes DNS tunneling, and theoretically compare how well the surveyeddetection techniques could detect it.