Statistical Techniques to detect Covert Channels Employing DNS

No ratings

Presented at FIRSTCyberThreatIntelligenceSymposium 2019 by

Dhia Mathew

DNS tunneling has been rising in prominence over the last few years as a means for malware communication or data exfiltration. Consequently - security operators are interested in identifying cases of DNS tunneling even if the tunneling is benign in nature. The aim of this talk is to provide researchers with a detailed summary of the types of DNS tunneling we have identified in the wild as well as statistical techniques to detect instances of DNS tunneling.By modelling DNS tunneling as a communication process we hope to identify tunneling occurrences by similar statistical correlations across messages. These correlations occur across multiple messages because the encoding process of a DNS tunneling protocol introduces either redundancies or similar lexical patterns.To prove this hypothesis we employ two different vector quantization schemes over different domain feature spaces to show that DNS tunneling domains cluster together with higher frequency than ‘noise’ domains.By analyzing the length structure of a domain’s labels we observe that tunneling domains follow a certain sequence length. In addition, if we examine a feature space composed of the lexical structure of a domain label we also observe that DNS tunneling domains belonging to a similar family cluster nearby.Based on these two quantization schemes we build a DNS tunneling detector that can identify tunneling domains in the wild.Key takeaways:The types/uses of DNS tunneling found in the wildDesigning features to help identify DNS tunnelingHow to use machine learning models in conjunction with threat analysts to provide quick assessments of network threatsThe value of analyst feedback in the development cycle of automated modelsCategorizing types of DNS tunneling based on their structure