Identifying DNS-tunneled traffic with predictive models
  DNS is a distributed, fault tolerant system that avoids a single point of
failure. As such it is an integral part of the internet as we use it today and
hence deemed a safe protocol which is let through firewalls and proxies with no
or little checks. This can be exploited by malicious agents. Network forensics
is effective but struggles due to size of data and manual labour. This paper
explores to what extent predictive models can be used to predict network
traffic, what protocols are tunneled in the DNS protocol and more specifically
whether the predictive performance is enhanced when analyzing DNS-queries and
responses together and which feature set that can be used for DNS-tunneled
network prediction. The tested protocols are SSH, SFTP and Telnet and the
machine learning models used are Multi Layered Perceptron and Random Forests.
To train the models we extract the IP Packet length, Name length and Name
entropy of both the queries and responses in the DNS traffic. With an
experimental research strategy it is empirically shown that the performance of
the models increases when training the models on the query and respose pairs
rather than using only queries or responses. The accuracy of the models is >83%
and reduction in data size when features are extracted is roughly 95%. Our
results provides evidence that machine learning is a valuable tool in detecting
network protocols in a DNS tunnel and that only an small subset of network
traffic is needed to detect this anomaly.
