DNS Covert Channel Detection via Behavioral Analysis: a Machine Learning
  Approach
  Detecting covert channels among legitimate traffic represents a severe
challenge due to the high heterogeneity of networks. Therefore, we propose an
effective covert channel detection method, based on the analysis of DNS network
data passively extracted from a network monitoring system. The framework is
based on a machine learning module and on the extraction of specific anomaly
indicators able to describe the problem at hand. The contribution of this paper
is two-fold: (i) the machine learning models encompass network profiles
tailored to the network users, and not to the single query events, hence
allowing for the creation of behavioral profiles and spotting possible
deviations from the normal baseline; (ii) models are created in an unsupervised
mode, thus allowing for the identification of zero-days attacks and avoiding
the requirement of signatures or heuristics for new variants. The proposed
solution has been evaluated over a 15-day-long experimental session with the
injection of traffic that covers the most relevant exfiltration and tunneling
attacks: all the malicious variants were detected, while producing a low
false-positive rate during the same period.
