A High Accuracy DNS Tunnel Detection Method Without Feature Engineering

Abstract

Domain Name System (DNS) is a key protocol and service used on the Internet. It is responsible for converting domain names into IP addresses. DNS tunnel is a method of encoding data of other programs or protocols in DNS query and response. Previous studies usually need to extract a large number of features manually and train the classifier of DNS tunnel detection by feature engineering. In this paper, a new framework for DNS tunnel detection is proposed, which can automatically extract features, including long short-term memory (LSTM) language model with attention mechanism and gated recurrent unit (GRU) language model with attention mechanism. Finally, a single-level classifier based on a character-level convolutional neural network (Char-CNN) is proposed. The results show that the LSTM and GRU language models based on attention mechanism and the algorithm of character-level convolution neural network achieve high accuracy and near-zero false positives.