Abstract:DNS tunnels, due to their versatility and concealment, have become a preferred method for attackers to execute Command and Control (C&C) attacks, posing a significant security threat to terminal devices. Therefore, the efficient and accurate detection of DNS tunnels is important in reducing the economic losses and privacy risks faced by both enterprises and individuals. Despite notable advancements in the research of intelligent detection of DNS tunnels, existing model-based approaches predominantly concentrate on the surface-level features of domain names or packet payloads. This narrow focus leads to low detection accuracy when dealing with unknown DNS tunnel attacks and traffic from wildcard DNS. Furthermore, these methods struggle with accurately identifying DNS tunneling tools, complicating the task of swiftly locating and mitigating malware for analysts. This paper proposes GraphTunnel, a framework based on graph neural networks for detecting DNS tunnels and identifying tunneling tools. It delves into the correlations among DNS resolutions to construct paths that represent the recursive resolution process of DNS. By using central nodes that denote the gateways, these paths are connected and transformed into graph structures. Concurrently, it employs GraphSage to aggregate the features of nodes and their edges in the graph, enabling effective detection of DNS tunnels. Additionally, GraphTunnel utilizes the G2M algorithm to capture the statistical features of nodes in the graph and maps them into grayscale images, which are then processed by a CNN for multi-class identification of DNS tunneling tools. Experimental results demonstrate that in non-wildcard DNS scenarios, GraphTunnel achieves a 100% accuracy in DNS tunnel detection, encompassing unknown DNS tunnels. Even in high false-positive environments caused by wildcard DNS, GraphTunnel maintains an F1-Score of 99.78%. Moreover, GraphTunnel can identify DNS tunneling tools with an accuracy rate exceeding 98.57%, enhancing the rapid mitigation capabilities of emergency responders in dealing with malicious DNS tunnels.

Detecting Http-Tunnel with Process Monitoring

Monitoring System of Shield Tunneling Machine Based on Adaptive Control Technology

A Novel Web Tunnel Detection Method Based on Protocol Behaviors

A Multi-tunnel VPN Concurrent System for New Generation Network Based on User Space

HTTP Tunnel Trojan Detection Model Based on Deep Learning

Prototype demonstration: trojan detection and defense system

A General Framework of Trojan Communication Detection Based on Network Traces

Towards a Near-real-time Protocol Tunneling Detector based on Machine Learning Techniques

A comprehensive survey on DNS tunnel detection

DESIGN SAFETY MONITORING SYSTEM FOR INTELLIGENT TUNNEL TRAFFIC BASED ON VIDEO DETECTION PROCESSING

A Novel Approach Of Detecting Trojan Based On Network Behavior Analysis

APT Covert Tunnel Detection based on OpenVPN Identification

ML-based tunnel detection and tunneled application classification

GraphTunnel: Robust DNS Tunnel Detection Based on DNS Recursive Resolution Graph

A method based on hierarchical spatiotemporal features for trojan traffic detection

Detection of Trojan Covert Communication Based on Client Honeypot

Development of tunnel intelligent monitoring and early warning system based on micro-service architecture: the case of AnPing tunnel

Combating Malicious DNS Tunnel

HSTF-Model: An HTTP-based Trojan detection model via the Hierarchical Spatio-temporal Features of Traffics

Data Spoofing Attacks by Ipv6 Tunnels

DESIGNING AND IMPLEMENTING DISTRIBUTED TROJAN DETECTION SYSTEM