Abstract:DNS tunnels, due to their versatility and concealment, have become a preferred method for attackers to execute Command and Control (C&C) attacks, posing a significant security threat to terminal devices. Therefore, the efficient and accurate detection of DNS tunnels is important in reducing the economic losses and privacy risks faced by both enterprises and individuals. Despite notable advancements in the research of intelligent detection of DNS tunnels, existing model-based approaches predominantly concentrate on the surface-level features of domain names or packet payloads. This narrow focus leads to low detection accuracy when dealing with unknown DNS tunnel attacks and traffic from wildcard DNS. Furthermore, these methods struggle with accurately identifying DNS tunneling tools, complicating the task of swiftly locating and mitigating malware for analysts. This paper proposes GraphTunnel, a framework based on graph neural networks for detecting DNS tunnels and identifying tunneling tools. It delves into the correlations among DNS resolutions to construct paths that represent the recursive resolution process of DNS. By using central nodes that denote the gateways, these paths are connected and transformed into graph structures. Concurrently, it employs GraphSage to aggregate the features of nodes and their edges in the graph, enabling effective detection of DNS tunnels. Additionally, GraphTunnel utilizes the G2M algorithm to capture the statistical features of nodes in the graph and maps them into grayscale images, which are then processed by a CNN for multi-class identification of DNS tunneling tools. Experimental results demonstrate that in non-wildcard DNS scenarios, GraphTunnel achieves a 100% accuracy in DNS tunnel detection, encompassing unknown DNS tunnels. Even in high false-positive environments caused by wildcard DNS, GraphTunnel maintains an F1-Score of 99.78%. Moreover, GraphTunnel can identify DNS tunneling tools with an accuracy rate exceeding 98.57%, enhancing the rapid mitigation capabilities of emergency responders in dealing with malicious DNS tunnels.

Dns Tunneling Detection with New Patterns Emerging: A Forest-Based Classifier with an Unknown Option

Detection Method of Domain Names Generated by DGAs Based on Semantic Representation and Deep Neural Network

DNS Tunneling: A Deep Learning based Lexicographical Detection Approach

A comprehensive survey on DNS tunnel detection

GraphTunnel: Robust DNS Tunnel Detection Based on DNS Recursive Resolution Graph

A Dynamic Intrusion Detection System Capable of Detecting Unknown Attacks

A DNS Tunnel Sliding Window Differential Detection Method Based on Normal Distribution Reasonable Range Filtering

: Towards Fine-Grained Unknown Class Detection Against the Open-Set Attack Spectrum with Variable Legitimate Traffic

Identifying DNS-tunneled traffic with predictive models

Detection of Data Leakage Based on DNS Traffic

Identifying APT Malware Domain Based on Mobile DNS Logging

Intelligent model for the detection and classification of encrypted network traffic in cloud infrastructure

Detecting Data Leakage in DNS Traffic Based on Time Series Anomaly Detection.

ML-based tunnel detection and tunneled application classification

KRTunnel: DNS channel detector for mobile devices

HinDom: A Robust Malicious Domain Detection System based on Heterogeneous Information Network with Transductive Classification

Can We Learn What People Are Doing from Raw DNS Queries?

Detecting DNS-based Covert Channel on Live Traffic

Censorship Data-Driven DNS Resolution Anomaly Detection: an Ensemble Algorithm Model with Multivariate Feature Fusion

A Novel Web Tunnel Detection Method Based on Protocol Behaviors

DNS covert channel detection method using the LSTM model