Abstract:DNS tunnels, due to their versatility and concealment, have become a preferred method for attackers to execute Command and Control (C&C) attacks, posing a significant security threat to terminal devices. Therefore, the efficient and accurate detection of DNS tunnels is important in reducing the economic losses and privacy risks faced by both enterprises and individuals. Despite notable advancements in the research of intelligent detection of DNS tunnels, existing model-based approaches predominantly concentrate on the surface-level features of domain names or packet payloads. This narrow focus leads to low detection accuracy when dealing with unknown DNS tunnel attacks and traffic from wildcard DNS. Furthermore, these methods struggle with accurately identifying DNS tunneling tools, complicating the task of swiftly locating and mitigating malware for analysts. This paper proposes GraphTunnel, a framework based on graph neural networks for detecting DNS tunnels and identifying tunneling tools. It delves into the correlations among DNS resolutions to construct paths that represent the recursive resolution process of DNS. By using central nodes that denote the gateways, these paths are connected and transformed into graph structures. Concurrently, it employs GraphSage to aggregate the features of nodes and their edges in the graph, enabling effective detection of DNS tunnels. Additionally, GraphTunnel utilizes the G2M algorithm to capture the statistical features of nodes in the graph and maps them into grayscale images, which are then processed by a CNN for multi-class identification of DNS tunneling tools. Experimental results demonstrate that in non-wildcard DNS scenarios, GraphTunnel achieves a 100% accuracy in DNS tunnel detection, encompassing unknown DNS tunnels. Even in high false-positive environments caused by wildcard DNS, GraphTunnel maintains an F1-Score of 99.78%. Moreover, GraphTunnel can identify DNS tunneling tools with an accuracy rate exceeding 98.57%, enhancing the rapid mitigation capabilities of emergency responders in dealing with malicious DNS tunnels.

A comprehensive survey on DNS tunnel detection

GraphTunnel: Robust DNS Tunnel Detection Based on DNS Recursive Resolution Graph

A Bigram Based Real Time DNS Tunnel Detection Approach.

Detecting DNS Tunnel Through Binary-Classification Based on Behavior Features

Detecting DNS Tunnels Using Session Behavior and Random Forest Method.

A DNS Tunnel Sliding Window Differential Detection Method Based on Normal Distribution Reasonable Range Filtering

Detection of Data Leakage Based on DNS Traffic

Principle and Performance Analysis of Covert Tunnel Based on DNS Protocol

FTPB: A Three-Stage DNS Tunnel Detection Method Based on Character Feature Extraction

Combating Malicious DNS Tunnel

DNS Tunneling: A Deep Learning based Lexicographical Detection Approach

Refined Identification of Hybrid Traffic in DNS Tunnels Based on Regression Analysis

Botnet Detection Technology Based On Dns

Dns Tunneling Detection with New Patterns Emerging: A Forest-Based Classifier with an Unknown Option

A Survey on DNS Encryption: Current Development, Malware Misuse, and Inference Techniques

Application Behavior Identification in DNS Tunnels Based on Spatial-Temporal Information

KRTunnel: DNS channel detector for mobile devices

Identifying DNS-tunneled traffic with predictive models

Study on Covert Channel Based on the DNS Protocol

Tdae: Autoencoder-Based Automatic Feature Learning Method For The Detection Of Dns Tunnel

DNS covert channel detection method using the LSTM model