Abstract:DNS tunnels, due to their versatility and concealment, have become a preferred method for attackers to execute Command and Control (C&C) attacks, posing a significant security threat to terminal devices. Therefore, the efficient and accurate detection of DNS tunnels is important in reducing the economic losses and privacy risks faced by both enterprises and individuals. Despite notable advancements in the research of intelligent detection of DNS tunnels, existing model-based approaches predominantly concentrate on the surface-level features of domain names or packet payloads. This narrow focus leads to low detection accuracy when dealing with unknown DNS tunnel attacks and traffic from wildcard DNS. Furthermore, these methods struggle with accurately identifying DNS tunneling tools, complicating the task of swiftly locating and mitigating malware for analysts. This paper proposes GraphTunnel, a framework based on graph neural networks for detecting DNS tunnels and identifying tunneling tools. It delves into the correlations among DNS resolutions to construct paths that represent the recursive resolution process of DNS. By using central nodes that denote the gateways, these paths are connected and transformed into graph structures. Concurrently, it employs GraphSage to aggregate the features of nodes and their edges in the graph, enabling effective detection of DNS tunnels. Additionally, GraphTunnel utilizes the G2M algorithm to capture the statistical features of nodes in the graph and maps them into grayscale images, which are then processed by a CNN for multi-class identification of DNS tunneling tools. Experimental results demonstrate that in non-wildcard DNS scenarios, GraphTunnel achieves a 100% accuracy in DNS tunnel detection, encompassing unknown DNS tunnels. Even in high false-positive environments caused by wildcard DNS, GraphTunnel maintains an F1-Score of 99.78%. Moreover, GraphTunnel can identify DNS tunneling tools with an accuracy rate exceeding 98.57%, enhancing the rapid mitigation capabilities of emergency responders in dealing with malicious DNS tunnels.

ML-based tunnel detection and tunneled application classification

Towards a Near-real-time Protocol Tunneling Detector based on Machine Learning Techniques

Analyzing Learning-based Encrypted Malware Traffic Classification with AutoML

GraphTunnel: Robust DNS Tunnel Detection Based on DNS Recursive Resolution Graph

A Novel Framework for Malicious Encrypted Traffic Classification at Host Level and Flow Level.

Classifying Tor Traffic Encrypted Payload Using Machine Learning

DNS Tunneling: A Deep Learning based Lexicographical Detection Approach

Robust Machine Learning for Encrypted Traffic Classification

AI-Enhanced VPN Security Framework: Integrating Open-Source Threat Intelligence and Machine Learning to Secure Digital Networks

A Novel Malware Encrypted Traffic Detection Framework Based on Ensemble Learning

Encrypted Network Traffic Analysis and Classification Utilizing Machine Learning

A comprehensive survey on DNS tunnel detection

Extensible Machine Learning for Encrypted Network Traffic Application Labeling via Uncertainty Quantification

Feature Analysis of Encrypted Malicious Traffic

Real-time Threat Detection Strategies for Resource-constrained Devices

Unsupervised Detection and Clustering of Malicious TLS Flows

Revealing MPLS tunnels obscured from traceroute

A deep learning anomaly detection framework with explainability and robustness

Machine Learning-Powered Encrypted Network Traffic Analysis: A Comprehensive Survey.

An Novel Hybrid Method for Effectively Classifying Encrypted Traffic

A Novel Malware Traffic Classification Method Using Semi-Supervised Learning.