DNS Tunnel Detection for Low Throughput Data Exfiltration via Time-Frequency Domain Analysis

Domain Name System (DNS) is one of the most common and vital services on the Internet. Attackers take advantage of DNS tunneling to bypass firewalls for data exfiltration, which has been a significant risk in cyber security. Although there are studies on DNS tunneling detection, few are concerned with low-throughput data exfiltration over DNS tunnels. This paper proposes a low-throughput data exfiltration detection method via time-frequency domain analysis on DNS traffic. We conduct the time and frequency domain analysis on time windows of DNS traffic in different granularities. The frequency domain features effectively encode sequential information of the packet sequences, which sketch malicious patterns in low-throughput DNS tunnels. We evaluate our method on the DNS traffic of an enterprise network. Experimental results exhibit that our method significantly outperforms the existing approach in detecting low-throughput data exfiltration over DNS tunnels.