Exploring Tunneling Behaviours in Malicious Domains With Self-Organizing Maps

Tunneling and exfiltration over Domain Name System pose a threat in the cybersecurity landscape. In this work, we propose an unsupervised learning approach, namely SelfOrganizing Maps, to explore the tunneling behaviours in Domain Name System traffic. We perform evaluations on eight different combinations of datasets against state-of-the-art techniques. Results show that our approach demonstrates a robust ability to separate benign and tunneling behaviours across a variety of training schemes, where F1 measure reaches 99% across the different testing conditions.