DNS-Tunnet: A Hybrid Approach for DNS Tunneling Detection

Domain Name Service (DNS) is a well-trusted protocol for translating domain name to IP address. However, cybercriminals have found new ways to launch attacks through this medium such as DNS Tunneling, by creating covert control and command channels to tunnel payloads. Most of the previous studies extract hand-crafted features from DNS queries and train them individually on state-of-the-art methods. In this study, we have not only explored the standard Deep Learning approach but have also used the integration of Convolutional Neural Networks (CNN) and Support Vector Machine (SVM) in our proposed DNS-Tunnet architecture. This technique utilizes both automatic feature extraction property of CNN and the precise classification property of SVM. For comparison purposes, we have compared performance of DNS-Tunnet with ensemble classifiers for which we prepared two different datasets through feature extraction. Our experiment concludes that DNS-Tunnet outperforms all other models both in terms of performance and efficiency.