A Survey of DNS Tunnel Detection

While the network brings convenience to people’s lives, it also causes security issues. In recent years, hackers have exploited the vulnerability of DNS protocol design and architecture to build DNS tunnels for DNS protocol-based information interaction through DNS tunneling tools. However, the DNS protocol is the infrastructure of network communication and can naturally pass through the firewall, which greatly increases the threat of DNS tunnel-based attacks. So researchers began to study how to detect DNS tunnels, and have gotten good results. This paper provides an overview of the detection methods for DNS tunnels in recent years. Firstly, we briefly discuss DNS protocol and vulnerability, then introduce the principles of DNS tunnel implementation and commonly applied DNS tunnel tools, secondly, we compare and analyze the methods for detecting DNS tunnels, and finally, we point out the future directions of DNS tunnel detection that are worthy of research.