Improving DNS Data Exfiltration Detection Through Temporal Analysis

By leveraging the DNS tunneling technique, malicious actors have the ability to transfer covertly data embedded within a DNS transaction. A DNS tunnel can be used as a Command and Control (C &C) channel for botnet coordination, for data exfiltration, for tunneling another protocol through it, to name a few. To this end, it is imperative to develop DNS exfiltration detection techniques that are capable to mitigate such cybersecurity incidents and decrease the risks that can potentially pose within an infrastructure. In our work, we examine several DNS exfiltration detection techniques, and we compare the most common algorithms and detection features. Furthermore, we propose a temporal analysis enhancement mechanism with the purpose to increase the existing mechanisms’ efficiency. We focus on the detection of DNS exfiltration evidence within the logs of the DNS recursive resolver. Such setup does not require a specialized DNS traffic capturing mechanism, but rather the DNS queries are logged by default. This way, our approach can be used for both real time detection and forensic analysis. The performance of the proposed solution is demonstrated by investigating the DNS traffic generated from common open-source DNS tunneling tools. The results showcase that the temporal analysis can significantly improve the accuracy of the detection ratio of the exfiltration packets.