Flow-Based Detection of DNS Tunnels - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2013

Flow-Based Detection of DNS Tunnels

Résumé

DNS tunnels allow circumventing access and security policies in firewalled networks. Such a security breach can be misused for activities like free web browsing, but also for command & control traffic or cyber espionage, thus motivating the search for effective automated DNS tunnel detection techniques. In this paper we develop such a technique, based on the monitoring and analysis of network flows. Our methodology combines flow information with statistical methods for anomaly detection. The contribution of our paper is twofold. Firstly, based on flow-derived variables that we identified as indicative of DNS tunnelling activities, we identify and evaluate a set of non-parametrical statistical tests that are particularly useful in this context. Secondly, the efficacy of the resulting tests is demonstrated by extensive validation experiments in an operational environment, covering many different usage scenarios.
Fichier principal
Vignette du fichier
978-3-642-38998-6_16_Chapter.pdf (1.18 Mo) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-01489962 , version 1 (14-03-2017)

Licence

Paternité

Identifiants

Citer

Wendy Ellens, Piotr Żuraniewski, Anna Sperotto, Harm Schotanus, Michel Mandjes, et al.. Flow-Based Detection of DNS Tunnels. 7th International Conference on Autonomous Infrastructure (AIMS), Jun 2013, Barcelona, Spain. pp.124-135, ⟨10.1007/978-3-642-38998-6_16⟩. ⟨hal-01489962⟩
224 Consultations
543 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More