DNS covert tunnel detection method based on deep learning

Abstract

The invention discloses a DNS covert tunnel detection method based on deep learning, and the method is characterized in that the method comprises the steps: employing a tcpdump to capture DNS messagestransmitted and received by a DNS covert channel tool iodine, and obtaining a black sample; capturing the internal DNS flow by using tcpdump to obtain a white sample; converting the black sample andthe white sample into files which can be identified by a deep learning detection algorithm; performing random sampling on the recognizable file to obtain sampling data; training a convolutional neuralnetwork by using 80% of the sampling data, and carrying out model verification on the convolutional neural network by using the remaining 20% of the sampling data to generate a preliminary model; testing the preliminary model by using a DNS sample with a hidden channel attack, and generating a stable detection model after an expected effect is achieved; and detecting the DNS covert tunnel by using the detection model.

Description

technical field [0001] The invention relates to the field of network security, in particular to a deep learning-based DNS covert tunnel detection method. Background technique [0002] DNS covert tunnel is one of many covert channels. Since most firewalls, intrusion detection systems, and intrusion prevention systems rarely detect DNS traffic, this provides conditions for DNS to be used as a covert tunnel. Currently, DNS covert channels Detection tools such as iodine, dnscat2, and dns2tcp need to manually sort out rules and update the rule base. Some DNS covert tunnel detection models that use traditional machine learning such as clustering and classification can reduce labor costs but cannot automatically learn abstract features. The efficiency is low, and some data still needs to be processed manually. Contents of the invention [0003] In view of this, the object of the present invention is to propose a method for detecting DNS covert tunnels that saves labor costs and ...

AI Technical Summary

Problems solved by technology

[0002] DNS covert tunnel is one of many covert channels. Since most firewalls, intrusion detection systems, and intrusion prevention systems rarely detect DNS traffic, this provides conditions for DNS to be used as a covert channel. Currently, DNS covert channels Detection tools such as iodine, dnscat2, and dns2tcp need to manually sort out rules and update the rule base. Some DNS covert tunnel detection models that use traditional machine learning such as clustering and classification can reduce labor costs but cannot automatically learn abstract features. The efficiency is low, and some data still needs to be processed manually

Images