A method and system for detecting a DNS covert channel

Abstract

The application relates to a DNS covert channel detection method and system, which comprises the following steps: S1, converting a PCAPNG file into a CSV format, removing irrelevant information items, obtaining a network domain name sequence, and labeling the network domain name sequence; S2, constructing a DCC detection model based on a BERT model, improving the BERT model, and introducing a knowledge distillation technology; S3, processing the network domain name sequence, generating corresponding feature input into the DCC detection model, constructing a cross-entropy loss function for model training, and finally determining whether the input network domain name sequence is a DCC. The method provided by the application learns the mode and features of data in an automatic manner, and improves the efficiency and accuracy of DCC detection.

Description

Technical Field

[0001] This invention relates to the field of information security technology, specifically to a method and system for detecting DNS covert channels. Background Technology

[0002] With the continuous advancement of network technology, cyberattacks against large-scale research facilities and scientific data centers have become increasingly sophisticated. The Domain Name System (DNS) protocol is a fundamental protocol used in the network environments of these facilities, typically involving unencrypted data transmission and used to identify computers accessing via the internet. Attackers exploit vulnerabilities in the DNS protocol to establish DNS Covert Channels (DCCs), enabling them to evade traditional security detection and launch cyberattacks by encapsulating hidden information within these channels. DCCs can be used for malicious activities such as data breaches, command and control (C&C) attacks, and bypassing Wi-Fi connection registration. Furthermore, they can be used for most types of cyberattacks, including remote access trojans (RATs), botnets, ransomware, and advanced persistent threats (APTs). These attacks can seriously jeopardize the network and information security of large-scale research facilities and scientific data centers. Therefore, timely detection and defense against DCCs are crucial for protecting the networks of these facilities.

[0003] In recent years, the detection and analysis of DNS covert channels has attracted widespread research interest, leading to the proposal of numerous detection methods and the participation of many researchers. Many machine learning-based DNS covert channel detection methods rely on manual feature extraction, requiring complex data preprocessing and feature extraction. Compared to traditional methods, deep learning-based methods can automatically extract data features without manual intervention and achieve end-to-end traffic identification models. However, existing deep learning-based covert channel detection methods suffer from low recognition rates and long training cycles.

[0004] Existing research on DNS covert channel detection methods can be broadly categorized into three types: traditional methods, classical machine learning methods, and deep learning methods. Traditional DNS covert channel detection methods primarily rely on statistical properties. By analyzing subdomain entropy, they can effectively classify DNS covert channel communication domains. However, these methods have limited effectiveness in detecting encrypted information and rely heavily on expert experience. Classical machine learning methods employ traditional Bayesian techniques and utilize 12 features, including query and response packet sizes and statistical characteristics, for detection. To analyze DNS request messages and messages in the corresponding PCAP files, these methods use machine learning models to extract features. While providing better detection results compared to traditional methods, manual feature extraction is ineffective in extracting features from encrypted information due to the encryption involved in covert channel transmission. Machine learning methods relying on textual statistical features mainly utilize information such as packet length and domain name length; therefore, their effectiveness and detection performance for encrypted text remain limited, relying heavily on expert experience. Deep learning methods utilize deep neural networks to automatically learn features for detection, including communication content features extracted from encrypted text and other parts of DNS packets. They can use DNS text information as input to complete classification tasks. By learning the characteristics of normal DNS traffic, deep neural networks can effectively detect DNS covert channels by calculating the mean squared error between normal and malicious samples.

[0005] In summary, existing DNS covert channel detection methods still have limitations, such as the need for manual parameter adjustment, poor robustness and adaptability, and inability to handle complex sequence data. Summary of the Invention

[0006] To address the aforementioned technical problems, this invention provides a method and system for detecting DNS covert channels.

[0007] The technical solution of this invention is: a method for detecting DNS covert channels, comprising:

[0008] Step S1: Convert the PCAPNG file to CSV format, remove irrelevant information items, obtain the network domain name sequence, and label it;

[0009] Step S2: Construct a DCC detection model based on the BERT model, improve the BERT model, and introduce knowledge distillation technology;

[0010] Step S3: Process the network domain name sequence to generate corresponding features to input into the DCC detection model. At the same time, construct a cross-entropy loss function for model training. Finally, determine whether the input network domain name sequence is DCC.

[0011] Compared with the prior art, the present invention has the following advantages:

[0012] 1. This invention discloses a method for detecting DNS covert channels. Unlike traditional statistical methods, the DCC detection model of this invention eliminates errors that may be caused by manually adjusting parameters by automatically learning data features.

[0013] 2. This invention can adaptively learn the characteristics and patterns of data, making it more flexible in adapting to datasets of different types and sizes. Furthermore, the method proposed in this invention can automatically learn the distribution of data, enhancing its robustness and making it easier to detect new DNS covert channel attacks, especially when trained on smaller datasets, where the detection accuracy remains very high.

[0014] 3. The method proposed in this invention can process complex sequence data with long sequence dependencies, and is very effective in detecting DNS covert channel attacks, solving the problem that traditional machine learning methods require manual feature extraction from sequence data. Attached Figure Description

[0015] Figure 1 This is a flowchart of a DNS covert channel detection method according to an embodiment of the present invention;

[0016] Figure 2 This is a schematic diagram of the Transformer model in an embodiment of the present invention;

[0017] Figure 3 This is a schematic diagram illustrating the process of preprocessing network domain name sequences in an embodiment of the present invention;

[0018] Figure 4 This is a structural block diagram of a DNS covert channel detection system according to an embodiment of the present invention. Detailed Implementation

[0019] This invention provides a method for detecting DNS covert channels, which learns data patterns and characteristics in an automated manner, thereby improving the efficiency and accuracy of DCC detection.

[0020] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below through specific implementations and in conjunction with the accompanying drawings.

[0021] Example 1

[0022] like Figure 1 As shown in the figure, an embodiment of the present invention provides a method for detecting DNS covert channels, which includes the following steps:

[0023] Step S1: Convert the PCAPNG file to CSV format, remove irrelevant information items, obtain the network domain name sequence, and label it;

[0024] Step S2: Construct a DCC detection model based on the BERT model, improve the BERT model, and introduce knowledge distillation technology;

[0025] Step S3: Process the network domain name sequence to generate the corresponding feature input DCC detection model. At the same time, construct the cross-entropy loss function for model training, and finally determine whether the input network domain name sequence is DCC.

[0026] In one embodiment, step S1 above—converting the PCAPNG file to CSV format, removing irrelevant information items to obtain the network domain name sequence, and labeling it—specifically includes:

[0027] (1) In DNS covert channel detection tasks, the collected data packets are typically stored in PCAPNG format. First, the packet headers of the PCAPNG file are parsed to extract relevant information, such as source IP address, destination IP address, port number, and protocol type. The PCAPNG file is then converted to a more easily processed CSV format. Next, irrelevant information items, such as sequence number, request time, source and destination IP addresses, protocol name, and request length, are removed. Finally, the dataset is labeled to distinguish whether each entry is a DCC (Delta Channel Covert Channel). For network domain name sequences, the preprocessed dataset format is shown below, where label 0 represents regular DNS and label 1 represents a DNS covert channel, i.e., DCC:

[0028] mail.daka.info,0

[0029] calendar.kaimata.school.nz,0

[0030] r22279.tunnel.tuns.org.,1

[0031] WWW.mariavitrine.com / br,0

[0032] 69-7-11-184.rev.cape.com,0

[0033] r35155.tunnel.tuns.org.,1

[0034] The embodiments of the present invention use the total dataset shown in Table 1.

[0035] Table 1 Total Dataset

[0036] DCC Dataset 34014 34014 0 Private Dataset 39951 24693 15258 Total dataset 73965 58707 15258

[0037] Table 2 shows the different types of DCCs and their sample numbers included in the DCC dataset in Table 1.

[0038] Table 2 DCC Dataset

[0039] cobalt_strike 1244 dns2tcp 5626 dnscat2_1 5172 dnsexfiltrator 13038 dnslivery 222 iodine_1.1 259 OzymanDNS 4165 reverse_dns_shell 389 tcp-over-dns 2420 tuns 1479

[0040] In one embodiment, step S2 above, which involves constructing a DCC detection model based on the BERT model, improving the BERT model, and introducing knowledge distillation techniques, specifically includes:

[0041] Step S21: Reduce the size of the DCC detection model by decreasing the number of layers and hidden units in the Transformer encoder of the BERT model;

[0042] Step S22: Shorter sequence lengths and fewer training steps were used during the pre-training of the DCC detection model;

[0043] Step S23: Introduce knowledge distillation technology into the DCC detection model to distill knowledge from the BERT model into the DCC detection model, so as to retain important information and knowledge in the BERT model;

[0044] Step S24: Fine-tune the BERT model by inputting the preprocessed network domain name sequence into the model and performing backpropagation and parameter updates based on the objective function, so that it can perform binary classification on the input network domain name sequence.

[0045] Because ordinary domain names and domain names with covert channels differ in semantic association information, such as domain name length, type, character frequency, and special resource record types, from a natural language processing perspective, DNS covert channel detection can be summarized as a binary classification task of regular or covert channel network domain names. Therefore, the DCC detection model of this invention is constructed by improving upon the BERT model. BERT is a Transformer model that uses self-supervised learning methods to pre-train on a large-scale English corpus. It is pre-trained only on raw text data, without any manual labeling, and uses an automatic process to generate input and labels from the text. To achieve sequence classification tasks while maintaining the high performance of the BERT pre-trained language model and appropriately reducing model size and computational cost, the DCC detection model of this invention is based on the BERT model and has the following improvements:

[0046] ① Simplified Model Structure: This invention's DCC detection model reduces the number of layers and hidden units in the Transformer encoder to decrease the model size, while still maintaining high performance for DCC detection tasks. The Transformer can process all text in parallel during training without using any loops. It is a sequence-to-sequence network based entirely on attention mechanisms, replacing recursion and convolution operations. Furthermore, the Transformer model utilizes self-attention mechanisms to consider the importance of each input component with different weights, employing an encoder-decoder architecture that introduces attention mechanisms within both encoding and decoding blocks. This approach surpasses traditional deep learning techniques. Deep learning methods suitable for DNS covert channel detection require large datasets, significant time and computational resources for model training. Figure 2 A schematic diagram of the Transformer model is shown.

[0047] ② Improved pre-training process: The DCC detection model of this invention uses shorter sequence lengths and fewer training steps in the pre-training stage to speed up the pre-training process. The model can still learn effective language representations of DCC even after the training time is reduced, and can meet the immediacy and real-time requirements of DNS covert channel detection tasks in practical application environments as much as possible.

[0048] ③ Knowledge Distillation: The DCC detection model of this invention uses knowledge distillation technology, that is, by distilling knowledge from the original BERT model into this model, the important information and knowledge in the BERT model are retained, so that this model occupies less resources in the actual deployment environment and can provide high-quality language representation at a faster inference speed.

[0049] ④ Fine-tuning for DCC detection tasks: Use network domain name sequences as model input, and classify each input sequence by fine-tuning the model to determine whether it contains a hidden channel; label each network domain name sequence used for model training to indicate whether it contains a hidden channel. By fine-tuning the model, the semantic information of each domain name can be learned and classified and labeled to identify DNS hidden channels.

[0050] In one embodiment, step S3 above—preprocessing the network domain name sequence to generate a corresponding feature input DCC detection model, constructing a cross-entropy loss function for model training, and finally determining whether the input network domain name sequence is a DCC—specifically includes:

[0051] Step S31: Segment the input network domain name sequence into individual words or sub-words according to domain name level rules, while also satisfying the segmentation method required for model training;

[0052] Step S32: Add special markers to the segmented sequence so that the DCC detection model can understand the start and end positions of the sequence. Add a [CLS] marker at the beginning of the network domain name sequence to indicate the start of the sequence, and add a [SEP] marker at the end of the sequence to indicate the end of the sequence;

[0053] Step S33: Replace each tag with the corresponding ID in the embedding table, that is, map each word or subword in the segmented sequence to its corresponding index sequence in the vocabulary, and add positional encoding and attention mask for each position. Integrate the segmented sequence, positional encoding, and attention encoding into a feature sequence, that is, convert the network domain name sequence into the corresponding feature sequence, input it into the DCC detection model for training, and the output of the model is whether it is DCC;

[0054] Figure 3 This diagram illustrates the process of preprocessing network domain name sequences, namely tokenization.

[0055] Step S34: Construct the cross-entropy loss function to update the model parameters.

[0056]

[0057] Among them, y i This represents the true label of sample i, where a label of 1 indicates DCC and a label of 0 indicates regular DNS traffic; p i This represents the result predicted by the DCC detection model for sample i; N is the total number of samples.

[0058] The loss function constructed in this embodiment of the invention is used to measure the difference between the model's prediction results and the true labels, thereby improving the model's generalization ability and robustness.

[0059] This invention discloses a method for detecting DNS covert channels. Unlike traditional statistical methods, the DCC detection model of this invention automatically learns data features, eliminating errors that may arise from manual parameter adjustments. This invention can adaptively learn data features and patterns, making it more flexible in adapting to datasets of different types and sizes. Furthermore, the proposed method can automatically learn the data distribution, enhancing its robustness and making it easier to detect new DNS covert channel attacks, especially when trained on smaller datasets, where the detection accuracy remains very high. The proposed method can handle complex sequence data with long sequence dependencies, making it highly effective for detecting DNS covert channel attacks and solving the problem of traditional machine learning methods requiring manual feature extraction from sequence data.

[0060] Example 2

[0061] like Figure 4 As shown, this embodiment of the invention provides a DNS covert channel detection system, comprising the following modules:

[0062] The preprocessing module 41 is used to convert the PCAPNG file into CSV format, remove irrelevant information items, obtain the network domain name sequence, and label it.

[0063] The DCC detection model building module 42 is used to build a DCC detection model based on the BERT model, improve the BERT model, and introduce knowledge distillation technology.

[0064] The DCC detection module 43 is used to preprocess the network domain name sequence, generate corresponding feature input DCC detection model, construct cross-entropy loss function for model training, and finally determine whether the input network domain name sequence is DCC.

[0065] The above embodiments are provided merely for the purpose of describing the present invention and are not intended to limit the scope of the invention. The scope of the invention is defined by the appended claims. Various equivalent substitutions and modifications made without departing from the spirit and principles of the invention should be covered within the scope of the invention.

Claims

1. A method for detecting a DNS covert channel, characterized in that, include: Step S1: Convert the PCAPNG file to CSV format, remove irrelevant information items, obtain the network domain name sequence, and label it; Step S2: Construct a DCC detection model based on the BERT model, improve the BERT model, and introduce knowledge distillation technology, specifically including: Step S21: Reduce the size of the DCC detection model by decreasing the number of layers and hidden units in the Transformer encoder of the BERT model; Step S22: Shorter sequence lengths and fewer training steps were used in the pre-training process of the DCC detection model; Step S23: Introduce knowledge distillation technology into the DCC detection model to distill knowledge from the BERT model into the DCC detection model, so as to retain important information and knowledge in the BERT model; Step S24: Fine-tune the BERT model by inputting the preprocessed network domain name sequence into the model and performing backpropagation and parameter updates according to the objective function, so that it can perform binary classification on the input network domain name sequence. Step S3: Preprocess the network domain name sequence to generate corresponding features for inputting the DCC detection model. Simultaneously, construct a cross-entropy loss function for model training. Finally, determine whether the input network domain name sequence is a DCC. Specifically, this includes: Step S31: Segment the input network domain name sequence into individual words or sub-words according to domain name level rules, while simultaneously satisfying the segmentation method required for model training; Step S32: Add special markers to the segmented sequence so that the DCC detection model can understand the start and end positions of the sequence; add a [CLS] marker to the beginning of the network domain name sequence to indicate the start of the sequence, and add a [SEP] marker to the end of the sequence to indicate the end of the sequence; Step S33: Replace each of the tokens with the corresponding ID in the embedding table, that is, map each word or subword in the segmented sequence to the index sequence in its corresponding vocabulary, and add position encoding and attention mask for each position; integrate the segmented sequence, position encoding and attention encoding into a feature sequence, that is, convert the network domain name sequence into a corresponding feature sequence, input it into the DCC detection model for training, and the output of the model is whether it is DCC; Step S34: Construct the cross-entropy loss function to update the model parameters: in, y i Indicates sample i The actual label, where a label of 1 indicates DCC and a label of 0 indicates regular DNS traffic; p i Indicates sample i The result predicted by the DCC detection model; N The total number of samples.

2. A DNS covert channel detection system, characterized in that, Includes the following modules: The preprocessing module is used to convert PCAPNG files into CSV format, remove irrelevant information items, obtain the network domain name sequence, and label it. A module for building DCC detection models is included. This module is used to construct DCC detection models based on the BERT model. The BERT model is improved, and knowledge distillation techniques are introduced. Specifically, this includes: Step S21: Reduce the size of the DCC detection model by decreasing the number of layers and hidden units in the Transformer encoder of the BERT model; Step S22: Shorter sequence lengths and fewer training steps were used in the pre-training process of the DCC detection model; Step S23: Introduce knowledge distillation technology into the DCC detection model to distill knowledge from the BERT model into the DCC detection model, so as to retain important information and knowledge in the BERT model; Step S24: Fine-tune the BERT model by inputting the preprocessed network domain name sequence into the model and performing backpropagation and parameter updates according to the objective function, so that it can perform binary classification on the input network domain name sequence. The DCC detection module is used to preprocess the network domain name sequence, generate corresponding features to input into the DCC detection model, construct a cross-entropy loss function for model training, and finally determine whether the input network domain name sequence is DCC. Specifically, it includes: Step S31: Segment the input network domain name sequence into individual words or sub-words according to domain name level rules, while simultaneously satisfying the segmentation method required for model training; Step S32: Add special markers to the segmented sequence so that the DCC detection model can understand the start and end positions of the sequence; add a [CLS] marker to the beginning of the network domain name sequence to indicate the start of the sequence, and add a [SEP] marker to the end of the sequence to indicate the end of the sequence; Step S33: Replace each of the tokens with the corresponding ID in the embedding table, that is, map each word or subword in the segmented sequence to the index sequence in its corresponding vocabulary, and add position encoding and attention mask for each position; integrate the segmented sequence, position encoding and attention encoding into a feature sequence, that is, convert the network domain name sequence into a corresponding feature sequence, input it into the DCC detection model for training, and the output of the model is whether it is DCC; Step S34: Construct the cross-entropy loss function to update the model parameters: in, y i Indicates sample i The actual label, where a label of 1 indicates DCC and a label of 0 indicates regular DNS traffic; p i Indicates sample i The result predicted by the DCC detection model; N The total number of samples.

Images