DNS Tunneling Detection With False Positive Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing DNS tunneling detection methods fail to accurately distinguish between legitimate and malicious activities, resulting in high false positive detections, which burden security solutions and analysts, and can inadvertently block reputable traffic.
Innovation Solution
A multi-stage system utilizing retransmission-based features, name server robustness, and machine learning to classify DNS tunneling activities, reducing false positives by filtering domains associated with reputable name servers and employing a Naïve Bayes classifier.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If DNS tunneling detection is performed using existing methods, then malicious activities can be detected, but false positive detections increase significantly
Solution Approach 1:
The detection system is divided into multiple independent stages: initial DNS tunneling detection, name server robustness verification, and machine learning-based classification. Each stage processes specific features independently and contributes to the final decision, allowing the system to filter false positives at different levels rather than relying on a single detection mechanism
Solution Approach 2:
The patent introduces name server robustness as an intermediary verification layer between initial detection and final classification. By checking whether detected tunneling activities originate from reputable name servers, the system mediates between sensitive detection (that catches all potential threats) and specific detection (that avoids false positives), using the name server reputation as a filtering intermediary
2Object-affected harmful factors
If security solutions block all detected DNS tunneling activities, then malicious traffic is prevented, but legitimate traffic is inadvertently blocked
Solution Approach 1:
The system applies different detection thresholds and verification criteria to different name servers based on their reputation and robustness characteristics. Reputable name servers with high robustness scores benefit from relaxed detection thresholds, while unknown or suspicious name servers undergo stricter verification, allowing legitimate traffic from trusted sources to pass through while maintaining strict blocking for unverified sources
Solution Approach 2:
The detection system dynamically adjusts detection parameters such as threshold values and verification requirements based on name server robustness metrics. Name servers with higher robustness scores have their detection thresholds raised, reducing false positives, while name servers with lower scores maintain stricter thresholds, adapting the security response to the specific characteristics of each name server
3Measurement precision
If manual verification of DNS tunneling detections is performed, then false positives can be identified, but analyst efficiency and productivity decrease
Solution Approach 1:
The system implements automated self-verification mechanisms where the machine learning model and name server robustness checks automatically identify and filter false positives without requiring manual analyst intervention. The system serves itself by using accumulated data and established robustness metrics to automatically distinguish true positives from false positives, reserving manual verification only for edge cases that require human judgment
Solution Approach 2:
The system incorporates feedback loops where detection results, including false positive identifications, are fed back into the machine learning model for continuous training and improvement. This feedback mechanism allows the system to automatically learn from past false positives and improve its classification accuracy over time, reducing the need for ongoing manual verification while maintaining high precision
Data Source
AI summary
Techniques for automated identification of false positives in DNS tunneling detectors are disclosed. In some embodiments, a system, process, and/or computer program product for automated identification of false positives in DNS tunneling detectors includes receiving a set of passive DNS data, wherein the set of passive DNS data includes a DNS query and a DNS response for resolution of the DNS query for each of a plurality of DNS queries; extracting a plurality of features associated with each domain in the set of passive DNS data; and classifying DNS tunneling activities and performing false positive reduction using the plurality of features associated with each domain in the set of passive DNS data to reduce false positive detections.