基于改进卷积神经网络识别DNS隐蔽信道

doi:10.11959/j.issn.1000-436x.2020017

Abstract

Abstract:

In order to effectively identify the multiple types of DNS covert channels,the implementation of different sorts of DNS covert channel software was studied,and a detection based on the improved convolutional neural network was proposed.The experimental results,grounded upon the campus network traffic,show that the detection can identify twenty-two kinds of data interaction modes of DNS covert channels and is able to identify the unknown DNS covert channel traffic.The proposed method outperforms the existing methods.

Key words: covert channel, domain name system, convolutional neural network

CLC Number:

TP393

Meng ZHANG,Haoliang SUN,Peng YANG. Identification of DNS covert channel based on improved convolutional neural network[J]. Journal on Communications, 2020, 41(1): 169-179.

Figures/Tables 13

References 13

[1]	CROTTI M , DUSI M , GRINGOLI F ,et al. Detecting HTTP tunnels with statistical mechanisms[C]// IEEE International Conference on Communications. IEEE, 2007: 6162-6168.
[2]	DUSI M , CROTTI M , GRINGOLI F ,et al. Tunnel hunter:detecting application-layer tunnels with statistical fingerprinting[J]. Computer Networks, 2009,53(1): 81-97.
[3]	CASAS P , MAZEL J , OWEZARSKI P . MINETRAC:mining flows for unsupervised analysis ＆ semi-supervised classification[C]// The 23rd International Teletraffic Congress. 2011: 87-94.
[4]	MARCHAL S , FRANCIS J , WAGNER C ,et al. DNSSM:a large scale passive DNS security monitering framework[J]. Network Operations＆ Management Symposium IEEE, 2012,131(5): 988-993.
[5]	KARASARIDIS A , MEIER-HELLSTEM K , HOEFLIN D . NIS04-2:detection of DNS anomalies using flow data analysis[C]// Global Telecommunications Conference. IEEE, 2006: 1-6.
[6]	SHERIDAN S , KEANE A . Detection of DNS based covert channels[C]// The 14th European Conference on Cyber Warfare and Security (ECCWS). 2015: 66-77.
[7]	SHAFIEIAN S , SMITH D , ZULKERNINE M . Detecting DNS tunneling using ensemble learning[C]// International Conference on Network and System Security. 2017: 112-127.
[8]	NUSSBAUM L , NEYRON P , RICHARD O . On robust covert chan-nels inside DNS[J]. IFIP Advances in Information＆Communication Technology, 2009,297(7): 51-62.
[9]	AIELLO M , MERLO A , PAPALEO G . Performance assessment and analysis of DNS tunneling tools[J]. Logic Journal of IGPL, 2013,21(4): 592-602.
[10]	NADLER A , AMINOV A , SHABTAI A . Detection of malicious and low throughput data exfiltration over the DNS protocol[J]. Computer＆ Security, 2019,80(10): 36-53.
[11]	FARNHAM G , ATLASIS A . Detecting DNS tunneling[C]// SANS Institute InfoSec Reading Room. 2013: 1-32.
[12]	BILGE L , KIRDA E , KRUEGEL C ,et al. EXPOSURE:finding malicious domains using passive DNS analysis[C]// The Network and Distributed System Security Symposium. 2011: 68-82.
[13]	LENCUN Y , BOTTOU L , BENGIO Y . Gradient-based learning applied to document recognition[J]. Proceedings of the IEEE, 1998,862(10): 2278-2324.

Metrics

Recommended 0

No Suggested Reading articles found!

序号	表征元素名称	含义
1	Label_pointer	网络分组含标签指针
2	Exist_cname	应答分组含CNAME记录
3	Response_rdlength	应答部分资源记录数据长度总和
4	All_rdlength	全部资源记录数据长度总和
5	Num_unusual_record_type	不常用的记录类型的数目
6	Num_qname_label	QNAME的标签数量
7	Qname_2ld_length	QNAME二级域名部分的字符串长度
8	Qname_subdomain_2_data_amount	QNAME子域名承载的二进制数据量
9	Qname_subdomain_data_amount	QNAME子域名存储的数据量
10	Domain_str_entropy	域名字符串的熵
11	Parse_exception	网络分组解析是否异常
12	Injected_data_amount	注入数据的数据量
13	DNS_request_length	DNS请求分组的长度
14	DNS_response_length	DNS响应分组的长度
15	UDP_payload_length	UDP载荷长度
16	Violate_strategy	是否违反策略

特征集	特征集说明
Feature_Set₁	客户端发送DNS分组的总数
	客户端接收DNS分组的总数
	异常解析
	违反策略
Feature_Set₂	标签指针
	CNAME 记录
	使用了不常见的记录类型
	QNAME 中具有二进制的分组总数
Feature_Set₃	网络分组特征1、2、6、7、9、10、12、13、14、15的统计值
	独立的DNS 请求个数
Feature_Set₄	每个域名的主机名个数
	NXDomain 响应的个数

编号	C1卷积层		S2池化层		C3卷积层		S4池化层		F5全连接层
编号	卷积核	输出	采样窗口	输出	卷积核	输出	采样窗口	输出	卷积核	输出
模型1	48×(3×3)	48×(8×8)	2×2	48×(4×4)	96×(3×3)	96×(4×4)	2×2	96×(2×2)	96×(2×2)	96×1
模型2	32×(3×3)	32×(8×8)	2×2	32×(4×4)	64×(3×3)	64×(4×4)	2×2	64×(2×2)	32×(2×2)	32×1
模型3	16×(3×3)	16×(8×8)	2×2	16×(4×4)	32×(3×3)	32×(4×4)	2×2	32×(2×2)	64×(2×2)	64×1
模型4	16×(3×3)	16×(8×8)	2×2	16×(4×4)	32×(3×3)	32×(4×4)	2×2	32×(2×2)	32×(2×2)	32×1
模型5	8×(3×3)	8×(8×8)	2×2	8×(4×4)	16×(3×3)	16×(4×4)	2×2	16×(2×2)	64×(2×2)	64×1
模型6	8×(3×3)	8×(8×8)	2×2	8×(4×4)	16×(3×3)	16×(4×4)	2×2	16×(2×2)	32×(2×2)	32×1

编号	总体正确率	测试时间/s
模型1	88.98%	50.21
模型2	96.96%	48.32
模型3	97.78%	42.15
模型4	98.68%	41.23
模型5	98.92%	36.57
模型6	99.65%	35.56

编号	总体正确率	测试时间/s
模型1	97.98%	50.57
模型2	98.10%	48.59
模型3	98.32%	41.59
模型4	98.33%	40.35
模型5	97.99%	36.39
模型6	98.67%	35.19

Identification of DNS covert channel based on improved convolutional neural network

RichHTML

PDF

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 13

References 13

Related Articles 15

Metrics

Recommended 0

样本类型	训练样本数	测试样本数
校园网DNS流量	300 000	279 200
Iodine（6类资源记录）	312 000	312 000
Dns2tcp（2类资源记录）	320 000	320 000
DNSCat（2类资源记录）	320 000	320 000
tcp-over-dns	280 000	280 000
PSUDP	240 000	240 000

方法	总体准确率	测试时间/s
Farnham模型	93.96%	5.11
Karasaridis模型	96.86%	4.66
Shafieian模型	97.23%	5.00
Nadler模型	98.37%	5.01
本文方法	99.50%	5.03

类型	Farnham模型	Karasarid is模型	Shafieian模型	Nadler模型	本文方法
Iodine₁	98.6%	98.1%	99.1%	99.3%	99.8%
Iodine₂	91.9%	93.6%	97.9%	97.5%	99.3%
Iodine₃	93.8%	95.6%	97.3%	97.8%	99.1%
Iodine₄	96.9%	97.2%	98.6%	98.5%	99.9%
Iodine₅	78.6%	87.9%	96.2%	96.8%	99.8%
Iodine₆	75.9%	88.9%	97.2%	97.6%	99.3%
Dns2tcp₁	61.8%	68.7%	97.4%	97.1%	99.0%
Dns2tcp₂	96.2%	93.3%	98.2%	98.1%	99.9%
DNSCat₁	91.2%	90.9%	95.9%	96.1%	99.9%
DNSCat₂	91.7%	92.6%	96.9%	97.0%	99.6%
tcp-over-dns	77.1%	79.1%	92.1%	93.3%	98.3%
PSUDP	78.6%	78.9%	91.2%	92.1%	96.9%

[1]	Leixiao LI, Jinze DU, Hao LIN, Haoyu GAO, Yanyan YANG, Jing GAO. Research progress of blockchain network covert channel [J]. Journal on Communications, 2022, 43(9): 209-223.
[2]	Yurong LIAO, Haining WANG, Cunbao LIN, Yang LI, Yuqiang FANG, Shuyan NI. Research progress of deep learning-based object detection of optical remote sensing image [J]. Journal on Communications, 2022, 43(5): 190-203.
[3]	Fan ZHANG, Yun HUANG, Zizhuo FANG, Wei GUO. Lost-minimum post-training parameter quantization method for convolutional neural network [J]. Journal on Communications, 2022, 43(4): 114-122.
[4]	Fenghua LI, Chaoyang LI, Chao GUO, Zifu LI, Liang FANG, Yunchuan GUO. Survey on key technologies of covert channel in ubiquitous network environment [J]. Journal on Communications, 2022, 43(4): 186-201.
[5]	Zhengyu ZHU, Gengwang HOU, Chongwen HUANG, Gangcan SUN, Wanming HAO, Jing LIANG. Systems resource allocation algorithm for RIS-assisted D2D secure communication based on parallel CNN [J]. Journal on Communications, 2022, 43(3): 172-179.
[6]	Hongyan WANG, Libin ZHANG, Guoqiang CHEN, Zumin WANG, Zhiyuan GUAN. Approach of target tracking combining particle filter and metric learning [J]. Journal on Communications, 2021, 42(5): 98-110.
[7]	Jiawen DIAO, Binxing FANG, Xiang CUI, Zhongru WANG, Ruiling GAN, Lin FENG, Hai JIANG. Survey of DNS covert channel [J]. Journal on Communications, 2021, 42(5): 164-178.
[8]	Nianwen SI, Wenlin ZHANG, Dan QU, Heyu CHANG, Shengxiang LI, Tong NIU. Generalized Grad-CAM attacking method based on adversarial patch [J]. Journal on Communications, 2021, 42(3): 23-35.
[9]	Hongmin GAO, Xueying CAO, Zhonghao CHEN, Zaijun HUA, Chenming LI, Yue CHEN. Hyperspectral image classification method based on multi-scale proximal feature concatenate network [J]. Journal on Communications, 2021, 42(2): 92-102.
[10]	Jun YANG,Jisheng DANG. Semantic segmentation of 3D point cloud based on contextual attention CNN [J]. Journal on Communications, 2020, 41(7): 195-203.
[11]	Chunyu HAN,Yongzheng ZHANG,Yu ZHANG. Fast-flucos:malicious domain name detection method for Fast-flux based on DNS traffic [J]. Journal on Communications, 2020, 41(5): 37-47.
[12]	Hongmin GAO,Xueying CAO,Yao YANG,Zaijun HUA,Chenming LI. Application of bilateral fusion model based on CNN in hyperspectral image classification [J]. Journal on Communications, 2020, 41(11): 132-140.
[13]	Xin ZHOU,Xiaoxin HE,Changwen ZHENG. Radio signal recognition based on image deep learning [J]. Journal on Communications, 2019, 40(7): 114-125.
[14]	Yanfeng LI,Liping DING,Jingzheng WU,Qiang CUI,Xuehua LIU,Bei GUAN. Research on a new network covert channel model in blockchain environment [J]. Journal on Communications, 2019, 40(5): 67-78.
[15]	Jia LI,Xiaochun YUN,Shuhao LI,Yongzheng ZHANG,Jiang XIE,Fang FANG. HTTP malicious traffic detection method based on hybrid structure deep neural network [J]. Journal on Communications, 2019, 40(1): 24-33.

类型	Farnham模型	Karasaridis模型	Shafieian模型	Nadler模型	本文方法
Iodine₁	1.6%	2.17%	0.93%	0.91%	0.11%
Iodine₂	1.7%	1.81%	0.98%	0.97%	0.13%
Iodine₃	1.32%	1.66%	1.22%	1.11%	0.91%
Iodine₄	1.91%	1.32%	1.14%	0.99%	0.31%
Iodine₅	1.86%	1.87%	0.70%	0.72%	0.18%
Iodine₆	1.93%	1.91%	0.68%	0.66%	0.25%
Dns2tcp₁	2.58%	1.97%	1.32%	1.29%	0.71%
Dns2tcp₂	2.82%	3.13%	1.33%	1.30%	1.19%
DNSCat₁	2.19%	2.89%	1.24%	1.21%	0.9%
DNSCat₂	3.17%	2.11%	1.08%	1.03%	0.61%
tcp-over-dns	2.16%	1.91%	0.89%	0.91%	0.23%
PSUDP	3.68%	3.93%	1.45%	1.50%	1.13%