Classifying DNS tunneling tools for malicious DoH traffic

R Alenezi, SA Ludwig - 2021 IEEE Symposium Series on …, 2021 - ieeexplore.ieee.org
R Alenezi, SA Ludwig
2021 IEEE Symposium Series on Computational Intelligence (SSCI), 2021ieeexplore.ieee.org
Cyber adversaries continuously seek new ways to penetrate security systems and infect
computer infrastructure. The past decade has witnessed a sharp increase in attacks
targeting Domain Name Server (DNS) systems used to store information about the domain
names and their corresponding IP addresses (zone file). Therefore, preventing these require
a new method for attacks and their strategies. Researchers suggest that appropriate
remedial actions against cyber attacks can be attained by detailed investigation about the …
Cyber adversaries continuously seek new ways to penetrate security systems and infect computer infrastructure. The past decade has witnessed a sharp increase in attacks targeting Domain Name Server (DNS) systems used to store information about the domain names and their corresponding IP addresses (zone file). Therefore, preventing these require a new method for attacks and their strategies. Researchers suggest that appropriate remedial actions against cyber attacks can be attained by detailed investigation about the environment of digital systems. Although initially cited as a solution to attacks such as DNS spoofing and DNS tunneling, DNS over HTTPS (DoH) has introduced novel privacy challenges. Therefore, this paper contributes to the investigation of machine learning models as solutions to DNS tunneling and DoH security issues. Thus, focusing to determine how well the classifiers can distinguish between DNS tunneling types using different machine learning models which are frequently used among other researchers. The CIRA-CIC-DoHBrw-2020 data set is used for the experiments of ML models. The obtained results confirm that applying the classifiers to generate the models are good choices to detect DNS tunnelings of DNS attacks on DoH traffic. The efficacy of these models' performance was evaluated by measuring the precision, recall, F1-score, accuracy, and confusion matrix.
ieeexplore.ieee.org
以上显示的是最相近的搜索结果。 查看全部搜索结果