论文标题
DNS通过行为分析的秘密渠道检测：机器学习方法
DNS Covert Channel Detection via Behavioral Analysis: a Machine Learning Approach
论文作者
论文摘要
由于网络的异质性很高，检测合法流量之间的秘密渠道代表了严重的挑战。因此，我们根据对从网络监视系统被动提取的DNS网络数据的分析提出了一种有效的秘密通道检测方法。该框架基于机器学习模块以及能够描述手头问题的特定异常指标的提取。本文的贡献是两个方面：（i）机器学习模型涵盖了针对网络用户量身定制的网络配置文件，而不是对单个查询事件，因此允许创建行为配置文件并发现与正常基线的可能偏差； （ii）模型是在无监督模式下创建的，从而允许识别零日攻击并避免对新变体的签名或启发式方法的要求。已在长达15天的实验会议上评估了该解决方案，并注入了涵盖最相关的渗透和隧道攻击的流量：检测到所有恶意变体，同时在同一时期产生较低的假阳性率。
Detecting covert channels among legitimate traffic represents a severe challenge due to the high heterogeneity of networks. Therefore, we propose an effective covert channel detection method, based on the analysis of DNS network data passively extracted from a network monitoring system. The framework is based on a machine learning module and on the extraction of specific anomaly indicators able to describe the problem at hand. The contribution of this paper is two-fold: (i) the machine learning models encompass network profiles tailored to the network users, and not to the single query events, hence allowing for the creation of behavioral profiles and spotting possible deviations from the normal baseline; (ii) models are created in an unsupervised mode, thus allowing for the identification of zero-days attacks and avoiding the requirement of signatures or heuristics for new variants. The proposed solution has been evaluated over a 15-day-long experimental session with the injection of traffic that covers the most relevant exfiltration and tunneling attacks: all the malicious variants were detected, while producing a low false-positive rate during the same period.
