DNS隧道取证分析中基于熵的网络协议预测
Entropy-based Prediction of Network Protocols in the Forensic Analysis of DNS Tunnels
摘要：
DNS隧道技术通常用于恶意目的，但网络安全机制一直在努力检测这些。因此，网络取证分析已经被使用，但已被证明是缓慢的和工作密集的，因为网络取证分析工具难以处理未记录的或新的网络隧道技术。在本文中，我们提出了一种方法，以协助法医分析，通过自动推理的协议隧道内DNS隧道技术。我们分析了DNS隧道技术的内部数据包结构，并描述了不同网络协议及其DNS隧道等效协议的信息熵。由此，我们提出了我们的协议预测方法，使用熵分布平均。最后，我们在一个数据集上应用我们的方法来衡量它的性能，并表明它的预测准确率为75%。我们的方法也保护隐私，因为它不解析实际的隧道内容，而是只计算信息熵。
英文摘要：
DNS tunneling techniques are often used for malicious purposes but network security mechanisms have struggled to detect these. Network forensic analysis has thus been used but has proved slow and effort intensive as Network Forensics Analysis Tools struggle to deal with undocumented or new network tunneling techniques. In this paper we present a method to aid forensic analysis through automating the inference of protocols tunneled within DNS tunneling techniques. We analyze the internal packet structure of DNS tunneling techniques and characterize the information entropy of different network protocols and their DNS tunneled equivalents. From this, we present our protocol prediction method that uses entropy distribution averaging. Finally we apply our method on a dataset to measure its performance and show that it has a prediction accuracy of 75%. Our method also preserves privacy as it does not parse the actual tunneled content, rather it only calculates the information entropy.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
