DNS Tunneling：一种基于深度学习的词典检索方法
DNS Tunneling: A Deep Learning based Lexicographical Detection Approach
摘要：
域名服务是一种用于名称解析的可信协议，但在过去几年中，已经开发了一些方法来将其用于数据传输。DNS Tunnel是一种将数据编码在DNS查询中的方法，允许通过DNS进行信息交换。这一特性对于黑客来说很有吸引力，他们利用DNS Tunnel方法与感染恶意软件的机器建立双向通信，目的是以模糊的方式泄露数据或发送指令。为了快速准确地检测这些威胁，本工作提出了一种基于卷积神经网络（CNN）的检测方法，具有最小的架构复杂度。由于缺乏高质量的数据集来评估DNS Tunnel连接，我们还提出了一个新的数据集，其中包含五个著名的DNS工具生成的DNS Tunnel域的详细构造和描述。尽管其结构简单，但由此产生的CNN模型正确检测到超过92%的Tunnel域，假阳性率接近0.8%。
英文摘要：
Domain Name Service is a trusted protocol made for name resolution, but during past years some approaches have been developed to use it for data transfer. DNS Tunneling is a method where data is encoded inside DNS queries, allowing information exchange through the DNS. This characteristic is attractive to hackers who exploit DNS Tunneling method to establish bidirectional communication with machines infected with malware with the objective of exfiltrating data or sending instructions in an obfuscated way. To detect these threats fast and accurately, the present work proposes a detection approach based on a Convolutional Neural Network (CNN) with a minimal architecture complexity. Due to the lack of quality datasets for evaluating DNS Tunneling connections, we also present a detailed construction and description of a novel dataset that contains DNS Tunneling domains generated with five well-known DNS tools. Despite its simple architecture, the resulting CNN model correctly detected more than 92% of total Tunneling domains with a false positive rate close to 0.8%.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
