The domain name system (DNS) that maps alphabetic names to numeric Internet Protocol (IP) addresses plays a foundational role for Internet communications. By default, DNS queries and responses are exchanged in unencrypted plaintext, and hence, can be read and/or hijacked by third parties. To protect user privacy, the networking community has proposed standard encryption technologies such as DNS over TLS (DoT), DNS over HTTPS (DoH), and DNS over QUIC (DoQ) for DNS communications, enabling clients to perform secure and private domain name lookups. We survey the DNS encryption literature published since 2016, focusing on its current landscape and how it is misused by malware, and highlighting the existing techniques developed to make inferences from encrypted DNS traffic. First, we provide an overview of various standards developed in the space of DNS encryption and their adoption status, performance, benefits, and security issues. Second, we highlight ways that various malware families can exploit DNS encryption to their advantage for botnet communications and/or data exfiltration. Third, we discuss existing inference methods for profiling normal patterns and/or detecting malicious encrypted DNS traffic. Several directions are presented to motivate future research in enhancing the performance and security of DNS encryption.
Improving the Identification of Real-world Malware's DNS Covert Channels Using Locality Sensitive Hashing
Center for Research and Technology (ZFT), University of Applied Sciences Worms（沃尔姆斯应用科学大学技术研究与应用中心）；Institute of Information Resource Management (IRM), Ulm University（乌尔姆大学信息资源管理研究所）
DomURLs_BERT: Pre-trained BERT-based Model for Malicious Domains and URLs Detection and Classification
College of Computing, Mohammed VI Polytechnic University, Ben Guerir, Morocco（摩洛哥穆莱·伊斯梅尔理工学院计算机学院）；Department of Computer Science, Faculty of Science, Technology and Medicine,University of Luxembourg, Luxembourg（卢森堡大学科学、技术与医学学院计算机科学系）；LISAC Laboratory, Faculty of Sciences Dhar El Mehraz, USMBA, Fez, Morocco（摩洛哥费赞大学科学与技术学院LISAC实验室）；Vanguard Center, Mohammed VI Polytechnic University, Ben Guerir, Morocco（摩洛哥穆莱·伊斯梅尔理工学院Vanguard中心）；National Moroccan Computer Emergency and Response Team (maCert), Morocco（摩洛哥国家计算机应急响应团队（maCert））
