Abstract
Lately, costly and threatening DNS tunnels on the mobile networks bypassing the mobile operator’s Policy and Charging Enforcement Function (PCEF), has shown the vulnerability of the mobile networks caused by the Domain Name System (DNS) which calls for protection solutions. Unfortunately there is currently no really adequate solution. This paper proposes to use machine learning techniques in the detection and mitigation of a DNS tunneling in mobile networks. Two machine learning techniques, namely One Class Support Vector Machine (OCSVM) and K-Means are experimented and the results prove that machine learning techniques could yield quite efficient detection solutions. The paper starts with a comprehensive introduction to DNS tunneling in mobile networks. Next the challenges in DNS tunneling detections are reviewed. The main part of the paper is the description of proposed DNS tunneling detection using machine learning.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
IETF: RFC 1034 Domain names – concepts and facilities, Internet standard, November 1987
IETF: RFC 1035 Domain names - Implementation and specification - Internet standard, November 1987
Pure Hacking: Reverse DNS Tunneling – Staged Loading Shellcode, Ty Miller, Blackhat (2008)
Ayaya: Black Ops of DNS, Dan Kaminsky, Blackhat (2004)
OzymanDNS – Dan Kaminsky (2004). https://dankaminsky.com/2004/07/29/51/
Dns2tcp - Hervé Schauer Consultants. http://www.hsc.fr/ressources/outils/dns2tcp/
Iodine. http://code.kryo.se/iodine/
Heyoka. http://heyoka.sourceforge.net/
MagicTunnel. http://www.magictunnel.net/
Element53 – Sander Nijhof. https://nijhof.biz/element53/
VPN over DNS. https://www.vpnoverdns.com/
SANS Institute: Data Charging Bypass - How your IDS can help, Hassan Mourad, September 2014
SANS Institute: Detecting DNS Tunneling, Greg Farnham, February 2013
Bianco, D.: A traffic-analysis approach to detecting DNS tunnels. http://blog.vorant.com/2006/05/traffic-analysis-approach-to-detecting.html. Accessed 3 May 2006
Pietraszek, T.: Dnscat. http://tadek.pietraszek.org/projects/DNScat/. Accessed 31 Oct 2004
Heavy Reading: DNS Security for Service Providers: An Active Approach at L7 – White Paper – Patrick Donegan, October 2015
Do, V.T., Engelstad, P., Feng, B., van Do, T.: Strengthening mobile network security using machine learning. In: Younas, M., Awan, I., Kryvinska, N., Strauss, C., van Thanh, D. (eds.) MobiWIS 2016. LNCS, vol. 9847, pp. 173–183. Springer, Heidelberg (2016). doi:10.1007/978-3-319-44215-0_14
Mitchell, T.M.: Machine Learning. Mcgraw-Hill Companies Inc, New York (1997). ISBN 0-47-042807-7
Manevitz, L.M., Yousef, M.: One-class SVMs for document classification. J. Mach. Learn. Res. 2, 139–154 (2002)
MacQueen, J.B.: Some methods for classification and analysis of multivariate observations. In: Proceedings of 5th Berkeley Symposium on Mathematical Statistics and Probability, pp. 281–297. University of California Press, Berkeley (1967). MR 0214227, Zbl 0214.46201, Accessed 07 Apr 2009
SlowDNS: A free VPN over DNS Tunneling Tool. http://slowdns.com/
Bengio, Y.: Learning deep architectures for AI. Found. Trends Mach. Learn. 2, 1–127 (2009). doi:10.1561/2200000006
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2017 Springer Nature Singapore Pte Ltd.
About this paper
Cite this paper
Do, V.T., Engelstad, P., Feng, B., van Do, T. (2017). Detection of DNS Tunneling in Mobile Networks Using Machine Learning. In: Kim, K., Joukov, N. (eds) Information Science and Applications 2017. ICISA 2017. Lecture Notes in Electrical Engineering, vol 424. Springer, Singapore. https://doi.org/10.1007/978-981-10-4154-9_26
Download citation
DOI: https://doi.org/10.1007/978-981-10-4154-9_26
Published:
Publisher Name: Springer, Singapore
Print ISBN: 978-981-10-4153-2
Online ISBN: 978-981-10-4154-9
eBook Packages: EngineeringEngineering (R0)