Technology of Information Security
|
App. Res. of Comp. Printed Article
Vol. 40, 2023 No. 10
3138-3143

DNS covert channel detection based on traffic slice

Liu Yangyanga,b
Ruan Shuhuaa,b
Zeng Xuemeib
a. School of Cyber Science & Engineering, b. Cyber Science Research Institute, Sichuan University, Chengdu 610065, China
DOI: 10.19734/j.issn.1001-3695.2023.02.0040

Abstract

In order to solve the problem of bypassing detection methods for DNS covert channel(DCC) traffic deformation strategies, this paper proposed a DCC detection method based on traffic slice. In this method, the traffic of the experimental environment was firstly divided into batches based on the sliding window, and then obtained the traffic slice based on the aggregation of each host-end IP. Each slice contains DNS packets and Web packets belonging to the same host in a short time span. Then, for the DNS data volume, DNS request behavior, DNS response behavior, and association behavior correlation behavior with WEB of DNS in the slice, it implement DCC-detection-oriented feature engineering and create detection models on this basis. Comparative experiments show that the detection accuracy of the constructed DCC detection model on the conventional DCC traffic datasets is 99.83%, and the false positive rate is only 0.08%. On the deformed DCC traffic datasets with six types of different traffic deformation strategies, the detection ability of the DCC detection model is more than 95% on average, which is better than the other detection schemes. It proves that the proposed method is effective in dealing with DCC traffic deformation. Moreover, the proposed method, which can effectively detect DCC communication within a single traffic slice, is a detection method with good real-time performance.

Foundation Support

国家自然科学基金区域基金重点项目(U19A2081)
中央高校基础研究基金资助项目(2022SCU12116)
四川大学理工科发展计划项目(2020SCUNG129)

Publish Information

DOI: 10.19734/j.issn.1001-3695.2023.02.0040
Publish at: Application Research of Computers Printed Article, Vol. 40, 2023 No. 10
Section: Technology of Information Security
Pages: 3138-3143
Serial Number: 1001-3695(2023)10-039-3138-06

Publish History

[2023-04-25] Accepted Paper
[2023-10-05] Printed Article

Cite This Article

刘阳洋, 阮树骅, 曾雪梅. 基于流量切片的DNS隐蔽通道检测 [J]. 计算机应用研究, 2023, 40 (10): 3138-3143. (Liu Yangyang, Ruan Shuhua, Zeng Xuemei. DNS covert channel detection based on traffic slice [J]. Application Research of Computers, 2023, 40 (10): 3138-3143. )

About the Journal

  • Application Research of Computers Monthly Journal
  • Journal ID ISSN 1001-3695
    CN  51-1196/TP

Application Research of Computers, founded in 1984, is an academic journal of computing technology sponsored by Sichuan Institute of Computer Sciences under the Science and Technology Department of Sichuan Province.

Aiming at the urgently needed cutting-edge technology in this discipline, Application Research of Computers reflects the mainstream technology, hot technology and the latest development trend of computer application research at home and abroad in a timely manner. The main contents of the journal include high-level academic papers in this discipline, the latest scientific research results and major application results. The contents of the columns involve new theories of computer discipline, basic computer theory, algorithm theory research, algorithm design and analysis, blockchain technology, system software and software engineering technology, pattern recognition and artificial intelligence, architecture, advanced computing, parallel processing, database technology, computer network and communication technology, information security technology, computer image graphics and its latest hot application technology.

Application Research of Computers has many high-level readers and authors, and its readers are mainly senior and middle-level researchers and engineers engaged in the field of computer science, as well as teachers and students majoring in computer science and related majors in colleges and universities. Over the years, the total citation frequency and Web download rate of Application Research of Computers have been ranked among the top of similar academic journals in this discipline, and the academic papers published are highly popular among the readers for their novelty, academics, foresight, orientation and practicality.

Indexed & Evaluation

  • The Second National Periodical Award 100 Key Journals
  • Double Effect Journal of China Journal Formation
  • the Core Journal of China (Peking University 2023 Edition)
  • the Core Journal for Science
  • Chinese Science Citation Database (CSCD) Source Journals
  • RCCSE Chinese Core Academic Journals
  • Journal of China Computer Federation
  • 2020-2022 The World Journal Clout Index (WJCI) Report of Scientific and Technological Periodicals
  • Full-text Source Journal of China Science and Technology Periodicals Database
  • Source Journal of China Academic Journals Comprehensive Evaluation Database
  • Source Journals of China Academic Journals (CD-ROM Version), China Journal Network
  • 2017-2019 China Outstanding Academic Journals with International Influence (Natural Science and Engineering Technology)
  • Source Journal of Top Academic Papers (F5000) Program of China's Excellent Science and Technology Journals
  • Source Journal of China Engineering Technology Electronic Information Network and Electronic Technology Literature Database
  • Source Journal of British Science Digest (INSPEC)
  • Japan Science and Technology Agency (JST) Source Journal
  • Russian Journal of Abstracts (AJ, VINITI) Source Journals
  • Full-text Journal of EBSCO, USA
  • Cambridge Scientific Abstracts (Natural Sciences) (CSA(NS)) core journals
  • Poland Copernicus Index (IC)
  • Ulrichsweb (USA)