Malicious DNS Tunnel Tool Recognition using Persistent DoH Traffic Analysis

Mitsuhashi, Rikima; Jin, Yong; Iida, Katsuyoshi; Shinagawa, Takahiro; Takai, Yoshiaki

Malicious DNS Tunnel Tool Recognition using Persistent DoH Traffic Analysis

Mitsuhashi, Rikima; Jin, Yong; Iida, Katsuyoshi et al.

IEEE Transactions on Network and Service Management, 2022, 20(2), 2086-2095

Permalink : https://hdl.handle.net/2115/87440

このアイテムのアクセス数:660件（2026-03-04 15:54 集計）

閲覧可能ファイル

ファイル	フォーマット	サイズ	閲覧回数	説明
aper_IEEE_TNSM_20221016	pdf	4.84 MB	1,217

論文情報

ファイル出力 EndNote Basic出力 Mendeley出力

アクセス権	open access
URI	https://hdl.handle.net/2115/87440
タイトル	Malicious DNS Tunnel Tool Recognition using Persistent DoH Traffic Analysis
著者	Mitsuhashi, Rikima ; Jin, Yong ; Iida, Katsuyoshi ; Shinagawa, Takahiro ; Takai, Yoshiaki
著者名 Mitsuhashi, Rikima
e-Rad_Researcher 60725787 著者名 Jin, Yong
e-Rad_Researcher 00332768 著者名 Iida, Katsuyoshi
e-Rad_Researcher 40361745 著者名 Shinagawa, Takahiro
e-Rad_Researcher 00206707 著者名 Takai, Yoshiaki
言語	英語
キーワード	DNS over HTTPS (DoH)
	Network traffic classification
	Machine learning methods
	Gradient boosting decision tree algorithm
	GBDT algorithm
	Suspicious DoH traffic
	Emerging malicious DNS tunnel tool recognition
	CIRA-CICDoHBrw-2020
	DoH-Tunnel-Traffic-HKD
発行日	2022-10-19
出版者	IEEE
収録物名	IEEE Transactions on Network and Service Management
巻(号)	20(2)
ページ	2086-2095
記述	Published in: IEEE Transactions on Network and Service Management (Volume:20, Issue:2, June 2023)
抄録	DNS over HTTPS (DoH) protocol can mitigate the risk of privacy breaches but makes it difficult to control network security services due to the DNS traffic encryption. However, since malicious DNS tunnel tools for the DoH protocol pose network security threats, network administrators need to recognize malicious communications even after the DNS traffic encryption has become widespread. In this paper, we propose a malicious DNS tunnel tool recognition system using persistent DoH traffic analysis based on machine learning. The proposed system can accomplish continuous knowledge updates for emerging malicious DNS tunnel tools on the machine learning model. The system is based on hierarchical machine learning classification and focuses on DoH traffic analysis. The evaluation results confirm that the proposed system is able to recognize the six malicious DNS tunnel tools in total, not only well-known ones, including dns2tcp, dnscat2, and iodine, but also the emerging ones such as dnstt, tcp-over-dns, and tuns with 98.02% classification accuracy.
資源タイプ	学術雑誌論文
出版タイプ	Accepted Manuscript
権利情報	© 2022 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.
PISSN	1932-4537
関連情報 (isVersionOf)	出版社版DOI https://doi.org/10.1109/TNSM.2022.3215681
関連情報 (references)	HDL https://hdl.handle.net/2115/88092