Print Email Facebook Twitter Flow-based detection of DNS tunnels Title Flow-based detection of DNS tunnels Author Ellens, W. Zuraniewski, P.W. Sperotto, A. Schotanus, H.A. Mandjes, M. Meeuwissen, H.B. Contributor Doyen, G. (editor) Waldburger, M. (editor) Publication year 2013 Abstract DNS tunnels allow circumventing access and security policies in firewalled networks. Such a security breach can be misused for activities like free web browsing, but also for command & control traffic or cyber espionage, thus motivating the search for effective automated DNS tunnel detection techniques. In this paper we develop such a technique, based on the monitoring and analysis of network flows. Our methodology combines flow information with statistical methods for anomaly detection. The contribution of our paper is twofold. Firstly, based on flow-derived variables that we identified as indicative of DNS tunnelling activities, we identify and evaluate a set of non-parametrical statistical tests that are particularly useful in this context. Secondly, the efficacy of the resulting tests is demonstrated by extensive validation experiments in an operational environment, covering many different usage scenarios. © 2013 IFIP International Federation for Information Processing. Subject Communication & InformationPNS - Performance of Networks & Services ; ISEC - Information SecurityTS - Technical SciencesInfrastructuresInformaticsInformation SocietyAnomaly detectionCyber securityDNS tunnelingnetwork flows To reference this document use: http://resolver.tudelft.nl/uuid:a523169c-1001-41f3-ad68-6636e8409c5d DOI https://doi.org/10.1007/978-3-642-38998-6_16 TNO identifier 474973 Publisher Springer, Berlin ISBN 9783642389979 ISSN 0302-9743 Source Emerging Management Mechanisms for the Future Internet. 7th IFIP WG 6.6 International Conference on Autonomous Infrastructure, Management, and Security, AIMS 2013, 25-28 June 2013, Barcelona, Spain, 124-135 Series Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) Document type bookPart Files To receive the publication files, please send an e-mail request to TNO Library.