DNS tunneling detection method based on ML & DL models
Domain Name System (DNS) tunnels as a covert communication channel between a controlled host and a master
server can be utilized by malicious attackers disguising the master server as an authoritative domain name server.
DNS tunneling can cause significant harm due to its ability to easily evade network security mechanisms by using
DNS traffic, so it is crucial to detect the malicious domain in advance. In this research, the performance of the
machine learning and deep learning models with existing detection methods are compared to determine their
effectiveness in detecting DNS tunneling activity, and optimize the models by tuning hyperparameters, adjusting
the architecture of the models, or combining multiple models to achieve better performance in the real-time
prediction.
Murat Erdogdu
BlueCat Networks
Computer science
Professional, scientific and technical services
University of Toronto
Accelerate