DNS tunneling detection method based on ML & DL models

Domain Name System (DNS) tunnels as a covert communication channel between a controlled host and a master
server can be utilized by malicious attackers disguising the master server as an authoritative domain name server.
DNS tunneling can cause significant harm due to its ability to easily evade network security mechanisms by using
DNS traffic, so it is crucial to detect the malicious domain in advance. In this research, the performance of the
machine learning and deep learning models with existing detection methods are compared to determine their
effectiveness in detecting DNS tunneling activity, and optimize the models by tuning hyperparameters, adjusting
the architecture of the models, or combining multiple models to achieve better performance in the real-time
prediction.

Faculty Supervisor:

Murat Erdogdu

Student:

Partner:

BlueCat Networks

Discipline:

Computer science

Sector:

Professional, scientific and technical services

University:

University of Toronto

Program: