Detection of DNS tunneling in mobile networks using machine learning

Forfatter(e)

Utgivelsesdato

2017

Serie/Rapportnr.

Lecture Notes in Electrical Engineering;Information Science and Applications 2017, Volume 424

Utgiver

Springer Verlag

Dokumenttype

Sammendrag

Lately, costly and threatening DNS tunnels on the mobile networks bypassing the mobile operator’s Policy and Charging Enforcement Function (PCEF), has shown the vulnerability of the mobile networks caused by the Domain Name System (DNS) which calls for protection solutions. Unfortunately there is currently no really adequate solution. This paper proposes to use machine learning techniques in the detection and mitigation of a DNS tunneling in mobile networks. Two machine learning techniques, namely One Class Support Vector Machine (OCSVM) and K-Means are experimented and the results prove that machine learning techniques could yield quite efficient detection solutions. The paper starts with a comprehensive introduction to DNS tunneling in mobile networks. Next the challenges in DNS tunneling detections are reviewed. The main part of the paper is the description of proposed DNS tunneling detection using machine learning.

Emneord

Versjon

submittedVersion

Permanent URL

  • https://hdl.handle.net/10642/5962