Dynamic-Time-Warping for DNS Exfiltration Detection

Detection of DNS tunneling using Dynamic-Time-Warping.

Getting Started

Convert PCAPs to .csv file format:

python dtw_convert_pcap.py

Next, convert CSV files to .npy to train our kNN classifier:

python dtw_data.py
python dtw_data_heicloud.py # not publicly available

Next, train classifier (our skip this step to use the provided one)

python dtwknn.py

DNS Tunneling

• iodine
• dnscat2
• dns2tcp
• dnspot

Data set

In this study, we investigated the effects of packet_size, entropy, ``. We converted all *.pcap files using Tshark. Due to same IP addresses across the data set, we changed them accordingly.

tshark -r benign_heavy_3.pcap -Y "dns.flags == 0x0100" -T fields -e frame.time -e ip.src -e frame.len
sed -i -- 's/192.168.20.38/1.1.1.3/g' benign_heavy_3.csv

• CIC-Bell-DNS-EXF-2021

In addition, we also traced DNS tunnels in our lab environment.

Check heiBOX for the PCAPs files.

Verification

In order to validate our results, we implemented a XGBoost Ensemble and validated our performance against a well-established method.

Problems

skTime and Tensorflow

Set XLA_FLAGS for cuda path:

export XLA_FLAGS=--xla_gpu_cuda_data_dir=/usr/lib/cuda

Remove warning:

for a in /sys/bus/pci/devices/*; do echo 0 | sudo tee -a $a/numa_node; done