Visualization of DNS Tunneling Attacks Using Parallel Coordinates Technique

Abstract

The Domain Name System (DNS) is considered one of the most critical protocols on the Internet. The DNS translates readable domain names into Internet Protocol (IP) addresses and vice-versa. The DNS tunneling attack uses DNS to create a covert channel for bypassing the firewall and performing command and control functions from within a compromised network or to transfer data to and from the network. There is work for detecting attacks that use DNS but little work focusing on the DNS tunneling attack. In this work, we introduce a fast and scalable approach, using the parallel coordinates technique, visualizing a malicious DNS tunneling attack within the large amount of network traffic. The DNS tunneling attack was performed in order to study the differences between the normal and the malicious traffic. Based on different scenarios, four different DNS tunneling graphical patterns were defined for distinguishing between normal DNS traffic and malicious traffic containing DNS tunneling attacks. Finally, the proposed system was able to visualize the DNS tunneling attack efficiently for the future work of creating an efficient detection system.