基于特征变换和互信息的DNS隧道分析

2016 Eighth International Conference on Ubiquitous and Future Networks (ICUFN) Pub Date : 2016-07-05 DOI:10.1109/ICUFN.2016.7536939

E. Cambiaso, M. Aiello, M. Mongelli, Gianluca Papaleo

{"title":"基于特征变换和互信息的DNS隧道分析","authors":"E. Cambiaso, M. Aiello, M. Mongelli, Gianluca Papaleo","doi":"10.1109/ICUFN.2016.7536939","DOIUrl":null,"url":null,"abstract":"Tunneling attacks are executed to bypass security policies or leak sensitive data outside of a network. In this paper, we propose an innovative algorithm to profile DNS tunnels. Our approach combines Principal Component Analysis and Mutual Information. The proposed algorithm is validated on a live network. Results show that, under specific conditions, anomalies are correctly characterized through the proposed method. Other cases require instead further investigation.","PeriodicalId":403815,"journal":{"name":"2016 Eighth International Conference on Ubiquitous and Future Networks (ICUFN)","volume":"66 1","pages":"0"},"PeriodicalIF":0.0000,"publicationDate":"2016-07-05","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"11","resultStr":"{\"title\":\"Feature transformation and Mutual Information for DNS tunneling analysis\",\"authors\":\"E. Cambiaso, M. Aiello, M. Mongelli, Gianluca Papaleo\",\"doi\":\"10.1109/ICUFN.2016.7536939\",\"DOIUrl\":null,\"url\":null,\"abstract\":\"Tunneling attacks are executed to bypass security policies or leak sensitive data outside of a network. In this paper, we propose an innovative algorithm to profile DNS tunnels. Our approach combines Principal Component Analysis and Mutual Information. The proposed algorithm is validated on a live network. Results show that, under specific conditions, anomalies are correctly characterized through the proposed method. Other cases require instead further investigation.\",\"PeriodicalId\":403815,\"journal\":{\"name\":\"2016 Eighth International Conference on Ubiquitous and Future Networks (ICUFN)\",\"volume\":\"66 1\",\"pages\":\"0\"},\"PeriodicalIF\":0.0000,\"publicationDate\":\"2016-07-05\",\"publicationTypes\":\"Journal Article\",\"fieldsOfStudy\":null,\"isOpenAccess\":false,\"openAccessPdf\":\"\",\"citationCount\":\"11\",\"resultStr\":null,\"platform\":\"Semanticscholar\",\"paperid\":null,\"PeriodicalName\":\"2016 Eighth International Conference on Ubiquitous and Future Networks (ICUFN)\",\"FirstCategoryId\":\"1085\",\"ListUrlMain\":\"https://doi.org/10.1109/ICUFN.2016.7536939\",\"RegionNum\":0,\"RegionCategory\":null,\"ArticlePicture\":[],\"TitleCN\":null,\"AbstractTextCN\":null,\"PMCID\":null,\"EPubDate\":\"\",\"PubModel\":\"\",\"JCR\":\"\",\"JCRName\":\"\",\"Score\":null,\"Total\":0}","platform":"Semanticscholar","paperid":null,"PeriodicalName":"2016 Eighth International Conference on Ubiquitous and Future Networks (ICUFN)","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.1109/ICUFN.2016.7536939","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"","JCRName":"","Score":null,"Total":0}

引用次数: 11

摘要

隧道攻击是一种绕过安全策略或将敏感数据泄露到网络外的攻击。在本文中，我们提出了一种创新的算法来分析DNS隧道。我们的方法结合了主成分分析和互信息。该算法在实际网络中得到了验证。结果表明，在特定条件下，该方法能够正确地表征异常。其他案件则需要进一步调查。

本文章由计算机程序翻译，如有差异，请以英文原文为准。

查看原文本刊更多论文

Feature transformation and Mutual Information for DNS tunneling analysis

Tunneling attacks are executed to bypass security policies or leak sensitive data outside of a network. In this paper, we propose an innovative algorithm to profile DNS tunnels. Our approach combines Principal Component Analysis and Mutual Information. The proposed algorithm is validated on a live network. Results show that, under specific conditions, anomalies are correctly characterized through the proposed method. Other cases require instead further investigation.

求助全文

通过发布文献求助，成功后即可免费获取论文全文。去求助

来源期刊

2016 Eighth International Conference on Ubiquitous and Future Networks (ICUFN)

自引率

0.00%

发文量