关键词: DNS隧道, 隐蔽通信, 隧道工具, 隧道通信检测, 隧道检测特征, 隧道工具评估

Abstract: As a system that converts IP addresses and domain names to each other, Domain Name System (DNS) is one of the important basic protocols in the Internet. Due to the importance of DNS in the Internet, the security policies of some security facilities such as firewalls and Intrusion Detection Systems (IDS) allow DNS traffic to pass by default, giving attackers the opportunity to use DNS tunneling for communication. This fact gives attackers the opportunity to use DNS tunneling for communication. Recently, there are many malwares that support DNS communication or even use DNS communication by default, which brings great challenges to current IDS or security departments. However, existing research mainly focuses on specific detection methods and rarely explores the tunneling tool itself, even though majority of authors rely on tunneling tools to generate samples in their solution. This article systematically elaborates on the development history and research status of DNS tunneling and existing detection solutions, as well as discusses the advantages and disadvantages of detection methods in the past 10 years. Subsequently, 6 communication tools such as dnscat2, Iodine, and dns2tcp, which are commonly used in these detection solutions, were evaluated and tested, and the experimental data were made public. According to our research, most detection solutions did not disclose their tunneling sample datasets or the configure when using tunneling tools to generate traffic, making their proposed solutions almost impossible to reproduce. In addition, some detection solutions use DNS tunneling tools with obvious signature features. Using samples with signature features to train model-based detection solutions will lead to doubts about the generalization ability of the model, that is, it is impossible to know whether this type of model will perform well in the real world. Finally, suggestions for future work directions are provided.

Key words: DNS tunneling, covert communication, tunneling tool, tunneling communication detection, tunneling detection feature, tunneling tool evaluation