DNS Tunneling Detection Method Based on Multilabel Support Vector Machine
| Autor: | Ahmed Almusawi, Haleh Amintoosi |
|---|---|
| Jazyk: | angličtina |
| Rok vydání: | 2018 |
| Předmět: |
Article Subject
Computer Networks and Communications Computer science 020206 networking & telecommunications 02 engineering and technology computer.software_genre Classified information Support vector machine Naive Bayes classifier Firewall (construction) Binary classification lcsh:Technology (General) 0202 electrical engineering electronic engineering information engineering Classification methods lcsh:T1-995 020201 artificial intelligence & image processing Data mining lcsh:Science (General) computer Quantum tunnelling Information Systems lcsh:Q1-390 |
| Zdroj: | Security and Communication Networks, Vol 2018 (2018) |
| ISSN: | 1939-0114 |
| DOI: | 10.1155/2018/6137098 |
| Popis: | DNS tunneling is a method used by malicious users who intend to bypass the firewall to send or receive commands and data. This has a significant impact on revealing or releasing classified information. Several researchers have examined the use of machine learning in terms of detecting DNS tunneling. However, these studies have treated the problem of DNS tunneling as a binary classification where the class label is either legitimate or tunnel. In fact, there are different types of DNS tunneling such as FTP-DNS tunneling, HTTP-DNS tunneling, HTTPS-DNS tunneling, and POP3-DNS tunneling. Therefore, there is a vital demand to not only detect the DNS tunneling but rather classify such tunnel. This study aims to propose a multilabel support vector machine in order to detect and classify the DNS tunneling. The proposed method has been evaluated using a benchmark dataset that contains numerous DNS queries and is compared with a multilabel Bayesian classifier based on the number of corrected classified DNS tunneling instances. Experimental results demonstrate the efficacy of the proposed SVM classification method by obtaining an f-measure of 0.80. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|
Plný text