An Improved Approach to DNS Covert Channel Detection Based on DBM-ENSec

Xinyu Li, Xiaoying Wang (), Guoqing Yang, Jinsha Zhang, Chunhui Li, Fangfang Cui and Ruize Gu
Additional contact information
Xinyu Li: School of Information Engineering, Institute of Disaster Prevention, Langfang 065201, China
Xiaoying Wang: School of Information Engineering, Institute of Disaster Prevention, Langfang 065201, China
Guoqing Yang: School of Information Engineering, Institute of Disaster Prevention, Langfang 065201, China
Jinsha Zhang: School of Information Engineering, Institute of Disaster Prevention, Langfang 065201, China
Chunhui Li: School of Information Engineering, Institute of Disaster Prevention, Langfang 065201, China
Fangfang Cui: School of Information Engineering, Institute of Disaster Prevention, Langfang 065201, China
Ruize Gu: School of Information Engineering, Institute of Disaster Prevention, Langfang 065201, China

Future Internet, 2025, vol. 17, issue 7, 1-30

Abstract: The covert nature of DNS covert channels makes them a widely utilized method for data exfiltration by malicious attackers. In response to this challenge, the present study proposes a detection methodology for DNS covert channels that employs a Deep Boltzmann Machine with Enhanced Security (DBM-ENSec). This approach entails the creation of a dataset through the collection of malicious traffic associated with various DNS covert channel attacks. Time-dependent grouping features are excluded, and feature optimization is conducted on individual traffic data through feature selection and normalization to minimize redundancy, enhancing the differentiation and stability of the features. The result of this process is the extraction of 23-dimensional features for each DNS packet. The extracted features are converted to gray scale images to improve the interpretability of the model and then fed into an improved Deep Boltzmann Machine for further optimization. The optimized features are then processed by an ensemble of classifiers (including Random Forest, XGBoost, LightGBM, and CatBoost) for detection purposes. Experimental results show that the proposed method achieves 99.92% accuracy in detecting DNS covert channels, with a validation accuracy of up to 98.52% on publicly available datasets.

Keywords: feature selection; integrated learning; DNS covert channel (DCC); network security; flow detection (search for similar items in EconPapers)
JEL-codes: O3 (search for similar items in EconPapers)
Date: 2025
References: Add references at CitEc
Citations:

Downloads: (external link)
https://www.mdpi.com/1999-5903/17/7/319/pdf (application/pdf)
https://www.mdpi.com/1999-5903/17/7/319/ (text/html)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:gam:jftint:v:17:y:2025:i:7:p:319-:d:1706672

Access Statistics for this article

Future Internet is currently edited by Ms. Grace You

More articles in Future Internet from MDPI
Bibliographic data for series maintained by MDPI Indexing Manager ().