Loading...
DNS tunnelling, exfiltration and detection over cloud environments
Salat, Lehel Davis, Mastaneh Khan, Nabeel
Salat, Lehel
Davis, Mastaneh
Khan, Nabeel
Citations
Altmetric:
Advisors
Editors
Other Contributors
Affiliation
EPub Date
Publication Date
2023-03-02
Submitted Date
Collections
Files
Loading...
Manuscript.pdf
Adobe PDF, 4.07 MB
Other Titles
Abstract
The domain name system (DNS) protocol is fundamental to the operation of the internet, however, in recent years various methodologies have been developed that enable DNS attacks on organisations. In the last few years, the increased use of cloud services by organisations has created further security challenges as cyber criminals use numerous methodologies to exploit cloud services, configurations and the DNS protocol. In this paper, two different DNS tunnelling methods, Iodine and DNScat, have been conducted in the cloud environment (Google and AWS) and positive results of exfiltration have been achieved under different firewall configurations. Detection of malicious use of DNS protocol can be a challenge for organisations with limited cybersecurity support and expertise. In this study, various DNS tunnelling detection techniques were utilised in a cloud environment to create an effective monitoring system with a reliable detection rate, low implementation cost, and ease of use for organisations with limited detection capabilities. The Elastic stack (an open-source framework) was used to configure a DNS monitoring system and to analyse the collected DNS logs. Furthermore, payload and traffic analysis techniques were implemented to identify different tunnelling methods. This cloud-based monitoring system offers various detection techniques that can be used for monitoring DNS activities of any network especially accessible to small organisations. Moreover, the Elastic stack is open-source and it has no limitation with regards to the data that can be uploaded daily.
Citation
Salat, L., Davis, M., Khan, N. (2023). DNS tunnelling, exfiltration and detection over cloud environments. Sensors, 23(5), 2760. https://doi.org/10.3390/s23052760
Publisher
MDPI
Journal
Sensors
Research Unit
PubMed ID
PubMed Central ID
Type
Article
Language
Description
Series/Report no.
ISSN
No print ISSN
EISSN
1424-8220