informИнформатикаInformatics1816-03012617-6963UIIP NASB10.37661/1816-0301-2020-17-3-78-86inform-1057Research ArticleЗАЩИТА ИНФОРМАЦИИ И НАДЕЖНОСТЬ СИСТЕМINFORMATION PROTECTION AND SYSTEM RELIABILITYТекстовый анализ DNS запросов для защиты компьютерных сетей от эксфильтрации данныхText analysis of DNS queries for data exfiltration protection of computer networkshttps://orcid.org/0000-0003-0768-5746БубновЯ. В.BubnovYa. V.

Бубнов Яков Васильевич, магистр технических наук, аспирант кафедры электронных вычислительных машин, факультет компьютерных систем и сетей

Минск

Yakov V. Bubnov, M. Sci. (Eng.), Postgraduate Student of Department of Electronic Computing Machines, Faculty of Computer Systems and Networks

Minsk

girokompass@gmail.comИвановН. Н.IvanovN. N.

Иванов Николай Николаевич, кандидат физикоматематических наук, доцент кафедры электронных вычислительных машин, факультет компьютерных систем и сетей 

Минск

Nick N. Ivanov, Cand. Sci. (Phys.-Math.), Associate Professor of Department of Electronic Computing Machines, Faculty of Computer Systems and Networks

Minsk

invanovnn@gmail.comБелорусский государственный университет информатики и радиоэлектроники.Belarusian State University of Informatics and Radioelectronics2020110620201737886Copyright © Бубнов Я.В., Иванов Н.Н., 20202020Бубнов Я.В., Иванов Н.Н.Bubnov Y.V., Ivanov N.N.Данная работа распространяется под лицензией Creative Commons Attribution 4.0.This work is licensed under a Creative Commons Attribution 4.0 License.https://inf.grid.by/jour/article/view/1057

Предлагается эффективный способ защиты компьютерных сетей от эксфильтрации данных через систему доменных имен (англ. Domain Name System, DNS), которая представляет собой способ сокрытия передачи конфиденциальной информации удаленному злоумышленнику путем инкапсуляции данных в запрашиваемое доменное имя. Рассматриваются DNS-запросы, в которых передается украденная информация, c зараженного вредоносной программой узла на внешний узел, управляемый злоумышленником. Описывается подход для обнаружения подобных запросов с помощью текстовой классификации доменных имен сверточной нейронной сетью. Эффективность подхода базируется на предположении, что доменные имена, используемые для эксфильтрации данных, отличаются от доменных имен, сформированных из слов естественного языка. Для классификации запросов в сверточной нейронной сети предлагается использовать символьное встраивание с целью представления строки доменного имени. Производится оценка качества распознавания эксфильтрации данных через DNS с помощью ROC-анализа для обученной нейронной сети.

Демонстрируется архитектура программного обеспечения для развертывания обученной нейронной сети в существующую инфраструктуру DNS с целью практической защиты компьютерных сетей от эксфильтрации данных. Архитектура подразумевает формирование зон с политикой ответов для блокировки отдельных запросов, классифицируемых как вредоносные.

The paper proposes effective method of computer network protection from data exfiltration by the system of domain names. Data exfiltration by Domain Name System (DNS) is an approach to conceal the transfer of confidential data to remote adversary using data encapsulation into the requesting domain name. The DNS requests that transfer stolen information from a host infected by malicious software to an external host controlled by a malefactor are considered. The paper proposes a method of detecting such DNS requests based on text classification of domain names by convolutional neural network. The efficiency of the method is based on assumption that domain names exploited for data exfiltration differ from domain names formed from words of natural language. To classify the requests in convolutional neural network the use of character embedding for representing the string of a domain name is proposed. Quality evaluation of the trained neural network used for recognition of data exfiltration through domain name system using ROC-analysis is performed.

The paper presents the software architecture used for deployment of trained neural network into existing infrastructure of the domain name system targeting practical computer networks protection from data exfiltration. The architecture implies creation of response policy zones for blocking of individual requests, classified as malicious.

cистема доменных имензащита компьютерных сетейэксфильтрация данныхтекстовая классификациясверточная нейронная сетьdomain name systemcomputer network securitydata exfiltrationtext classificationconvolutional neural networkReferencesZhong, X. Stealthy malware traffic – not as innocent as it looks / X. Zhong, Y. Fu, R. Brooks // Malicious and Unwanted Software (MALWARE) : 10th Intern. Conf., Fajardo, 20–22 Oct. 2015. – Fajardo, 2015. – P. 110–116.Zhong, X. Stealthy malware traffic – Not as innocent as it looks / X. Zhong, Y. Fu, R. Brooks // Malicious and Unwanted Software (MALWARE) : 10th International Conference, Fajardo 20-22 Oct 2015 – Fajardo, 2015. – P. 110-116.On botnets that use DNS for command and control / C. Deitrich [et al.] // Computer Network Defense : 7th European Conf. on Computer Network Defense, Gotheburg, 6–7 Sept. 2011. – Gotheburg, 2011. – P. 9–16.Deitrich, C. On botnets that use DNS for command and control / C. Deitrich, C. Rossow, F. Freiling, H. Bos, M. Van Steen, N. Pohlman // Computer Network Defense : 7th European Conference on Computer Network Defense, Gotheburg 6-7 Sep 2011 – Gotheburg, 2011. – P. 9-16.Valenzuela, I. Game changer: identifying and defending against data exfiltration attempts [Electronic resource] // SANS Cyber Security Summit Archive. – 2015. – Mode of access: https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1493840468.pdf. – Date of access: 15.02.2020.Valenzuela, I. Game Changer: Identifying and Defending Against Data Exfiltration Attempts [Electronic resource] // SANS Cyber Security Summit Archive. – Mode of access: https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1493840468.pdf. – Date of access – 15.02.2020.Bubnov, Y. DNS tunneling queries for binary classification [Electronic resource] / Y. Bubnov // Mendeley Data. – N. Y., 2019. – Vol. 1. – Mode of access: https://data.mendeley.com/datasets/mzn9hvdcxg/1. – Date of access: 15.02.2020.New FrameworkPOS variant exfiltrates data via DNS requests [Electronic resource] // G Data Security Blog. – Mode of access: https://www.gdatasoftware.com/blog/2014/10/23942-new-frameworkpos-variant-exfiltrates-data-via-dns-requests. – Date of access: 15.02.2020.A bigram based real time DNS tunnel detection approach / C. Qi [et al.] // Procedia Computer Science. – 2013. – Vol. 17. – P. 852–860.Bubnov, Y. DNS Tunneling Queries for Binary Classification / Y. Bubnov // Mendeley Data. – New York, 2019 – Vol 1.Born, K. Detecting DNS tunneling using character frequency analysis / K. Born, D. Gustafson // Proc. of the 9th Annual Security Conf., Las Vegas, 7–8 Apr. 2010. – Las Vegas, 2010. – P. 2–3.Qi, C. A bigram based real time DNS tunnel detection approach / C. Qi, X. Chen, C. Xu, J. Shi, P. Liu // Procedia Computer Science, Elsevier B.V. – 2013. – Vol. 17, P. 852-860.Nadler, A. Detection of malicious and low throughput data exfiltration over the DNS protocol / A. Nadler, A. Aminov, A. Shabtai. – 2018. – Mode of access: https://arxiv.org/abs/1709.08395. – Date of access: 15.02.2020.Born, K. Detecting DNS Tunneling Using Character Frequency Analysis / K. Born, D. Gustafson // Proceedings of the 9th Annual Security Conference, Las Vegas 7-8 Apr 2010. – Las Vegas, 2010, - P. 2-3.Berg, A. Identifying DNS-tunneled Traffic with Predictive Models [Electronic resource] / A. Berg, D. Forsberg. – 2019. – Mode of access: https://arxiv.org/abs/1906.11246. – Date of access: 12.01.2020.Nadler, A. Detection of Malicious and Low Throughput Data Exfiltration Over the DNS Protocol / A. Nadler, A. Aminov, A. Shabtai // Ben-Gurion University, 2018. – P. 1-14.Лукацкий, А. Об утечках через DNS, которые не ловит ни одна DLP [Электронный ресурс] / А. Лукацкий // Бизнес без опасности. – 2018. – Режим доступа: https://www.securitylab.ru/blog/personal/Business_without_danger/343229.php. – Дата доступа: 07.05.2020.Berg, A. Identifying DNS-tunneled traffic with predictive models / A. Berg, D. Forsberg // Stockholm University. – Stockholm, 2019. – P. 1-14.Mockapetris, P. Domain names – implementation and specification [Electronic resource] / P. Mockapetris // Internet Standard, ISI. – 1987. – Mode of access: https://tools.ietf.org/html/rfc1035. – Date of access: 15.02.2020.Mockapetris, P. Domain names – implementation and specification / P. Mockapetris // Internet Standard, ISI. – 1987. – P. 12.Character-aware Neural Language Models [Electronic resource] / Y. Kim [et al.]. – 2016. – Mode of access: https://arxiv.org/abs/1508.06615. – Date of access: 12.01.2020.Kim, Y. Character-Aware Neural Language Models / Y. Kim, Y. Jernite, D. Sontag, A. Rush // Association for the Advancement of Artificial Intelligence. – New York, 2016. – 9 p.Watson, D. Utilizing Character and Word Embedding for Text Normalization with Sequence-to-Sequence Models [Electronic resource] / D. Watson, N. Zalmout, N. Habash. – 2019. – Mode of access: https://arxiv.org/ abs/1809.01534. – Date of access: 12.01.2020.Watson, D. Utilizing Character and Word Embedding for Text Normalization with Sequence-to-Sequence Models / D. Watson, N. Zalmout, N. Habash // Empirical Methods in Natural Language Processing, Hong Kong 3-7 Nov 2019 – Hong Kong, 2019. – 7 p.Gal, Y. A Theoretically Grounded Application of Dropout in Recurrent Neural Networks [Electronic resource] / Y. Gal, Z. Ghahraamni. – 2016. – Mode of access: https://arxiv.org/abs/1512.05287. – Date of access: 12.01.2020.Gal, Y. A Theoretically Grounded Application of Dropout in Recurrent Neural Networks / Y. Gal, Z. Ghahraamni // Neural Information Processing Systems, Barcelona 5-20 Dec 2016. – Barcelona, 2016 – 14 p.Self-normalizing Neural Networks [Electronic resource] / G. Klambauer [et al.] – 2017. – Mode of access: https://arxiv.org/abs/1706.02515. – Date of access: 12.01.2020.Klambauer, G. Self-Normalizing Neural Networks / G. Klambauer, T. Unterthiner, A. Mayr, S. Hochreiter // Advances in Neural Information Processing Systems, Long Beach 4-9 Dec 2017. – Long Beach, 2017. – 102 p.Kingma, D. Adam: a method for stochastic optimization / D. Kingma, J. Ba // 3rd Intern. Conf. for Learning Representations, San Diego, 7–9 May 2015. – San Diego, 2015. – 15 p.Kingma, D. Adam: A Method for Stochastic Optimization / D. Kingma, J. Ba // 3rd International Conference for Learning Representations, San Diego 7-9 May 2015. – San Diego, 2015. – 15 p.Nygren, E. The Akami network: a platform for high-performance internet applications / E. Nygren, Sitaraman, J. Sun // ACM SIGOPS Operating Systems Review. – 2010. – Vol. 44, iss. 3. – P. 2–19.Nygren, E. The Akami Network: A Platform for High-Performance Internet Applications / E. Nygren, R. Sitaraman, J. Sun // ACM SIGOPS Operating Systems Review – Amherst, 2010. – P. 2-19.

The authors declare that there are no conflicts of interest present.