A Machine Learning-Based Approach for Detecting DNS Tunneling and Data Exfiltration in Network Traffic

Abstract

The Domain Name System (DNS) is a foundational protocol of the Internet, and its near-universal permission through firewalls makes it an attractive covert channel for attackers seeking to tunnel data or exfiltrate sensitive information. DNS tunneling techniques encode arbitrary data inside DNS queries and responses, allowing adversaries to bypass conventional perimeter defenses that focus on HTTP, HTTPS, and other well-monitored protocols. Signature-based intrusion detection systems struggle to keep pace with the diversity of tunneling tools and obfuscation strategies, motivating the application of machine learning (ML) to this problem. This paper presents a comprehensive machine learning-based framework for detecting DNS tunneling and data exfiltration activity in network traffic. We extract a rich set of statistical, lexical, and temporal features from DNS query streams and evaluate nine classification approaches, including Logistic Regression, Decision Tree, k-Nearest Neighbors, Naive Bayes, Support Vector Machine, Random Forest, XGBoost, Long Short-Term Memory (LSTM) networks, and a proposed hybrid Convolutional Neural Network-Random Forest (CNN-RF) ensemble. Experiments conducted on a labeled dataset of benign and tunneled DNS traffic show that the proposed hybrid model achieves 98.4% accuracy, 98.1% precision, 98.7% recall, and an F1-score of 98.4%, outperforming all baseline classifiers and prior published approaches. The results demonstrate that combining automatically learned representations with engineered statistical features substantially improves detection of low-and-slow exfiltration and previously unseen tunneling tools.