DNS Tunneling Detection with Supervised Learning

This paper presents an advanced analytic capable of detecting general DNS tunneling behavior with high precision and recall. It explores the application of supervised machine learning to a recently introduced technique for analyzing DNS traffic: classifying primary domains instead of queries. This approach is enabled by a partially synthetic dataset generated with a structurally configurable DNS tunneling tool.