DNS Tunneling: Threat Landscape and Improved Detection Solutions

Novruz Amirov, Baran Isik, Bilal Ihsan Tuncer, Serif Bahtiyar
7/14/2025
cs.CRcs.LGcs.NI

No confident code implementation found for this paper.

Abstract

Detecting Domain Name System (DNS) tunneling is a significant challenge in security due to its capacity to hide harmful actions within DNS traffic that appears to be normal and legitimate. Traditional detection methods are based on rule-based approaches or signature matching methods that are often insufficient to accurately identify such covert communication channels. This research is about effectively detecting DNS tunneling. We propose a novel approach to detect DNS tunneling with machine learning algorithms. We combine machine learning algorithms to analyze the traffic by using features extracted from DNS traffic. Analyses results show that the proposed approach is a good candidate to detect DNS tunneling accurately.

View on arXivView PDF

Code Implementations

No confident code match yet

We couldn't find an author-owned or strongly-evidenced community implementation for this paper. Any repos shown below are weak matches — verify before relying on them.

No code implementations found yet.

Know of an implementation? Let us know in the comments below!

Similar Papers

Augmenting Rule-based DNS Censorship Detection at Scale with Machine Learning

82% match1 repo42023

Command & Control (C2) Traffic Detection Via Algorithm Generated Domain (Dga) Classification Using Deep Learning And Natural Language Processing

81% match2025

Threat Detection in Social Media Networks Using Machine Learning Based Network Analysis

77% match2026

Open SESAME: Fighting Botnets with Seed Reconstructions of Domain Generation Algorithms

77% match2023

Feature Mining for Encrypted Malicious Traffic Detection with Deep Learning and Other Machine Learning Algorithms

77% match2023

DomURLs_BERT: Pre-trained BERT-based Model for Malicious Domains and URLs Detection and Classification

77% match1 repo252024

Cite this paper

@article{amirov2025tunneling,
  title  = {DNS Tunneling: Threat Landscape and Improved Detection Solutions},
  author = {Novruz Amirov and Baran Isik and Bilal Ihsan Tuncer and Serif Bahtiyar},
  year   = {2025},
  eprint = {2507.10267},
  archivePrefix = {arXiv},
  url    = {http://arxiv.org/abs/2507.10267v1}
}

Add a badge to your README

Shows whether official code is linked for this paper.

Code of Paper badge
[![Code of Paper](https://codeofpaper.com/badge/2507.10267.svg)](https://codeofpaper.com/paper/2507.10267)

Discussion