论文信息 - On the viability and performance of DNS tunneling

On the viability and performance of DNS tunneling

DNS tunnels are network covert channels that allow the transmission of arbitrary data using the DNS infrastructure. Users can use such tunnels to hide their communication sessions in order to bypass local security and accounting policies. Hence, it is important that we investigate the viability and performance of DNS tunneling. Our results show that clients can obtain up to 110 KB/s in throughput, and delays as low as 150ms. These results, however, incur very high overheads. In the worst case, clients generate up to 2000% more traffic!

[1] Steven J. Murdoch,et al. Embedding Covert Channels into TCP/IP , 2005, Information Hiding.

[2] A. Karimi,et al. Master‟s thesis , 2011 .

[3] Mike Fisk,et al. Eliminating Steganography in Internet Traffic with Active Wardens , 2002, Information Hiding.

[4] Richard E. Newman,et al. Capacity estimation and auditability of network covert channels , 1995, Proceedings 1995 IEEE Symposium on Security and Privacy.

[5] Anestis Karasaridis,et al. NIS04-2: Detection of DNS Anomalies using Flow Data Analysis , 2006, IEEE Globecom 2006.

[6] Virgil D. Gligor,et al. A guide to understanding covert channel analysis of trusted systems , 1993 .