# An Improved Approach to DNS Covert Channel Detection Based on DBM-ENSec
###### Abstract  
The covert nature of DNS covert channels makes them a widely utilized method for data exfiltration by malicious attackers. In response to this challenge, the present study proposes a detection methodology for DNS covert channels that employs a Deep Boltzmann Machine with Enhanced Security (DBM-ENSec). This approach entails the creation of a dataset through the collection of malicious traffic associated with various DNS covert channel attacks. Time-dependent grouping features are excluded, and feature optimization is conducted on individual traffic data through feature selection and normalization to minimize redundancy, enhancing the differentiation and stability of the features. The result of this process is the extraction of 23-dimensional features for each DNS packet. The extracted features are converted to gray scale images to improve the interpretability of the model and then fed into an improved Deep Boltzmann Machine for further optimization. The optimized features are then processed by an ensemble of classifiers (including Random Forest, XGBoost, LightGBM, and CatBoost) for detection purposes. Experimental results show that the proposed method achieves 99.92% accuracy in detecting DNS covert channels, with a validation accuracy of up to 98.52% on publicly available datasets. feature selection; integrated learning; DNS covert channel (DCC); network security; flow detection Article  
A  
13 June 202513 July 202513 July 202513 July 202513 July 202513 July 202513 June 202513 June 202513 June 202513 July  
reflection, or amplification attacks--which subsequently evolved into Distributed Denial of Service (DDoS) attacks (46%)--DNS channel attacks (35%), and cache poisoning (33%). Furthermore, the IDC 2023 Global DNS Threat Report [4] reveals that 90% of organizations encountered one or more DNS attacks in 2023, with 32% of these organizations also suffering a ransomware attack. The average cost associated with such an attack was estimated at $1.1 million, with organizations experiencing an average of 7.5 DNS attacks throughout the year. A comparative analysis of 2023 and 2022 indicates a 4% increase in DNS channel attacks, while DNS-based malware (including ransomware) rose by 5%, and attacks involving DNS domain hijacking or registrar credentials also increased by 5%. These rising trends highlight the critical importance of DCC protection for both businesses and individuals, as it plays a vital role in mitigating cyberattacks and safeguarding networks and data. The methodologies employed for the detection of DCC can be categorized into two primary groups: domain name-based detection methods and traffic grouping-based detection methods. Domain name-based approaches primarily focus on analyzing the characteristics of domain names within DNS queries, including factors such as domain name length, structural composition, and statistical attributes such as domain name entropy. However, the reliance on these fundamental features makes these methods susceptible to evasion techniques utilized by adversaries, potentially compromising their effectiveness. Traffic grouping-based detection methods have proven effective in comprehensively capturing and analyzing the characteristics of anomalous traffic, including transmission patterns, response times, packet sizes, and temporal sequences. This improved detection accuracy is particularly beneficial in the context of complex and evolving covert channel techniques. Nevertheless, because this approach relies on the collection and analysis of traffic data over an extended period, there is a risk that sensitive data may have already been exfiltrated by the time an abnormal condition is identified, potentially leading to irreversible losses. In order to address the limitations associated with traffic grouping-based detection methods and the singularity of existing datasets, the present study proposes the development of a comprehensive dataset that encompasses various DCC attacks.