# An Improved Approach to DNS Covert Channel Detection Based on DBM-ENSec
###### Abstract
This dataset has been constructed by employing different DCC tools to execute attacks on a target machine, followed by the collection of the resulting malicious traffic. This methodology aims to mitigate the inadequacies of current datasets in accurately reflecting contemporary attack strategies, thereby enhancing the precision and applicability of the detection model. The subsequent phase involves the optimization of the traffic feature extraction method. This is accomplished by eliminating time-dependent traffic grouping behavioral features and instead concentrating on the extraction of packet features from individual DNS packets. This refinement simplifies the data processing pipeline and improves the model's detection efficiency, thereby facilitating the prevention of data exfiltration prior to the detection of an attack. Finally, the paper presents a covert channel detection model based on a Deep Boltzmann Machine with an integrated classifier (DBM-ENSec), which significantly enhances DCC detection. This is achieved by combining a Deep Boltzmann Machine with various integrated classifiers. Specifically, 23 DNS traffic features were extracted and converted into 5 \(\times\) 5 grayscale images, which were subsequently fed into a modified Deep Boltzmann Machine for feature optimization. The optimized features are then forwarded to an integrated classifier comprising XGBoost, Random Forest, LightGBM, and CatBoost for detection purposes. This model leverages deep learning techniques for feature optimization and improves detection accuracy through the utilization of an integrated classifier. In summary, the main contributions of this paper are as follows:  
(1) Dataset Construction: A new dataset is constructed by capturing multiple DCC traffic instances and covering a variety of DCC attacks. (2) Feature Optimization: Time-dependent grouping features are excluded, and individual traffic features are optimized. Specifically, 23-dimensional features from a single DNS traffic message are extracted, significantly improving the accuracy and effectiveness of the features, thus providing more reliable inputs for the detection algorithm. (3) DBM-ENSec Model: This paper proposes the DBM-ENSec detection model, which employs an improved Deep Boltzmann Machine for feature optimization and extraction. This approach aims to obtain high-dimensional features with stronger discriminative properties, enhancing feature representation capabilities. By integrating classifiers (XGBoost, Random Forest, LightGBM, and CatBoost), the generalization ability and accuracy of the detection model are effectively improved. The model not only enhances the detection rate of covert channel attacks but also offers new insights and methods for future research in this field. This paper is organized as follows: Section 2 reviews the current research on DCC detection. Section 3 presents a detailed discussion of the DCC detection method based on DBM-ENSec, including a comprehensive explanation of the composition and interrelationships of each module. Section 4 describes the experimental setup and presents the results of the experimental evaluation. Finally, Section 5 summarizes the conclusions and discusses the limitations of the current research, as well as future work.