# An Improved Approach to DNS Covert Channel Detection Based on DBM-ENSec
## 3 Methodology
### Data Processing Module
The calculation of subdomain entropy is expressed as follows (Equation (1)):  
\[H(X)=-\sum_{i=1}^{n}P(x_{i})\log_{2}P(x_{i}), \tag{1}\]  
where \(H(X)\) denotes the entropy of the random variable \(X\), denotes the characters in the subdomain string, \(P(x)\) denotes the probability of occurrence of \(x\), and n denotes the number of possible character types in the subdomain string. Character-Building Features:  
Covert channels may employ unconventional character combinations to embed data [21]. For example, typical subdomains generally exhibit a low frequency of digits, while an increased frequency of digits may suggest data transmission. Furthermore, the structure of standard subdomains is characterized by a predominance of lowercase letters, whereas a higher occurrence of uppercase letters may indicate the presence of a covert channel. The presence of a significant percentage of consecutive consonants within a word is also indicative of a randomly generated character sequence. Moreover, frequent alternation between letters and numbers is a distinctive characteristic of covert channels, and such patterns can serve as reliable indicators of covert channel traffic. Character Combination Features:  
It is noteworthy that subdomains generated through covert channels may exhibit unusual character combinations that diverge from the patterns typically observed in standard traffic. The Jaccard index serves as a metric for quantifying the similarity between two sets. In normal subdomains, adjacent double characters generally adhere to specific linguistic patterns, whereas double-character combinations in covert channels tend to be more random. Additionally, the combination of three characters can also reflect the distribution pattern of characters, thereby aiding in the detection of anomalous behavior. This paper focuses exclusively on calculating the Jaccard index for a single domain name, and the simplified formula is presented as follows:  
\[Jaccard\ Index=\frac{|\mathrm{N}|}{\mathrm{L}}, \tag{2}\]  
where \(|\mathrm{N}|\) denotes the set of n-grams of the string and \(\mathrm{L}\) represents the length of the string. Lexical and tagging features:  
The examination of covert channels has demonstrated the creation of subdomains that consist of a significant quantity of nonsensical words or tags. The primary objective of these channels is to detect anomalies that diverge from typical traffic patterns. In contrast, conventional subdomains typically include one or more semantically meaningful words, whereas covert channels may comprise arbitrary or meaningless sequences of characters, leading to a reduced word count. Additionally, standard DNS requests are characterized by a reasonable number of labels (subdomain components); an excessive number of labels may suggest that data is being partitioned and transmitted through a covert channel. Message Length Features:  
The utilization of covert channels often results in the creation of DNS messages that diverge from standard lengths, either by being excessively long or short, in an effort to obscure data or evade detection. For example, standard DNS messages are constrained by specific load length limitations, whereas covert channels may utilize larger UDP payloads to enable the transmission of covert data. Resource Record Type Features:  
The existence of covert channels can facilitate the embedding of data within a resource record, leading to anomalies in both the size and entropy of the record. For example, the size of resource records in standard DNS responses is typically small; however, unusually large sizes may indicate the occurrence of data injection. Additionally, a high level of entropy in the content of the resource record implies a random distribution of characters, which may serve as an indicator of data injection. Furthermore, irregularities in the types of resource records (e.g., A, AAAA, CNAME) may also suggest the transfer of data.