# An Improved Approach to DNS Covert Channel Detection Based on DBM-ENSec
## 2 Related Work
### Detection Methods Based on Traffic Grouping  
In 2013, [PERSON] et al. [11] proposed a detection method based on DCC that first studied the characteristics of DCC, extracted 12 data grouping features, and used machine learning classifiers to distinguish the statistical properties of these features for identifying DCC. Although the model is capable of detecting new, untrained covert channels, its effectiveness may be limited, especially for more covert and complex channels. Consequently, expanding the feature set and optimizing the detection model became essential. In 2020, [PERSON] et al. [12] introduced a more advanced detection scheme, extracting 48 feature vectors from four aspects and constructing them as 8 \(\times\) 8 grayscale images, which were input into a modified convolutional neural network for detection. However, since most of the features used are traffic grouping features, this method may not support real-time detection in practical scenarios. In the same year, [PERSON] et al. [13] proposed a detection method based on anomaly metrics, analyzing DNS network data from a monitoring system by passively extracting data and using specific anomaly metrics to describe the problem. Due to the real-world data used, the dataset might be biased and may not include all types of DCC or attack variants. To improve the generalizability of detection, [PERSON] et al. [14] in 2021 proposed a new detection method using a stacked model that combines K-nearest neighbor, linear support vector machine, and random forest. This model extracts DNS packet features through deep detection and provides high accuracy in detecting DCC. Although the study mentions deployment in real networks, it does not provide a detailed analysis of the system's real-time performance, especially in high-traffic environments. In 2022, [PERSON] et al. [15] proposed an LSTM-based model combining request and response traffic characteristics. The model constructs a 13-dimensional feature vector to differentiate between DCC traffic and normal traffic by extracting timestamps, TTLs, and response packet lengths. To enhance the detection of encrypted traffic, [PERSON] et al. [16] introduced FF-MR, a DoH-based DCC detection method that employs feature fusion using multi-head attention and residual neural networks to combine session statistical features and multi-channel session byte sequence features. Key features are filtered using multi-head attention, and a multi-layer perceptron is used for detection. However, this method is mainly based on the CIRA-CIC-DoHBrw-2020 dataset, which may not cover all potential network conditions and attack scenarios, limiting the model's generalization across different datasets. In 2022, [PERSON] et al. [17] proposed a Tactics, Techniques, and Procedures (TTPs)-based approach to generate malicious traffic covering a wide sample space. They also proposed a sticky mechanism to convert certain decisions into dynamic human-computer interactions to validate suspicious hosts identified by the AI model. However, this mechanism requires user involvement, which could affect user experience, especially when rapid responses are required. In 2023, [PERSON] et al. [18] proposed an anomaly detection-based DNS data exfiltration detection algorithm that accurately identifies DCC and small-scale malware data exfiltration. However, detection accuracy may decrease when the transmission rate of malware drops below a certain threshold. The traffic grouping-based DCC detection method effectively analyzes the distinctions between DCC and normal traffic, thereby facilitating a more precise identification of covert channel traffic. However, this approach requires the aggregation of traffic data over a designated time period for grouping purposes, which raises the concern that the data may have already been compromised by the time any anomalous traffic is detected. This presents a significant challenge for the method.