# An Improved Approach to DNS Covert Channel Detection Based on DBM-ENSec
## 2 Related Work
### Detection Methods Based on Domain Name  
In 2019, [PERSON] et al. [5] applied a machine learning algorithm to identify DCCs by analyzing the requested domain names in both legitimate and covert channel DNS samples. They mined relevant information from the domain names and combined four types of attributes: domain name length, character occupancy, randomness features, and semantic features. However, relying solely on these four types of attributes makes the method vulnerable to circumvention by attackers. Therefore, a broader range of features is required to enhance detection capability. In 2020, [PERSON] et al. [6] proposed using DNS server logs as a data source to extract multidimensional statistical features, including entropy of second-level domains, the number of subdomains, and cache hit rates. The logs were then quantized into feature vectors, and the random forest algorithm was employed for model training, with ten-fold cross-validation used to adjust and optimize model parameters, thereby improving detection accuracy. Although the method introduces two additional features, cache hit and resource type, the detection still primarily relies on domain name features, which cannot cover all characteristics of DNS traffic. To address this issue, [PERSON] et al. [7] proposed a DCC detection method based on an LSTM model in 2021. This method does not depend on feature engineering but instead uses the fully qualified domain name (FQDN) in DNS packets as input, achieving good detection results. While this approach effectively detects domain name differences, it still fails to capture the complete traffic characteristics, leading to a high false alarm rate in practical applications. In 2023, [PERSON] [8] adopted a graph structure-based detection method to further improve detection accuracy. He introduced a DCC detection model based on graph attention networks (GAT), utilizing the semantic representation and inter-domain name relevance to detect covert channels. This method transforms the domain-level detection task into an undirected graph node classification problem. Despite the use of artificial intelligence methods to automatically extract features from domain names, as seen in [PERSON] et al.'s approach, the model remains susceptible to circumvention by attackers. In the same year, [PERSON] et al. [9] proposed a Transformer-based DCC detection method. This approach uses the Transformer architecture to capture global dependencies between inputs, significantly improving training speed and detection accuracy. However, the model's detection accuracy may still need refinement to handle more complex and advanced covert channels. To further enhance detection adaptability, [PERSON] et al. [10] in 2024 extended DCC detection by proposing a machine learning-based approach utilizing the LightGBM algorithm and selected features. Although this method achieves efficient detection, it primarily focuses on DNS request and response statistical features, which may not encompass a broader range of network behavior characteristics.  
The principal detection mechanism utilized by domain name-based methods relies on the examination of essential features of domain names. However, this approach fails to fully exploit the complex behavioral patterns and data characteristics inherent in DNS traffic. As a result, these methods can be easily evaded by attackers who manipulate, obscure, or simplify domain names, leading to a diminished effectiveness in detection.