# An Improved Approach to DNS Covert Channel Detection Based on DBM-ENSec
## 5 Summary  
In summary, the present study simulates a covert channel attack utilizing the Domain Name System (DNS) on a target machine to facilitate data exfiltration. Concurrently, it \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Reference** & **Mold** & **Accuracy** & **Precision** & **Recall Rate** & **F1 Score** \\ \hline [PERSON], 2020 [12] & CNN & 97.83\% & 97.26\% & 97.54\% & 97.40\% \\ [PERSON], 2020 [13] & SVM & 98.46\% & 98.77\% & 98.32\% & 98.54\% \\ [PERSON], 2022 [16] & FF-MR & 98.99\% & 98.65\% & 98.77\% & 98.73\% \\ [PERSON], 2022 [17] & RF & 99.13\% & 98.99\% & 98.99\% & 98.99\% \\
**Our Work** & **DBM-ENSec** & **99.92\%** & **99.92\%** & **99.91\%** & **99.91\%** \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Comparison with traffic grouping-based detection methods. Figure 19: Validation using publicly available datasets. Model accuracy comparison between the proposed DBM-ENSec method and several existing approaches, including [PERSON], 2019 [5], [PERSON], 2021 [7], [PERSON], 2023 [8], [PERSON], 2024 [10], [PERSON], 2020 [12], [PERSON], 2020 [13], [PERSON], 2022 [16], and [PERSON], 2022 [17].The DBM-ENSec model achieved the highest accuracy of 98.52%, outperforming all the referenced methods. Note: Method names in the figure correspond to the references listed above. collects the malicious traffic generated during the attack to construct a comprehensive dataset. The traffic features are subsequently optimized by eliminating time-based traffic grouping features and extracting 23-dimensional DNS message features. This optimization aims to mitigate the risk of data leakage that may occur prior to the detection of the covert channel attack. A detection model, designated as DBM-ENSec, is proposed, which integrates an improved Deep Boltzmann Machine (DBM) with a composite classifier. The 23-dimensional DNS message features are transformed into a \(5\times 5\) grayscale image, which is then processed by the improved DBM for feature optimization. The optimized features are subsequently input into an ensemble classifier that includes XGBoost, Random Forest, LightGBM, and CatBoost for detection purposes. This methodology has demonstrated a reduction in the false alarm rate and an enhancement in the model's adaptability to novel covert channel attacks. The effectiveness of the DBM-ENSec model is substantiated by empirical evaluations, which indicate that the proposed detection method outperforms traditional machine learning and deep learning approaches across various key metrics. Notably, the model achieves an accuracy of 99.92% and 98.52%, as validated against public datasets. Future work will focus on validating the model using real-world DNS traffic, including enterprise threat-hunting datasets and passive DNS logs, to assess its robustness and generalizability beyond synthetic scenarios. Additionally, we will conduct performance profiling under practical network conditions, evaluating inference latency, resource usage, and throughput. This will support the development of lightweight DBM-ENSec variants suitable for edge or high-throughput deployments. As DNS over HTTPS (DoH) and DNS over TLS (DoT) become more prevalent, detecting covert channels in encrypted traffic presents new challenges. Future research will explore privacy-preserving feature extraction methods tailored to encrypted protocols, leveraging metadata, timing, and side-channel patterns for effective detection. Conceptualization, X.L. and X.W. ; methodology, X.L. ; validation, C.L., F.C. and R.G. ; data management, J.Z. and G.Y. ; writing--original draft preparation, X.L. ; writing--review and editing, X.L. and X.W. All authors have read and agreed to the published version of the manuscript.