# An Improved Approach to DNS Covert Channel Detection Based on DBM-ENSec
## 3 Methodology
### Data Processing Module  
The data processing module consists of four components, with the primary objective of establishing a DNS attack environment. It collects both DCC traffic, generated during the attack, and standard DNS traffic. These data types are subsequently integrated and processed for use in the experiment. The following section presents a visual representation of this process, as illustrated in Figure 2.  
Figure 1: Experimental framework diagram. Figure 2: Data processing module. (1) Deploying the Attack Environment: The attack environment comprises the target client, a local DNS server, the \".top\" root domain server, and a covert channel server. Nine DNS covert channel tools (iodine, dns2 tcp, cobalstrike, dnsexfiltrator, tcp-over-dns, dnsshell, dnscat, dnslivery, and ozymandns) [19] are deployed and executed on the local DNS server to generate DCC traffic. These tools facilitate the establishment of covert channels with the target and enable the exfiltration of sensitive data. This configuration allows for the generation of diverse covert channel traffic, thereby simulating a variety of attack methods that an adversary might employ in a real-world context. Furthermore, Wireshark4.2.3 software is installed on the target device to capture the traffic generated during the attack. (2) Capturing Mixed Traffic: This study successfully captured a total of 100,000 samples of nine types of DCC attack traffic in the aforementioned attack environments and categorized them into DCC traffic sets. These samples represent a wide range of attack methods, ensuring diversity in the data. In addition, a further 100,000 benign DNS flows were captured from daily network activity over the last seven days and filtered as benign for training purposes. The resulting traffic was combined to create a comprehensive, balanced dataset, as shown in Table 1.  
(3) Data Processing: This module firstly cleans and filters the captured mixed traffic set to finally extract the valid DNS traffic and then performs feature extraction on the cleansed DNS traffic to finally form the dataset used for training. In terms of feature extraction, the present study examined the characteristics of Domain Name System (DNS) traffic, thereby identifying eight main feature categories, namely string complexity, character structure, character combinations, vocabulary and labels, message length, resource record type, request-response pattern, and resource record content. The development of these features was undertaken to enhance the distinction between benign DNS traffic and DNS covert channel traffic. String Complexity Features:  
It is a well-established fact that standard DNS requests typically exhibit reasonable subdomain lengths. However, it has been observed that covert channels often utilize subdomains with excessively long or short lengths for the purpose of data encryption [20]. Information entropy, which serves as a quantitative measure of randomness and uncertainty within data strings, is a valuable metric in this context. In the realm of DCC, encoding techniques are frequently employed to obfuscate the transmitted data, resulting in increased randomness of letter combinations and higher entropy values for subdomains. Consequently, entropy can effectively differentiate between covert channel traffic and standard DNS traffic. Generally, normal subdomains consist of meaningful words, whereas encoded domain names are less likely to form coherent words. Therefore, the presence of \begin{table}
\begin{tabular}{c c} \hline \hline
**Sample Type** & **Sample Size** \\ \hline Normal DNS traffic captured & 100,000 \\ cobalstrike & 12,000 \\ iodine & 12,000 \\ dnsshell & 12,000 \\ dnscat & 12,000 \\ dnsexfiltrator & 12,000 \\ dns2 tcp & 12,000 \\ tcp-over-dns & 12,000 \\ dnslivery & 12,000 \\ ozymandns & 4000 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Captured mixed traffic. excessively long words in a domain name may indicate benign DNS traffic.