CLR: A Classification of DNS Tunnel Based on Logistic Regression In order to detect DNS tunnel conveniently and effectively, and to classify different DNS tunneling tools, in this paper we conceive a method that does not require manual extraction of features, but converts packet bytes into highlatitude vectors by ASCII and classifies mainstream DNS tunneling tools through a wide range of machine learning algorithms. This method is named CLR which is The experimental results show that our method not only has excellent performance of classification of DNS tunnel, but also is superior to the proposed approach in terms of accuracy, recall rate, training time and testing time, and these values are 0.9999, 0.9999, 27.3 sec, 1 sec respectively.

IDNS: A HighPerformance Model for Identification of DNS Infrastructures on Largescale Traffic Domain Name System (DNS) is indispensable in a large number of network applications. Identifying DNS infrastructures into different roles hierarchically is highly desired for a variety of purposes such as network management and threat evaluation. However, traditional measurements almost all depend on active scanning without considering dynamic packetlevel features of different DNS infrastructures.In this paper, we propose a highperformance model IDNS (Identifying DNS) based on passive measurement. IDNS: (i) extracts singlepacket field features (SFF) and multipacket statistical features (MSF) from DNS traffic, (ii) utilizes an estimation algorithm to calculate MSF for satisfying online processing speed, and (iii) applies several classifiers in Ensemble Learning and Incremental Learning. We perform an extensive evaluation based on a large volume of DNS queries and responses collected from one ISP. The evaluation results demonstrate that the best classifier in Ensemble Learning can reach 90% accuracy rate while the classifier in Incremental Learning can reach 80% with the highest scalability.