dns tunneling detection techniques - classification , and theoretical comparison in case of a real apt campaign .
Detection of malicious payload distribution channels in DNS