DNS Tunnelling, Exfiltration and Detection over Cloud Environments.

Area of Science:

• Cybersecurity
• Network Protocols
• Cloud Computing Security

Background:

• The Domain Name System (DNS) is critical for internet operations but vulnerable to sophisticated attacks.
• Increased reliance on cloud services introduces new security challenges, including exploitation of DNS protocols.
• Cybercriminals increasingly leverage DNS for data exfiltration and command-and-control.

Purpose of the Study:

• To investigate the efficacy of DNS tunneling techniques (Iodine, DNScat) in cloud environments.
• To develop and evaluate a cost-effective DNS monitoring and detection system for organizations with limited cybersecurity resources.
• To enhance the detection capabilities against malicious DNS activities in cloud infrastructure.

Main Methods:

• Conducted DNS tunneling experiments using Iodine and DNScat in Google Cloud and AWS environments.
• Implemented various DNS tunneling detection techniques, including payload and traffic analysis.
• Utilized the Elastic stack, an open-source framework, for configuring the DNS monitoring system and analyzing DNS logs.

Main Results:

• Successfully achieved data exfiltration using DNS tunneling methods under diverse firewall configurations.
• Developed a cloud-based monitoring system with a reliable detection rate for malicious DNS activities.
• Demonstrated the effectiveness of the Elastic stack for real-time DNS log analysis and threat detection.

Conclusions:

• The proposed cloud-based monitoring system provides an accessible and effective solution for detecting DNS tunneling attacks.
• Organizations, particularly small ones with limited cybersecurity expertise, can benefit from this low-cost, open-source monitoring approach.
• Continuous monitoring and analysis of DNS traffic are crucial for identifying and mitigating emerging cyber threats in cloud environments.