A comparative performance evaluation of DNS tunneling tools

Authors:
Alessio Merlo;Gianluca Papaleo;Stefano Veneziano;Maurizio Aiello
Affiliations:
Dipartimento di Informatica, Sistemistica e Telematica, University of Genova, Genova, Italy and Istituto di Elettronica ed Ingeneria dell'Informazione e delle Telecomunicazioni, Genova, Italy;Istituto di Elettronica ed Ingeneria dell'Informazione e delle Telecomunicazioni, Genova, Italy;Istituto di Elettronica ed Ingeneria dell'Informazione e delle Telecomunicazioni, Genova, Italy;Istituto di Elettronica ed Ingeneria dell'Informazione e delle Telecomunicazioni, Genova, Italy
Venue:
CISIS'11 Proceedings of the 4th international conference on Computational intelligence in security for information systems
Year:
2011

Citing 5
Cited 0

Profiling internet backbone traffic: behavior models and applications

Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications
Inferring the source of encrypted HTTP connections

Proceedings of the 13th ACM conference on Computer and communications security
On Inferring Application Protocol Behaviors in Encrypted Network Traffic

The Journal of Machine Learning Research
How much anonymity does network latency leak?

Proceedings of the 14th ACM conference on Computer and communications security
Covert Channels and Countermeasures in Computer Network Protocols[Reprinted from IEEE Communications Surveys and Tutorials]

IEEE Communications Magazine

Quantified Score

Hi-index	0.02

Visualization

Abstract

DNS Tunnels are built through proper tools that allow embedding data on DNS queries and response. Each tool has its own approach to the building tunnels in DNS that differently affects the network performance. In this paper, we propose a brief architectural analysis of the current state-of-the-art of DNS Tunneling tools. Then, wepropose the first comparative analysis of such tools in term of performance, as a first step towardsthe possibility to relateeach tool with a proper behavior of DNS traffic. To this aim, we define an assessment of the toolsin three different network configurationswith three different performance metrics. We finallysummarize the most interesting results and provide some considerations on the performance of each tool.