Enhancing DNS data exfiltration protection through SDN data plane programming
type: CreativeWork
description: Data exfiltration has been a lucrative goal for malicious actors for many years, leading to a cycle of detection and avoidance that has driven the evolution of data exfiltration attacks. According to a 2019 Radware report, protecting private data was the highest area of investment for cyber security. This should come as no surprise due to the impact that data breaches can have at a private and corporate level, with large-scale data breaches being reported annually [1]. The Domain Name System (DNS) protocol has been a popular choice for malicious communication channels for many years; the vulnerability was first publicly discussed in 1998. Now, many years on, this vulnerability remains and exploits against it have grown more sophisticated and varied. The essential nature of the DNS protocol for Internet communication makes handling the threat difficult. Additionally, the movement to encrypt DNS renews old vulnerabilities that could be handled with proper traffic monitoring. In this thesis, the advantages of software-defined networking (SDN) and data plane programming are identified and leveraged to detect DNS-based data exfiltration attacks, including DNS-over-HTTPS. A DNS traffic analysis tool has been created for the SDN controller utilising its logically centralised network position. The controller application performs per-domain DNS and per-flow DoH traffic analysis for hosts throughout the network. To aid this analysis DNS-based data exfiltration attacks have been separated into 3 sub-categories: data exfiltration, protocol tunnelling, and command and control. To reduce the strain on the SDN controller, coarse-grained packet filtering is applied in the data plane to provide a rapid association for DNS packets into benign, malicious, and suspicious labels. This labelling informs the data plane on how to treat the traffic, either forwarding, dropping, or mirroring packets, as appropriate. The SDN controller application then populates a domain blacklist held at eit…
abstract: Data exfiltration has been a lucrative goal for malicious actors for many years, leading to a cycle of detection and avoidance that has driven the evolution of data exfiltration attacks. According to a 2019 Radware report, protecting private data was the highest area of investment for cyber security. This should come as no surprise due to the impact that data breaches can have at a private and corporate level, with large-scale data breaches being reported annually [1]. The Domain Name System (DNS) protocol has been a popular choice for malicious communication channels for many years; the vulnerability was first publicly discussed in 1998. Now, many years on, this vulnerability remains and exploits against it have grown more sophisticated and varied. The essential nature of the DNS protocol for Internet communication makes handling the threat difficult. Additionally, the movement to encrypt DNS renews old vulnerabilities that could be handled with proper traffic monitoring. In this thesis, the advantages of software-defined networking (SDN) and data plane programming are identified and leveraged to detect DNS-based data exfiltration attacks, including DNS-over-HTTPS. A DNS traffic analysis tool has been created for the SDN controller utilising its logically centralised network position. The controller application performs per-domain DNS and per-flow DoH traffic analysis for hosts throughout the network. To aid this analysis DNS-based data exfiltration attacks have been separated into 3 sub-categories: data exfiltration, protocol tunnelling, and command and control. To reduce the strain on the SDN controller, coarse-grained packet filtering is applied in the data plane to provide a rapid association for DNS packets into benign, malicious, and suspicious labels. This labelling informs the data plane on how to treat the traffic, either forwarding, dropping, or mirroring packets, as appropriate. The SDN controller application then populates a domain blacklist held at eit…
author: Steadman, Jacob
language: eng
keywords: SDN, network security, DNS, data exfiltration
date published: 2021-12
date modified: 2026-07-24T03:56:11Z
provider: Queen's University Belfast
publisher: Networked Digital Library of Theses and Dissertations
type: WebPage
source organization: Queen's University Belfast