DNS and Data Exfiltration Detection

Abstract

Undetected data exfiltration is a common occurrence<br> There is little research into detecting the data as it is traveling from target to attacker <br> Most research is on the prevention of exploitation. <br> Fundamental internet protocols are being used for exfiltration<br> DNS is the internet address book, so almost all internet-connected devices accept it <br> Most tunnels are encrypted to bypass packet inspection <br> By understanding how these protocols work, IDS rules can be developed to alert when traffic is abnormal