DNS and Data Exfiltration Detection

Abstract

Undetected data exfiltration is a common occurrence There is little research into detecting the data as it is traveling from target to attacker Most research is on the prevention of exploitation. Fundamental internet protocols are being used for exfiltration DNS is the internet address book, so almost all internet-connected devices accept it Most tunnels are encrypted to bypass packet inspection By understanding how these protocols work, IDS rules can be developed to alert when traffic is abnormal