Improving the Identification of Real-world Malware's DNS Covert Channels Using Locality Sensitive Hashing
Fuente:
arXiv
Saved in:
| Main Authors: | , , , |
|---|---|
| Format: | Preprint |
| Published: |
2025
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866915637373173760 |
|---|---|
| author | Ruffing, Pascal Petrov, Denis Zillien, Sebastian Wendzel, Steffen |
| author_facet | Ruffing, Pascal Petrov, Denis Zillien, Sebastian Wendzel, Steffen |
| contents | Nowadays, malware increasingly uses DNS-based covert channels in order to evade detection and maintain stealthy communication with its command-and-control servers. While prior work has focused on detecting such activity, identifying specific malware families and their behaviors from captured network traffic remains challenging due to the variability of DNS. In this paper, we present the first application of Locality Sensitive Hashing to the detection and identification of real-world malware utilizing DNS covert channels. Our approach encodes DNS subdomain sequences into statistical similarity features that effectively capture anomalies indicative of malicious activity. Combined with a Random Forest classifier, our method achieves higher accuracy and reduced false positive rates than prior approaches, while demonstrating improved robustness and generalization to previously unseen or modified malware samples. We further demonstrate that our approach enables reliable classification of malware behavior (e.g., uploading or downloading of files), based solely on DNS subdomains. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2511_20229 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | Improving the Identification of Real-world Malware's DNS Covert Channels Using Locality Sensitive Hashing Ruffing, Pascal Petrov, Denis Zillien, Sebastian Wendzel, Steffen Cryptography and Security Networking and Internet Architecture Nowadays, malware increasingly uses DNS-based covert channels in order to evade detection and maintain stealthy communication with its command-and-control servers. While prior work has focused on detecting such activity, identifying specific malware families and their behaviors from captured network traffic remains challenging due to the variability of DNS. In this paper, we present the first application of Locality Sensitive Hashing to the detection and identification of real-world malware utilizing DNS covert channels. Our approach encodes DNS subdomain sequences into statistical similarity features that effectively capture anomalies indicative of malicious activity. Combined with a Random Forest classifier, our method achieves higher accuracy and reduced false positive rates than prior approaches, while demonstrating improved robustness and generalization to previously unseen or modified malware samples. We further demonstrate that our approach enables reliable classification of malware behavior (e.g., uploading or downloading of files), based solely on DNS subdomains. |
| title | Improving the Identification of Real-world Malware's DNS Covert Channels Using Locality Sensitive Hashing |
| topic | Cryptography and Security Networking and Internet Architecture |
| url | https://arxiv.org/abs/2511.20229 |