When DNS Tunnels Learn to Hide: Seeing Through Evasive Covert Channels in Real Time

The DNS protocol, which is typically not blocked by firewalls, enables attackers to easily and efficiently establish tunnels and exfiltrate user information. Despite extensive research on DNS tunnel detection with promising results, a significant gap remains between experimental settings and real-world scenarios. This gap stems from the fact that existing methods predominantly depend on the quality of the training set, while attackers can adapt evasion techniques to create more covert and previously unknown tunnel types. To narrow this gap, we propose EvaSense, a real-time alert system for detecting DNS tunnels that employ diverse, potentially unseen evasion strategies. Our approach combines a behavior-based tunnel detection method with an agent-based online labeling method. We designed multiple DNS tunnels employing evasion strategies and conducted experiments on both real campus network traffic and public datasets. The experimental results demonstrate that EvaSense effectively detects these tunnels.