High-bandwidth covert channels pose significant risks to sensitive and proprietary information inside company networks. Domain Name System (DNS) tunnels provide a means to covertly infiltrate and exfiltrate large amounts of information past network boundaries. This paper explores the possibility of detecting DNS tunnels by analyzing the unigram, bigram, and trigram character frequencies of domains in DNS queries and responses. It is empirically shown how domains follow Zipf's law in a similar pattern to natural languages, whereas tunneled traffic has discovered when tunneled traffic is compared to the character frequency fingerprint of legitimate domain traffic.

A tool called NgViz is developed that examines DNS traffic and shows anomalies in n-gram frequencies of domains found in query and response resource records. This is accomplished by comparing input files against a fingerprint of legitimate traffic. Both quantitative analysis and visual aids are provided that allow the user to make determinations about the legitimacy of the DNS traffic.

Borders, K. And Prakash, A (2004), "Web tap: detecting covert web traffic," In CCS'04: Proceedings of the 11th ACM conference on Computer and communications security, New York, NY. ACM Press, 110-120.

Crotti, M., Dusi, M., Gringoli, F., Salgarelli, L. (2007), “Detecting HTTP Tunnels with Statistical Mechanisms", IEEE International Conference on Communications (ICC) ‘07, 6162-6168.

Crotti, M., Dusi, M., Gringoli, F., Salgarelli, L. (2008), "Detection of Encrypted Tunnels across Network Boundaries," in Proceedings of the 43rd IEEE International Conference on Communications (ICC 2008), May 19-23, Beijing, China.

Dembour, O. (2008), 'Dns2tcp', http://www.hsc.fr/ressources/outils/dns2tcp/index.html.en. Nov 2008.

'Dnstop', http://dns.measurement-factory.com/tools/dnstop, 2009.

'Dsc', http://dns.measurement-factory.com/tools/dsc, 2009.

Dusi, M., Gringoli, F., Salgarelli, L. (2008), "A Preliminary Look at the Privacy of SSH Tunnels," in Proceedings of the 17th IEEE International Conference on Computer Communications and Networks (ICCN 2008), Aug. 2008. St. Thomas, U.S. Virgin Islands.

Hind, Jarod, (2009), Catching DNS Tunnels with A.I., Proceedings of DefCon 17, July 29-Aug 2. Las Vegas, Nevada. 'Iodine', http://code.kryo.se/iodine/. June 2009.

Orebaugh, Angela (2006), “An Instance Messaging Intrusion Detection System Framework: Using character frequency analysis for authorship identification and validation,” Proceedings 2006 40th Annual IEEE International, Oct, 160-172.

Plonka, D., and Barford, P. (2008), Context-aware clustering of dns query traffic, Proceedings of the 8th ACM SIGCOMM Internet Measurement Conference (IMC'08), Oct 20-22, Vouliagmeni, Greece.

Mockapetris, P. (1987), 'RFC1035 - Domain names - implementation and specification', http://www.faqs.org/rfcs/rfc1035.html, November 1987.

'Relative frequencies of letters', http://www.cryptograms.org/letterfrequencies.php, 2009.

Ren, P., Kristoff, J., Gooch, Bruce (2006), 'Visualizing DNS traffic'. Proceedings of the 3rd international workshop on Visualization for computer security, Oct 30-Nov 03, 2006, Alexandria, VA.

Shannon, Claude E. (1951), "Prediction and entropy of printed English," The Bell System Technical Journal, 30:50-64.

'TCP-over-DNS tunnel software HOWTO', http://analogbit.com/tcpover-dns_howto. July 2008.

'Top Sites', http://www.alexa.com/topsites, Nov 2009.

Zipf, G (1932), "Selective Studies and the Principle of Relative Frequency in Language," Cambridge, Ma

'Zipf's Law', http://www.nslij-genetics.org/wli/zipf, Aug 2009.