DNS-Based Detection of Data Exfiltration in Corporate Networks

Abstract

The Domain Name System (DNS), a foundational component of internet communication, is
increasingly exploited as a covert channel for data exfiltration. Traditional firewalls and intrusion
detection systems often allow outbound DNS queries by default, making DNS an attractive medium for
bypassing perimeter defenses. This paper proposes a machine learning-based detection framework
focused on identifying DNS tunneling activity within corporate networks. We extract statistical and
structural features from DNS traffic—including domain name entropy, label length, query frequency,
and subdomain depth—and use them to train a Support Vector Machine (SVM) classifier. Experimental
evaluations include simulated tunneling scenarios using DNScat2 and Iodine, benchmarked against a
corporate-like DNS query baseline. Our model achieves a detection accuracy of 93.4% and maintains a
low false-positive rate, suitable for real-time anomaly detection. We validate the approach through
testbed deployment and evaluate integration with DNS Security Extensions (DNSSEC) and SIEM
platforms for alert correlation. The results demonstrate the viability of DNS as a monitored vector for
insider threat detection and data leak prevention in enterprise environments.