In order to improve the accuracy of the machine hidden learning channel in real time, and improve the detection ability of the machine learning model to deal with the unknown type of DNS covert channel, this paper proposed a DNS covert channel detection method based on the requested domain name. Taking the DNS covert channel as the research object, through research and analysis of the request domain name in the DNS legal sample and the covert channel sample,this paper utilized relevant information in the request domain name to build features, including domain name length, character proportion, randomness feature, and semantic feature composition, then used the machine learning algorithm to detect the DNS covert channel. This paper first evaluated the proposed method using data collected from the three most commonly used DNS covert channel tools Iodine, Dns2tcp and DNSCat and trained a decision tree classifier, covering computer network, information hiding, anomaly detection, data mining, natural language processing and other research areas. Evaluation results showsthat the model’s precision, recall, accuracyand ability to identify untrained DNS covert channels have been improved.
