Abstract

Covert Data Exfiltration (CDE) is always a concern in modern networks as adversaries routinely embed malicious payload within seemingly benign traffic. This is even more complex in the cloud-based infrastructures, where the constant large volume of data that flows in and out provides a lot of protection for the hidden activity. In this study, supervised machine learning techniques are used to detect DNS-based exfiltration methods based on behavioural and structural characteristics of network traffic. The detection problem is outlined as a two-class classification problem and the experimental pipeline includes data cleaning, feature transformation, z-score normalisation, stratified partition creation, mitigating class imbalance, and comparing the performance of multiple models. Classifiers under consideration include Logistic Regression, Support Vector Machine (SVM), Random Forest, XGBoost and a new stacked ensemble. The classifiers are evaluated on six criteria: accuracy, precision, recall, F1-score, AUC and false alarm rate. According to the experimental results, all the tree-based models achieve close-to-same accuracy, and the stacked ensemble is not able to surpass a single Random Forest or XGBoost model. Two new features are added, label-entropy variance and consonant-cluster density, and an ablation demonstrates that they contribute little after the query length is added. It is found that the length of queries has the greatest influence on detection on this benchmark, and that accuracy decreases in cross-dataset scenarios as well as when a realistic entropy-suppression attack is applied.