Attention-based Mechanism for Anomaly Time Slice Detection in DNS Tunnel Communication

In recent years, there has been a growing number of network attacks using DNS tunneling technology. Traditional machine learning classification and clustering algorithms do not consider the temporal relationships between time slices, leading to the issue of false negatives and reduced overall recall in DNS tunnel detection. To address this problem, this paper proposes a DNS tunnel communication anomaly time slice detection method based on attention mechanisms. It introduces BiGRU and attention mechanism techniques for detecting abnormal time slices in this scenario. Experimental results demonstrate that the method proposed in this paper not only improves accuracy but also reduces the false negative rate. Compared to traditional UDP-based DNS communication scenarios, the false negative rate is reduced to 0.98%, accuracy is increased to 99.91%, with a false positive rate of 3.61%.