dnstun

README

dnstun

dnstun - enable DNS tunneling detection in the service queries.

Description

With dnstun enabled, users are able to detect data exfiltration through DNS tunnels.

Syntax

dnstun {
    graph PATH
}

• graph is a directive to configure detector. It is a path to the .pb file with constant graph used to classify DNS traffic.

Examples

Here are the few basic examples of how to enable DNS tunnelling detection. Usually DNS tunneling detection is turned only for all DNS queries.

.  {
    dnstun {
        graph /var/dnstun/dnscnn.pb
    }
}

Documentation

Index

• type Dnstun
  • func NewDnstun(predictGraph *tf.Graph) *Dnstun
  • func (d *Dnstun) Name() string
  • func (d *Dnstun) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.Msg) (int, error)
• type Options
• type Tokenizer
  • func NewTokenizer(alphabet string, maxChars int) Tokenizer
  • func (t Tokenizer) Shape() []int64
  • func (t Tokenizer) TextToSeq(text string) []int64

Types

type Dnstun

type Dnstun struct {
	// contains filtered or unexported fields
}

Dnstun is a plugin to block DNS tunneling queries.

func NewDnstun

func NewDnstun(predictGraph *tf.Graph) *Dnstun

NewDnstun creates a new instance of the DNS tunneling detector plugin.

func (*Dnstun) Name

func (d *Dnstun) Name() string

func (*Dnstun) ServeDNS

func (d *Dnstun) ServeDNS(ctx context.Context, w dns.ResponseWriter, r *dns.Msg) (int, error)

type Options

type Options struct {
	Graph string
}

type Tokenizer

type Tokenizer struct {
	// contains filtered or unexported fields
}

func NewTokenizer

func NewTokenizer(alphabet string, maxChars int) Tokenizer

func (Tokenizer) Shape

func (t Tokenizer) Shape() []int64

func (Tokenizer) TextToSeq

func (t Tokenizer) TextToSeq(text string) []int64