29 Aug 2017

DNS tunneling detection eliminates weak spots of firewalls

Rohde & Schwarz Cybersecurity, a specialist IT security company, has announced the launch of enhanced traffic analysis capabilities to detect DNS (Domain Name Server) tunneling.

The new functionality provided by the deep packet inspection (DPI) engine R&S PACE 2 can be utilized by IT security solutions to reliably detect malicious activity in network traffic in real time caused by DNS tunneling.

DNS is a core component of the Internet and of paramount importance to the operation of the World Wide Web. It provides the mapping service between a domain name and the corresponding IP, translating human-friendly domain names into IP addresses.

As DNS is a trusted protocol it is often overlooked for security as no one considers using the protocol for data transmission. The use of DNS, especially with port 53, for data theft is called DNS tunneling. In tunneling, cybercriminals use the DNS protocol as an established pathway to direct the exchange of information for malicious purposes. Several tools have been developed to bypass traditional IPS or firewall inspection and network security measures to reach the Internet.

With the enhanced DNS tunneling detection functionality of the DPI engine R&S PACE 2, Rohde & Schwarz Cybersecurity now provides a highly scalable OEM software solution for network protection products. When embedded in a firewall, IT security vendors are able to inspect the entire DNS query for deeper markers of either good or bad behavior. This way, malicious attacks that bypass common security policies via DNS tunneling can be identified and prevented.

According to the DNS Threat Survey 2017 by Efficient IP, 94 percent claim DNS security is critical for their business. This is not surprising as in the past year, 76 percent of organizations around the world have been subjected to a DNS attack and a third suffered data theft. In addition, DNS tunneling was one of the leading causes besides malware, DDoS and cache poisoning attacks. If not secured properly, DNS attacks could cost businesses over $2 Billion annually in data exfiltration, loss of business or application downtime, says EfficientIP.

The new DNS protocol classification feature not only adds further value to cybersecurity solutions but also improves their reliability and credibility that enterprises can rely on. Besides the ability to detect DNS tunneling, R&S PACE 2 also provides reliable detection of tunneling in the HTTP protocol.

The DPI software library R&S PACE 2 provides powerful and reliable detection and classification of thousands of applications and protocols by combining deep packet inspection and behavioral traffic analysis – regardless of whether the protocols use advanced obfuscation, port-hopping techniques or encryption. DPI is needed everywhere in the network where intelligent decisions need to be made based on the nature of IP traffic, whether it is wanted or unwanted traffic, good or malicious.

Most popular news in Telecoms & networks

ZTE passes acceptance test of China Mobile’s Hohhot SDN Project
Rohde & Schwarz Cybersecurity & Radisys announce partnership
China Mobile and ZTE sign strategic cooperation agreement
Microsemi enhances SyncServer S600 series
Nokia enabling smooth migration from Japan-specific VDSL to G.fast

All news in this channel | All news


Share this page


Want more like this? Register for our newsletter






What to consider when incorporating an intelligent touch screen display into your product Markku Rihonnen | 4D Systems
What to consider when incorporating an intelligent touch screen display into your product
Gone are the days of rotary switches, push buttons and seven segment displays. Incorporating touch screen displays into embedded designs is the trend, accelerated of course by consumer adoption of the smartphone.
Training
Online - Fundamentals of Modern RF and Wireless Communications Engineering
This on-line course enables you to quickly get up-to-speed & understand key concepts of modern radio frequency, RF & wireless communications systems

More training courses










Radio-Electronics.com is operated and owned by Adrio Communications Ltd and edited by Ian Poole. All information is © Adrio Communications Ltd and may not be copied except for individual personal use. This includes copying material in whatever form into website pages. While every effort is made to ensure the accuracy of the information on Radio-Electronics.com, no liability is accepted for any consequences of using it. This site uses cookies. By using this site, these terms including the use of cookies are accepted. More explanation can be found in our Privacy Policy