Systems and methods for detecting covert DNS tunnels

A covert DNS tunnel detector comprising:

• a network scanner configured to:
• scan incoming network traffic received at a user equipment;
• and
• extract a first plurality of n-grams from the scanned incoming network traffic;
• a DNS request inspector configured to extract a second plurality of n-grams from a DNS request outgoing from the user equipment;
• a comparator configured to compare the first plurality of n-grams to the second plurality of n-grams;
• and
• a suspicious domain table configured to store at least a portion of a domain name associated with the outgoing DNS request when at least a portion of the second plurality of n-grams does not match the first plurality of n-grams.

A non-transitory computer readable medium storing computer executable instructions, which, when executed by a processor, cause the processor to carryout a method for detecting covert DNS tunnels, the computer readable medium comprising:

• scanning incoming network traffic received at a user equipment using a network scanner;
• extracting a first plurality of n-grams from the scanned incoming network traffic;
• extracting a second plurality of n-grams from a DNS request outgoing from the user equipment;
• comparing the first plurality of n-grams to the second plurality of n-grams;
• and
• adding at least a portion of a domain name associated with the outgoing DNS request to a table of a suspicious domain names when at least a portion of the second plurality of n-grams does not match the first plurality of n-grams.