README
¶
dnstun
dnstun - enable DNS tunneling detection in the service queries.
Description
With dnstun enabled, users are able to detect data exfiltration through DNS
tunnels.
Syntax
dnstun {
runtime HOST:PORT
detector forward|reverse DETECTOR:VERSION
}
-
runtimespecifies the endpoint inHOST:PORTformat to the remote model runtime. This runtime should comply with e.g.tensorcraftHTTP interface. -
detectoris a directive to configure detector. Optionforwardinstructs the plugin to treat higher probability in the second element of prediction tuple as DNS tunnel, whilereversetells that first element in the prediction tuple identifies DNS tunnel.
Examples
Here are the few basic examples of how to enable DNS tunnelling detection. Usually DNS tunneling detection is turned only for all DNS queries.
Analyze all DNS queries through remote resolver listening on TCP socket.
. {
dnstun {
# Connect to the runtime that stores model and executes it.
runtime 10.240.0.1:5678
# Choose detector and it's version.
detector reverse dns_cnn:latest
}
}
Documentation
¶
Index ¶
Constants ¶
const ( // MappingForward means that first element in the prediction tuple // is a probability of associating DNS query to the "good" domain // names. The second element is a probability of "bad" domain. MappingForward = "forward" // MappingReverse is reversed representation of probabilities in // the prediction tuple returned by the model. MappingReverse = "reverse" )
Variables ¶
var ( // DefaultTransport is a default configuration of the Transport. DefaultTransport http.RoundTripper = &http.Transport{ Proxy: http.ProxyFromEnvironment, DialContext: (&net.Dialer{ Timeout: 30 * time.Second, KeepAlive: 30 * time.Second, DualStack: true, }).DialContext, MaxIdleConns: 100, IdleConnTimeout: 90 * time.Second, TLSHandshakeTimeout: 10 * time.Second, ExpectContinueTimeout: 1 * time.Second, } // DefaultClient is a default instance of the HTTP client. DefaultClient = &http.Client{ Transport: DefaultTransport, } )
Functions ¶
This section is empty.
Types ¶
type Dnstun ¶
type Dnstun struct {
// contains filtered or unexported fields
}
Dnstun is a plugin to block DNS tunneling queries.
type PredictRequest ¶
type PredictRequest struct {
Instances [][]int `json:"instances"`
}
PredictRequest is a request to get predictions for the given attribute vectors.
type PredictResponse ¶
type PredictResponse struct {
Predictions [][]float64 `json:"predictions"`
}
PredictResponse lists probabilities for each attribute vector.
Source Files