securityboulevard.com
Effectively Detecting Low Throughput and Malicious DNS Exfiltration
In a previous blog post, we described how the DNS protocol, mainly designed for hostname to IP addresses resolution, can be abused for arbitrary data exchange. Based on throughput (i.e., bytes per hour), we distinguish between two classes of data...
Asaf Nadler