Attempt at utilising SVM One Class to classify and detect signs of DNS tunnelling
- Clone the directory
- Enter the directory by typing in this command
cd dns-tunneling-detection
- Install prerequisite libraries with pip (if your OS does not have pip installed, try
sudo easy-install pip
pip install -r requirements.txt
There are two ways to run the program, one with labelled training data and one without.
Run the program with 3 parameters, the first two files to be used to train the model.
The first file will be your benign traffic packets, the second would be an example of dns tunneling.
The last file can be whatever you want to test the model against.
Command:
python main.py pcap/good.pcap pcap/bad.pcap pcap/population.pcap
Run the program with one parameter, the pcap file you want to test against.
Command:
python main.py pcap/population.pcap
In both cases, the program will write the flagged packets to a results.pcap file in the same directory.
Example:
