Novel AI Techniques for DNS Tunnel Security

This report describes Infoblox’s machine-learning DNS tunneling detection system that combines a CNN autoencoder-derived reconstruction-loss feature with statistical and word-segmentation features, feeding a Random Forest classifier to achieve very high detection performance (query-level F1 ~99.7% and strong domain-level precision/recall). It details dataset collection (millions of benign prefixes and hundreds of thousands of tunneling queries), feature engineering, ablation results showing the impact of novel features, and real-time production deployment with secondary validation to reduce false positives.