An Intelligent Feature Engineering‐Driven Hybrid Framework for Adversarial Domain Name System Tunneling Detection

Domain Name System (DNS) tunneling is a critical issue for internet security, as it misuses the primary DNS function, which was designed for hostname resolution. Conventional traffic‐analysis methods do not provide adequate means to detect or prevent such complex attacks, especially when attackers employ camouflaged strategies that obscure the origin of malicious traffic. In this study, we present a novel framework that enhances the reliability of DNS traffic monitoring using a hybrid long short‐term memory‐deep neural network (LSMT‐DNN) architecture, enabling robust detection of adversarial DNS tunneling. The proposed framework leverages feature extraction from DNS traffic patterns, including domain request sequences, query types, and timing characteristics, to identify subtle indicators of compromise. By examining differences between normal and malicious DNS traffic, as well as adversarially modified DNS requests, the model provides precise classification. Experimental results confirm that the developed LSTM‐DNN model, integrated with Gradient Boosting (GB), can accurately identify DNS tunneling attacks, achieving overall accuracies of 92% and 84.95% for binary and multiclass classification, respectively. To address evolving attack behaviors, we incorporate a continual learning approach through periodic model fine‐tuning, which improves adaptability to newly observed DNS traffic patterns and yields consistent performance gains.