Rule-Based eXplainable Autoencoder for DNS Tunneling Detection

De Bernardi, Giacomo; Gaggero, Giovanni Battista; Patrone, Fabio; Zappatore, Sandro; Marchese, Mario; Mongelli, Maurizio

doi:10.3390/computers14090375

Open AccessArticle

Rule-Based eXplainable Autoencoder for DNS Tunneling Detection

by

Giacomo De Bernardi

¹,

Giovanni Battista Gaggero

^2,*

,

Fabio Patrone

²

,

Sandro Zappatore

²,

Mario Marchese

²

and

Maurizio Mongelli

¹

IEIIT Institute, Italian National Research Council (CNR), 16149 Genoa, Italy

²

Department of Electrical, Electronics and Telecommunications Engineering and Naval Architecture (DITEN), University of Genoa, 16145 Genoa, Italy

^*

Author to whom correspondence should be addressed.

Computers 2025, 14(9), 375; https://doi.org/10.3390/computers14090375

Submission received: 6 June 2025 / Revised: 18 August 2025 / Accepted: 4 September 2025 / Published: 8 September 2025

(This article belongs to the Special Issue Recent Advances in Data Mining: Methods, Trends, and Emerging Applications)

Download

Browse Figures

Versions Notes

Abstract

Artificial Intelligence (AI) and Machine Learning (ML) are employed in numerous fields and applications. Even if most of these approaches offer a very good performance, they are affected by the “black-box” problem. The way they operate and make decisions is complex and difficult for human users to interpret, making the systems impossible to manually adjust in case they make trivial (from a human viewpoint) errors. In this paper, we show how a “white-box” approach based on eXplainable AI (XAI) can be applied to the Domain Name System (DNS) tunneling detection problem, a cybersecurity problem already successfully addressed by “black-box” approaches, in order to make the detection explainable. The obtained results show that the proposed solution can achieve a performance comparable to the one offered by an autoencoder-based solution while offering a clear view of how the system makes its choices and the possibility of manual analysis and adjustments.

Keywords: DNS tunnelling; intrusion detection system; eXplainable AI; statistical traffic analysis

Share and Cite

MDPI and ACS Style

De Bernardi, G.; Gaggero, G.B.; Patrone, F.; Zappatore, S.; Marchese, M.; Mongelli, M. Rule-Based eXplainable Autoencoder for DNS Tunneling Detection. Computers 2025, 14, 375. https://doi.org/10.3390/computers14090375

AMA Style

De Bernardi G, Gaggero GB, Patrone F, Zappatore S, Marchese M, Mongelli M. Rule-Based eXplainable Autoencoder for DNS Tunneling Detection. Computers. 2025; 14(9):375. https://doi.org/10.3390/computers14090375

Chicago/Turabian Style

De Bernardi, Giacomo, Giovanni Battista Gaggero, Fabio Patrone, Sandro Zappatore, Mario Marchese, and Maurizio Mongelli. 2025. "Rule-Based eXplainable Autoencoder for DNS Tunneling Detection" Computers 14, no. 9: 375. https://doi.org/10.3390/computers14090375

APA Style

De Bernardi, G., Gaggero, G. B., Patrone, F., Zappatore, S., Marchese, M., & Mongelli, M. (2025). Rule-Based eXplainable Autoencoder for DNS Tunneling Detection. Computers, 14(9), 375. https://doi.org/10.3390/computers14090375

Note that from the first issue of 2016, this journal uses article numbers instead of page numbers. See further details here.

Article Menu

Rule-Based eXplainable Autoencoder for DNS Tunneling Detection

Abstract

Share and Cite

Article Metrics

Article Access Statistics

Further Information

Guidelines

MDPI Initiatives

Follow MDPI