Physics-Informed Diffusion Policy Transformer Model for DNS Tunnel Traffic Discovery

Abstract

This study develops a physics-informed Diffusion Policy Transformer for DNS tunnel traffic discovery in encrypted, mixed, and low-rate network scenarios. The method addresses the difficulty of identifying covert DNS behavior when single query records contain only weak evidence. Query length, label entropy, answer code, time interval, packet direction, host-domain persistence, resolver path, TTL variation, NXDOMAIN ratio, and domain-structure characteristics are encoded as protocol-physical descriptors. In this context, physical information refers to DNS protocol legality and operational traffic constraints rather than mechanical laws. A Transformer encoder learns long-range host-domain session dependencies, and a conditional diffusion module iteratively denoises the latent tunnel-risk state before adaptive threshold calibration produces analyst-facing warning grades. Experiments are conducted on a simulated enterprise DNS monitoring dataset containing 210,000 DNS query records, 31,600 host-domain sessions, and 36 protocol-physical characteristics. Compared with rule filtering, random forest, BiLSTM, Transformer, and non-physical diffusion baselines, the proposed model raises tunnel F1 from 0.884 to 0.932, improves low-rate tunnel recall from 81.6% to 90.7%, and reduces false alarms by 23.4%. Ablation results indicate that protocol-constraint encoding and diffusion calibration are the main sources of robustness. The study remains limited by its simulated data and should be validated with privacy-preserving enterprise DNS logs, multi-resolver deployments, and adversarial tunnel tools.