Thesis

Bachelor thesis

FTExfil: DNS Tunneling via Format Transforming Encryption and Huffman Coding

Bence Kanyok
Bachelor Project in Software Engineering
The Mærsk Mc-Kinney Møller Institute
University of Southern Denmark
June 2026

Supervisor: Professor Lars Ramkilde Knudsen

Read or download the thesis (PDF)

Research

The thesis investigates whether encrypted DNS tunnel payloads can be represented in a less uniform form while retaining useful transfer capacity. It develops a Rust proof of concept with regex-based Format Transforming Encryption and Huffman-based character frequency shaping, and compares both against a Base32 benchmark baseline.

The work includes background on DNS tunneling and detection, functional and non-functional requirements, the encoding and cryptographic design, application implementation, repeated transfer benchmarks, and an analysis of the remaining limitations.

Acknowledgement

The author thanks Professor Lars Ramkilde Knudsen for supervising the project and providing guidance.

Academic purpose

The research examines DNS tunneling to understand its operation, limitations, and security implications. The author does not condone unauthorized access, data exfiltration, or unlawful activity.

Large language models were used for AI-assisted development of the proof-of-concept application and suggestions for grammar corrections and paraphrasing during report writing.