  DNS tunneling techniques are often used for malicious purposes but network
security mechanisms have struggled to detect these. Network forensic analysis
has thus been used but has proved slow and effort intensive as Network
Forensics Analysis Tools struggle to deal with undocumented or new network
tunneling techniques. In this paper we present a method to aid forensic
analysis through automating the inference of protocols tunneled within DNS
tunneling techniques. We analyze the internal packet structure of DNS tunneling
techniques and characterize the information entropy of different network
protocols and their DNS tunneled equivalents. From this, we present our
protocol prediction method that uses entropy distribution averaging. Finally we
apply our method on a dataset to measure its performance and show that it has a
prediction accuracy of 75%. Our method also preserves privacy as it does not
parse the actual tunneled content, rather it only calculates the information
entropy.
