Copyright © 2026 Authors retain the copyright of this article. This article is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

@article{193482,
        author = {Rida Mansoor and Hrithik Anand and Maadhula R},
        title = {An Automated Framework for Detecting & Attribution of DNS-based Data Exfiltration AI-Based Detection of Credential Stuffing and Brute Force Attack},
        journal = {International Journal of Innovative Research in Technology},
        year = {2026},
        volume = {12},
        number = {10},
        pages = {1334-1338},
        issn = {2349-6002},
        url = {https://ijirt.org/article?manuscript=193482},
        abstract = {With the rapid expansion of digital environments and cloud interconnectivity, cybercriminals are increasingly exploiting subtle network channels and authentication mechanisms to steal sensitive data and compromise user credentials. DNS-based data exfiltration leverages the Domain Name System a ubiquitous and typically trusted protocol to covertly transmit stolen information outside a network. Simultaneously, credential stuffing and brute force attacks remain primary tools for attackers attempting to compromise accounts at scale using automated login attempts. Traditional security tools frequently struggle to detect these advanced threats due to encrypted traffic, evasion techniques, and high volumes of login attempts that resemble benign behavior. This article proposes a unified automated framework that integrates machine learning and behavioral analytics for detecting and attributing DNS-based exfiltration, alongside an AI-driven detection module targeting credential stuffing and brute force attacks. The framework applies real-time feature extraction, anomaly scoring, supervised and unsupervised learning models, and adaptive response strategies. Experimental evaluation shows high detection accuracy, low false positive rates, and robust performance across enterprise datasets. The system enhances threat visibility, attribution capability, and defensive automation, supporting network security operations, compliance requirements, and proactive incident response.},
        keywords = {DNS Exfiltration, Credential Stuffing, Brute Force Detection, Machine Learning.},
        month = {March},
        }