Data tunneling is a technique used to conceal malicious or unauthorized data by embedding it within legitimate protocols or system processes. Attackers commonly use tunneling to bypass security controls, evade detection, and exfiltrate data through allowed network channels such as HTTP, DNS, or HTTPS.
Instead of transmitting malicious data directly, which may be blocked or flagged, the attacker encapsulates it within normal-looking traffic. For example, command-and-control communications may be hidden inside DNS queries, or stolen data may be exfiltrated within HTTP requests. To security tools, this traffic appears legitimate unless deep inspection or behavioral analysis is applied.
Options A, B, and C describe standard networking or cryptographic operations, not tunneling. Decryption, packetization, and data reassembly are normal functions of communication systems and are not inherently malicious.
Cybersecurity operations documentation highlights data tunneling as a common technique used in advanced persistent threats (APTs) and covert exfiltration scenarios. Detecting tunneling often requires correlation, anomaly detection, and protocol analysis rather than signature-based detection alone.
Therefore, data tunneling refers to hiding malicious data within legitimate system processes, making Option D the correct answer.
