1. A method for detecting covert DNS tunnels, the method comprising: scanning incoming network traffic received at a user equipment using a network scanner; extracting a first plurality of n-grams from the scanned incoming network traffic; extracting a second plurality of n-grams from a DNS request outgoing from the user equipment; comparing the first plurality of n-grams to the second plurality of n-grams; and adding at least a portion of a domain name associated with the outgoing DNS request to a table of a suspicious domain names when at least a portion of the second plurality of n-grams does not match the first plurality of n-grams.