https://threatlabs.juniper.net/signatures/search/#/list/app?page_number=1&page_size=20
Those Application Signature are put in group to ease the management of type of Application
App Signature (Ozyman DNS Tunneling)
Use IDP, AppID is relatively ineffective for this purpose.
These are your primary signatures;
DNS:TUNNEL:DNS2TCP
DNS:TUNNEL:I2P-DNS-QUERY
DNS:TUNNEL:IODINE
DNS:TUNNEL:NULL-RECORD
DNS:TUNNEL:OZYMANDNS
DNS:TUNNEL:SHORT-TTL