Volume 7 • Issue 2 • PP: 43–47 • 2024
Securing DNS over HTTPS: A Machine Learning Study on Traffic Classification Using DoHBrw-2020
Open Access & Copyright
© 2024 The Author(s). Published by ASPG. This article is licensed under the Creative Commons Attribution 4.0 International License (CC BY 4.0).
View PDF Abstract
This study investigates machine-learning approaches for classifying secure DNS traffic and identifying threats associated with DNS over HTTPS (DoH). Using the DoHBrw-2020 dataset, we compare Decision Tree, Support Vector Machine (SVM), K-Nearest Neighbors (KNN), Naive Bayes, a multilayer perceptron (MLP), Gradient Boosting, and SVM with an RBF kernel. Models are evaluated using accuracy, sensitivity, specificity, positive predictive value, negative predictive value, and F-score. The Decision Tree achieves the highest accuracy (99.65%) and strong results across the evaluation criteria. These findings demonstrate the potential of machine learning to improve DNS traffic security and support the development of real-time DoH threat detection. The results also inform the design of safer DNS solutions for contemporary information-security environments.
Keywords
References
[1] M. Lyu, H. H. Gharakheili, and V. Sivaraman, “A survey on DNS encryption: Current development, malware misuse, and inference techniques,” ACM Computing Surveys, vol. 55, no. 8, pp. 1–28, 2022.
[2] K. Jeˇrábek, K. Hynek, T. ˇCejka, and O. Ryšavý, “Col-lection of datasets with DNS over HTTPS traffic,” Data in Brief, vol. 42, p. 108310, 2022.
[3] T. A. Nguyen and M. Park, “DoH tunneling detection system for enterprise network using deep learning tech-nique,” Applied Sciences, vol. 12, no. 5, p. 2416, 2022.
[4] M. Zhan, Y. Li, G. Yu, B. Li, and W. Wang, “Detecting DNS over HTTPS based data exfiltration,” Computer Networks, vol. 209, p. 108919, 2022.
[5] S. Ding, D. Zhang, J. Ge, X. Yuan, and X. Du, “En-crypt dns traffic: Automated feature learning method for detecting dns tunnels,” in 2021 IEEE International Conference on Parallel and Distributed Processing with Applications, Big Data and Cloud Computing, Sustain-able Computing and Communications, Social Comput-ing and Networking, pp. 352–359, 2021.
[6] K. Hynek, D. Vekshin, J. Luxemburk, T. Cejka, and A. Wasicek, “Summary of dns over https abuse,” IEEE Access, vol. 10, pp. 54668–54680, 2022.
[7] T. Zebin, S. Rezvy, and Y. Luo, “An explainable AI-based intrusion detection system for dns over https (DoH) attacks,” IEEE Transactions on Information Forensics and Security, vol. 17, pp. 2339–2349, 2022.
[8] R. Mitsuhashi, A. Satoh, Y. Jin, K. Iida, T. Shinagawa, and Y. Takai, “Identifying malicious dns tunnel tools from doh traffic using hierarchical machine learning classification,” in Information Security (J. K. Liu, S. Kat-sikas, W. Meng, W. Susilo, and R. Intan, eds.), pp. 238–256, Springer International Publishing, 2021.
[9] M. MontazeriShatoori, L. Davidson, G. Kaur, and A. H. Lashkari, “Detection of doh tunnels using time-series classification of encrypted traffic,” in 2020 IEEE Inter-national Conference on Dependable, Autonomic and Secure Computing; International Conference on Perva-sive Intelligence and Computing; International Confer-ence on Cloud and Big Data Computing; International Conference on Cyber Science and Technology Congress, pp. 63–70, 2020.
[10] X. Li, Y. Song, and Y. Li, “DNS tunnel detection scheme based on machine learning in campus network,” in 2022 4th International Conference on Machine Learning, Big Data and Business Intelligence (MLBDBI), pp. 253–257, 2022.
[11] S. Roy, T. Shapira, and Y. Shavitt, “Fast and lean en-crypted internet traffic classification,” Computer Com-munications, vol. 186, pp. 166–173, 2022.
[12] G. D’Angelo, A. Castiglione, and F. Palmieri, “DNS tunnels detection via DNS-images,” Information Pro-cessing & Management, vol. 59, no. 3, p. 102930, 2022.
[13] S. K. Singh and P. K. Roy, “Detecting malicious dns over https traffic using machine learning,” in 2020 In-ternational Conference on Innovation and Intelligence for Informatics, Computing and Technologies (3ICT), pp. 1–6, 2020.
[14] Y. Wang, C. Shen, D. Hou, X. Xiong, and Y. Li, “FF-MR: A doh-encrypted dns covert channel detection method based on feature fusion,” Applied Sciences, vol. 12, no. 24, p. 12644, 2022.
Cite This Article
Choose your preferred format
Publisher's Note
The statements, opinions, and data presented in this article are solely those of the author(s) and do not necessarily represent those of ASPG, the journal, or its editors. ASPG and the editors disclaim responsibility for any harm arising from the use of any ideas, methods, instructions, or products described in this article, to the fullest extent permitted by applicable law.