DNS over HTTPS Detection Using Standard Flow Telemetry

Simple item page
dc.contributor.authorJeřábek, Kamilcs
dc.contributor.authorHynek, Karelcs
dc.contributor.authorRyšavý, Ondřejcs
dc.contributor.authorBurgetová, Ivanacs
dc.coverage.issue11cs
dc.coverage.volume2023cs
dc.date.issued2023-01-31cs
dc.description.abstractThe aim of DNS over HTTPS (DoH) is to enhance users’ privacy by encrypting DNS. However, it also enables adversaries to bypass security mechanisms that rely on inspecting unencrypted DNS. Therefore in some networks, it is crucial to detect and block DoH to maintain security. Unfortunately, DoH is particularly challenging to detect, because it is designed to blend into regular HTTPS traffic. So far, there have been numerous proposals for DoH detection; however, they rely on specialized flow monitoring software that can export complex features that cannot be often computed on the running sequence or suffer from low accuracy. These properties significantly limit their mass deployment into real-world environments. Therefore this study proposes a novel DoH detector that uses IP-based, machine learning, and active probing techniques to detect DoH effectively with standard flow monitoring software. The use of classical flow features also enables its deployment in any network infrastructure with flow-monitoring appliances such as intelligent switches, firewalls, or routers. The proposed approach was tested using lab-created and real-world ISP-based network data and achieved a high classification accuracy of 0.999 and an F1 score of 0.998 with no false positives.en
dc.formattextcs
dc.format.extent50000-50012cs
dc.format.mimetypeapplication/pdfcs
dc.identifier.citationIEEE Access. 2023, vol. 2023, issue 11, p. 50000-50012.en
dc.identifier.doi10.1109/ACCESS.2023.3275744cs
dc.identifier.issn2169-3536cs
dc.identifier.orcid0000-0002-5317-9222cs
dc.identifier.orcid0000-0001-9652-6418cs
dc.identifier.orcid0000-0002-9947-9837cs
dc.identifier.other185138cs
dc.identifier.researcheridJFA-4159-2023cs
dc.identifier.researcheridC-3823-2009cs
dc.identifier.researcheridAAL-5652-2020cs
dc.identifier.scopus57208510810cs
dc.identifier.scopus9639380300cs
dc.identifier.scopus34977560700cs
dc.identifier.urihttp://hdl.handle.net/11012/244289
dc.language.isoencs
dc.publisherIEEEcs
dc.relation.ispartofIEEE Accesscs
dc.relation.urihttps://ieeexplore.ieee.org/abstract/document/10123708cs
dc.rightsCreative Commons Attribution 4.0 Internationalcs
dc.rights.accessopenAccesscs
dc.rights.sherpahttp://www.sherpa.ac.uk/romeo/issn/2169-3536/cs
dc.rights.urihttp://creativecommons.org/licenses/by/4.0/cs
dc.subjectDNS over HTTPSen
dc.subjectDoHen
dc.subjectMachine Learningen
dc.subjectDetectionen
dc.subjectClassificationen
dc.subjectNetwork Monitoringen
dc.subjectNetwork Flowsen
dc.titleDNS over HTTPS Detection Using Standard Flow Telemetryen
dc.title.alternativeDetekce DoH pomocí monitorování síťových tokůcs
dc.type.driverarticleen
dc.type.statusPeer-revieweden
dc.type.versionpublishedVersionen
sync.item.dbidVAV-185138en
sync.item.dbtypeVAVen
sync.item.insts2024.07.02 11:46:03en
sync.item.modts2024.07.02 11:13:48en
thesis.grantorVysoké učení technické v Brně. Fakulta informačních technologií. Ústav informačních systémůcs
Files
Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
DNS_Over_HTTPS_Detection_Using_Standard_Flow_Telemetry.pdf
Size:
1.17 MB
Format:
Adobe Portable Document Format
Description:
file DNS_Over_HTTPS_Detection_Using_Standard_Flow_Telemetry.pdf
Download
Collections
Ústav informačních systémů