Detection of DoH Tunneling using Semi-supervised Learning method
Anh Tuan Nguyen, Minho Park · 2022 International Conference on Information Networking (ICOIN) · 2022
DNS over HTTPS (DoH) is an upgrade of traditional DNS, enhancing privacy and security. DoH prevents man-in-the-middle attacks such as eavesdropping and manipulating DNS data by using the HTTPS protocol to encrypt the data between the DoH client and the DoH-based DNS resolver. However, DoH may cause unintended security vulnerability, information leakage via malicious DoH tunneling. Since the DoH traffic is not recognizable from other HTTPS traffic, secret encrypted DoH messages can be easily leaked out of an enterprise network. Although some countermeasures have been proposed, they still have limitations. To solve this problem, we propose a Semi-supervised machine learning classifier to detect malicious DoH tunneling. The experiment results show a significant improvement compared to the other previous works.