PACLASS: A Lightweight Classification Framework on DNS-Over-HTTPS
Quanbo Pan, Hanbing Yan, Zhipeng Qin, Bingzhi Qi · 2023
DNS-over-HTTPS is becoming the main protocol of DNS during the development of the Internet. The method of detecting hidden tunnels by using traditional DNS protocols is no longer adaptable. The existing methods of using machine learning have many problems, such as large amount of data and limited applicable data types. To solve the cost problem, we designed a lightweight encrypted DoH traffic classification framework called PACLASS. Different from other studies, PA-CLASS only uses the feature of packet size, does not need the time dimension of data, and supports data sampling and log data. As a result, it requires less computing and storage resources and applies to a wider range type of data. We verify the effectiveness of our framework with six machine learning methods, and evaluate the improvement of the performance of the framework through experiments, such as data sampling ratio, setting the minimum threshold of communication, pre-training model. PACLASS can use less data to train the model. When using the sampled training data, PACLASS can reduce the amount of training data by 69.7% and the F1-score can reach 98.51%.