MFC-DoH: DoH Tunnel Detection Based on the Fusion of MAML and F-CNN
Xiaoyu Liu, Yijing Zhang, Xiaodu Yang, Weilin Gai, Bo Sun · 2024
Domain Name System (DNS) tunnels, used by attackers to transmit sensitive information through plaintext DNS protocols, have garnered significant attention. In addressing the security concerns of DNS, the Internet Engineering Task Force (IETF) introduced the DNS-over-HTTPS (DoH) protocol in 2018, aiming to encrypt DNS data transmission and effectively safeguard user privacy. However, attackers cleverly conceal DNS tunnels within HTTPS using the DoH protocol, rendering traditional detection methods ineffective and resulting in numerous areas being impacted by malicious events. Although there are studies on DoH tunnel detection, few are concerned with DoH tunnel detection in few-shot scenarios. This paper proposes a novel method called MFC-DoH, based on the combination of Model-Agnostic Meta-Learning (MAML) and the unique CNN network(F-CNN) with the introduction of the frequency domain layer and multi-head attention layer(MHSA). We evaluate our method on the public dataset. Experimental results exhibit that our method significantly outperforms the existing approach in detecting DoH tunnels in few-shot scenarios.