Publication detail

Comparative Analysis of DNS over HTTPS Detectors

JEŘÁBEK, K. HYNEK, K. RYŠAVÝ, O.

Original Title

Comparative Analysis of DNS over HTTPS Detectors

Type

journal article in Web of Science

Language

English

Original Abstract

DNS over HTTPS (DoH) is a protocol that encrypts DNS traffic to improve user privacy and security. However, its use also poses challenges for network operators and security analysts who need to detect and monitor network traffic for security purposes. Therefore, there are multiple DoH detection proposals that leverage machine learning to identify DoH connections; however, these proposals were often tested on different datasets, and their evaluation methodologies were not consistent enough to allow direct performance comparison. In this study, seven DoH detection proposals were recreated and evaluated with six different experiments to answer research questions that targeted specific deployment scenarios concerning ML-model transferability, usability, and longevity. For thorough testing, a large Collection of DoH datasets along with a novel 5-week dataset was used, which enabled the evaluation of models’ longevity. This study provides insights into the current state of DoH detection techniques and evaluates the models in scenarios that have not been previously tested. Therefore, this paper goes beyond classical replication studies and shows previously unknown properties of seven published DoH detectors.

Keywords

DNS over HTTPS,DoH, detection,comparative analysis,machine learning,network security

Authors

JEŘÁBEK, K.; HYNEK, K.; RYŠAVÝ, O.

Released

20. 4. 2024

Publisher

Elsevier

ISBN

1872-7069

Periodical

Computer Networks

Year of study

247

Number

June

State

Kingdom of the Netherlands

Pages from

1

Pages to

13

Pages count

13

URL

https://doi.org/10.1016/j.comnet.2024.110452

Full text in the Digital Library

http://hdl.handle.net/11012/252835

BibTex

@article{BUT188647,
  author="Kamil {Jeřábek} and Karel {Hynek} and Ondřej {Ryšavý}",
  title="Comparative Analysis of DNS over HTTPS Detectors",
  journal="Computer Networks",
  year="2024",
  volume="247",
  number="June",
  pages="1--13",
  doi="10.1016/j.comnet.2024.110452",
  issn="1872-7069",
  url="https://doi.org/10.1016/j.comnet.2024.110452"
}