Detail publikace

DNS over HTTPS Detection Using Standard Flow Telemetry

JEŘÁBEK, K. HYNEK, K. RYŠAVÝ, O. BURGETOVÁ, I.

Originální název

DNS over HTTPS Detection Using Standard Flow Telemetry

Typ

článek v časopise ve Web of Science, Jimp

Jazyk

angličtina

Originální abstrakt

The aim of DNS over HTTPS (DoH) is to enhance users’ privacy by encrypting DNS. However, it also enables adversaries to bypass security mechanisms that rely on inspecting unencrypted DNS. Therefore in some networks, it is crucial to detect and block DoH to maintain security. Unfortunately, DoH is particularly challenging to detect, because it is designed to blend into regular HTTPS traffic. So far, there have been numerous proposals for DoH detection; however, they rely on specialized flow monitoring software that can export complex features that cannot be often computed on the running sequence or suffer from low accuracy. These properties significantly limit their mass deployment into real-world environments. Therefore this study proposes a novel DoH detector that uses IP-based, machine learning, and active probing techniques to detect DoH effectively with standard flow monitoring software. The use of classical flow features also enables its deployment in any network infrastructure with flow-monitoring appliances such as intelligent switches, firewalls, or routers. The proposed approach was tested using lab-created and real-world ISP-based network data and achieved a high classification accuracy of 0.999 and an F1 score of 0.998 with no false positives.

Klíčová slova

DNS over HTTPS,DoH,Machine Learning,Detection,Classification,Network Monitoring,Network Flows

Autoři

JEŘÁBEK, K.; HYNEK, K.; RYŠAVÝ, O.; BURGETOVÁ, I.

Vydáno

31. 1. 2023

Nakladatel

IEEE

ISSN

2169-3536

Periodikum

IEEE Access

Ročník

2023

Číslo

11

Stát

Spojené státy americké

Strany od

50000

Strany do

50012

Strany počet

13

URL

https://ieeexplore.ieee.org/abstract/document/10123708

Plný text v Digitální knihovně

http://hdl.handle.net/11012/244289

BibTex

@article{BUT185138,
  author="Kamil {Jeřábek} and Karel {Hynek} and Ondřej {Ryšavý} and Ivana {Burgetová}",
  title="DNS over HTTPS Detection Using Standard Flow Telemetry",
  journal="IEEE Access",
  year="2023",
  volume="2023",
  number="11",
  pages="50000--50012",
  doi="10.1109/ACCESS.2023.3275744",
  issn="2169-3536",
  url="https://ieeexplore.ieee.org/abstract/document/10123708"
}