FF-MR: A DoH-Encrypted DNS Covert Channel Detection Method Based on Feature Fusion
In this paper, in order to accurately detect Domain Name System (DNS) covert channels based on DNS over HTTPS (DoH) encryption and to solve the problems of weak single-feature differentiation and poor performance in the existing detection methods, we have designed a DoH-encrypted DNS covert channel...
| Main Authors: | , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2022-12-01
|
| Series: | Applied Sciences |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2076-3417/12/24/12644 |
| _version_ | 1827642046758780928 |
|---|---|
| author | Yongjie Wang Chuanxin Shen Dongdong Hou Xinli Xiong Yang Li |
| author_facet | Yongjie Wang Chuanxin Shen Dongdong Hou Xinli Xiong Yang Li |
| author_sort | Yongjie Wang |
| collection | DOAJ |
| description | In this paper, in order to accurately detect Domain Name System (DNS) covert channels based on DNS over HTTPS (DoH) encryption and to solve the problems of weak single-feature differentiation and poor performance in the existing detection methods, we have designed a DoH-encrypted DNS covert channel detection method based on features fusion, called FF-MR. FF-MR is based on a Multi-Head Attention and Residual Neural Network. It fuses session statistical features with multi-channel session byte sequence features. Some important features that play a key role in the detection task are screened out of the fused features through the calculation of the Multi-Head Attention mechanism. Finally, a Multi-Layer Perceptron (MLP) is used to detect encrypted DNS covert channels. By considering both global and focused features, the main idea of FF-MR is that the degree of correlation between each feature and all other features is expressed as an attention weight. Thus, features are re-represented as the result of the weighted fusion of all features using the Multi-Head Attention mechanism. Focusing on certain important features according to the distribution of attention weights improves the detection performance. While detecting the traffic in encrypted DNS covert channels, FF-MR can also accurately identify encrypted traffic generated by the three DNS covert channel tools. Experiments on the CIRA-CIC-DoHBrw-2020 dataset show that the macro-averaging recall and precision of the FF-MR method reach 99.73% and 99.72%, respectively, and the macro-averaging F1-Score reached 0.9978, which is up to 4.56% higher than the existing methods compared in the paper. FF-MR achieves at most an 11.32% improvement in macro-averaging F1-Score in identifying three encrypted DNS covert channels, indicating that FF-MR has a strong ability to detect and identify DoH-encrypted DNS covert channels. |
| first_indexed | 2024-03-09T17:23:07Z |
| format | Article |
| id | doaj.art-7faf1e9ae8e946e9912e03712c7309ed |
| institution | Directory Open Access Journal |
| issn | 2076-3417 |
| language | English |
| last_indexed | 2024-03-09T17:23:07Z |
| publishDate | 2022-12-01 |
| publisher | MDPI AG |
| record_format | Article |
| series | Applied Sciences |
| spelling | doaj.art-7faf1e9ae8e946e9912e03712c7309ed2023-11-24T13:02:16ZengMDPI AGApplied Sciences2076-34172022-12-0112241264410.3390/app122412644FF-MR: A DoH-Encrypted DNS Covert Channel Detection Method Based on Feature FusionYongjie Wang0Chuanxin Shen1Dongdong Hou2Xinli Xiong3Yang Li4College of Electronic Engineering, National University of Defense Technology, Hefei 230037, ChinaCollege of Electronic Engineering, National University of Defense Technology, Hefei 230037, ChinaCollege of Electronic Engineering, National University of Defense Technology, Hefei 230037, ChinaCollege of Electronic Engineering, National University of Defense Technology, Hefei 230037, ChinaCollege of Electronic Engineering, National University of Defense Technology, Hefei 230037, ChinaIn this paper, in order to accurately detect Domain Name System (DNS) covert channels based on DNS over HTTPS (DoH) encryption and to solve the problems of weak single-feature differentiation and poor performance in the existing detection methods, we have designed a DoH-encrypted DNS covert channel detection method based on features fusion, called FF-MR. FF-MR is based on a Multi-Head Attention and Residual Neural Network. It fuses session statistical features with multi-channel session byte sequence features. Some important features that play a key role in the detection task are screened out of the fused features through the calculation of the Multi-Head Attention mechanism. Finally, a Multi-Layer Perceptron (MLP) is used to detect encrypted DNS covert channels. By considering both global and focused features, the main idea of FF-MR is that the degree of correlation between each feature and all other features is expressed as an attention weight. Thus, features are re-represented as the result of the weighted fusion of all features using the Multi-Head Attention mechanism. Focusing on certain important features according to the distribution of attention weights improves the detection performance. While detecting the traffic in encrypted DNS covert channels, FF-MR can also accurately identify encrypted traffic generated by the three DNS covert channel tools. Experiments on the CIRA-CIC-DoHBrw-2020 dataset show that the macro-averaging recall and precision of the FF-MR method reach 99.73% and 99.72%, respectively, and the macro-averaging F1-Score reached 0.9978, which is up to 4.56% higher than the existing methods compared in the paper. FF-MR achieves at most an 11.32% improvement in macro-averaging F1-Score in identifying three encrypted DNS covert channels, indicating that FF-MR has a strong ability to detect and identify DoH-encrypted DNS covert channels.https://www.mdpi.com/2076-3417/12/24/12644DNS over HTTPSDNS covert channelfeatures fusionmulti-head attention mechanism |
| spellingShingle | Yongjie Wang Chuanxin Shen Dongdong Hou Xinli Xiong Yang Li FF-MR: A DoH-Encrypted DNS Covert Channel Detection Method Based on Feature Fusion Applied Sciences DNS over HTTPS DNS covert channel features fusion multi-head attention mechanism |
| title | FF-MR: A DoH-Encrypted DNS Covert Channel Detection Method Based on Feature Fusion |
| title_full | FF-MR: A DoH-Encrypted DNS Covert Channel Detection Method Based on Feature Fusion |
| title_fullStr | FF-MR: A DoH-Encrypted DNS Covert Channel Detection Method Based on Feature Fusion |
| title_full_unstemmed | FF-MR: A DoH-Encrypted DNS Covert Channel Detection Method Based on Feature Fusion |
| title_short | FF-MR: A DoH-Encrypted DNS Covert Channel Detection Method Based on Feature Fusion |
| title_sort | ff mr a doh encrypted dns covert channel detection method based on feature fusion |
| topic | DNS over HTTPS DNS covert channel features fusion multi-head attention mechanism |
| url | https://www.mdpi.com/2076-3417/12/24/12644 |
| work_keys_str_mv | AT yongjiewang ffmradohencrypteddnscovertchanneldetectionmethodbasedonfeaturefusion AT chuanxinshen ffmradohencrypteddnscovertchanneldetectionmethodbasedonfeaturefusion AT dongdonghou ffmradohencrypteddnscovertchanneldetectionmethodbasedonfeaturefusion AT xinlixiong ffmradohencrypteddnscovertchanneldetectionmethodbasedonfeaturefusion AT yangli ffmradohencrypteddnscovertchanneldetectionmethodbasedonfeaturefusion |