DNS over HTTPS Detection Using Standard Flow Telemetry

DNS over HTTPS,DoH,Machine Learning,Detection,Classification,Network Monitoring,Network Flows

DNS over HTTPS (DoH) is one of the encrypted DNS approaches that aim to improve users' privacy. However, it simultaneously enables users and adversaries to bypass the existing security mechanisms that rely strongly on inspecting unencrypted DNS. Compared to other DNS over Encryption protocols, DoH is designed to blend into regular HTTPS traffic, making its usage detection challenging. None of the existing proposals provide a satisfactory solution for reliable DoH detection in the real environment. In particular, relying on specialized flow monitoring software capable of extracting very complex features that cannot be computed on the running sequence in combination with Machine Learning methods produces unacceptable false positive rates. Therefore, in this work, we propose a novel DoH detector that combines IP-based, machine learning, and active probing approaches to detect DoH effectively. Contrary to previous proposals, our detector is designed to work with standard flow monitoring data making it deployable into any network infrastructure with flow monitoring appliances such as intelligent switches, firewalls, or routers.