Securing DNS over HTTPS traffic: a real-time analysis tool

Authors

Keywords:

Artificial intelligence, Cybersecurity, Deep learning, Domain Name System, Hypertext transfer protocol secure, Machine learning, Threats detection

Abstract

DNS over HTTPS (DoH) is a developing protocol that uses encryption to secure domain name system (DNS) queries within hypertext transfer protocol secure (HTTPS) connections, thereby improving privacy and security while browsing the web. This study involved the development of a live tool that captures and analyzes DoH traffic in order to classify it as either benign or malicious. We employed machine learning (ML) algorithms such as K-nearest neighbors (K-NN), random forest (RF), decision tree (DT), deep neural network (DNN), and support vector machine (SVM) to categorize the data. All of the algorithms, namely KNN, RF, and DT, achieved exceptional performance, with F1 scores of 1.0 or above for both precision and recall. The SVM and DNN both achieved exceptionally high scores, with only slight differences in accuracy. This tool employs a voting mechanism to arrive at a definitive classification decision. By integrating with the Mallory tool, it becomes possible to locally resolve DNS, which in turn allows for more accurate simulation of DoH queries. The evaluation results clearly indicate outstanding performance, confirming the tool's effectiveness in analyzing DoH traffic for network security and threat detection purposes.

Downloads

Published

2024-11-01

How to Cite

[1]
A. D. Eddine and G. Abdelkader, “Securing DNS over HTTPS traffic: a real-time analysis tool”, Comput Sci Inf Technol, vol. 5, no. 3, pp. 227–234, Nov. 2024.

Issue

Section

Articles

Similar Articles

1 2 3 4 5 6 7 8 9 > >> 

You may also start an advanced similarity search for this article.