Identifying Malicious DNS Tunnel Tools from DoH Traffic Using Hierarchical Machine Learning Classification

Although the DNS over HTTPS (DoH) protocol has desirable properties for Internet users such as privacy and security, it also causes a problem in that network administrators are prevented from detecting suspicious traffic generated by malware malicious tools. To support their efforts maintaining this paper, we propose novel system identifies tunnel tools through hierarchical classification method uses machine-learning technology on DoH traffic. We implemented prototype of proposed evaluated its performance CIRA-CIC-DoHBrw-2020 dataset, obtaining 99.81% accuracy filtering, 99.99% detection, 97.22% identification