A Lightweight Double-Stage Scheme to Identify Malicious DNS over HTTPS Traffic Using a Hybrid Learning Approach.

Area of Science:

• Computer Science
• Cybersecurity
• Network Security

Background:

• The Domain Name System (DNS) is crucial for internet functionality but faces significant security vulnerabilities.
• Attackers exploit DNS loopholes using advanced information-stealing techniques, challenging secure traffic delivery.
• DNS over HTTPS (DoH) was developed to encrypt DNS traffic and enhance security over covert channels.

Purpose of the Study:

• To propose a lightweight, double-stage scheme for identifying malicious DNS over HTTPS (DoH) traffic.
• To enhance the security of DNS protocol by accurately distinguishing benign from malicious DoH traffic.
• To develop a hybrid learning approach for efficient and accurate malicious DoH traffic detection.

Main Methods:

• A two-layer hybrid learning system was developed for malicious DoH traffic identification.
• The first layer uses random fine trees (RF) to classify traffic as DoH or non-DoH.
• The second layer employs Adaboost trees (ADT) to differentiate between benign and malicious DoH traffic, utilizing PCA for feature selection and RUS for sample minimization.

Main Results:

• The proposed system achieved high predictive accuracy, reaching 99.4% and 100% in its two layers.
• Low predictive overhead was reported at 0.83 µs for layer one and 2.27 µs for layer two.
• The model effectively utilizes a reduced feature set (18%) and sample set (17%) with balanced classes, outperforming existing models.

Conclusions:

• The proposed lightweight, double-stage scheme offers a superior method for detecting malicious DoH traffic.
• The hybrid learning approach, combined with PCA and RUS, provides high accuracy and efficiency.
• This research significantly contributes to securing DNS traffic against advanced cyber threats.