关键词: DNS, DNSoverHTTPS, 加密流量, 实时流量, 机器学习

Abstract: DoH(Dnsoverhttps) technology has become the main means of encrypting DNS. Different from DoH traffic data sets that are captured over a long period of time, realtime DoH traffic identification requires multiple traffic capture in a short period of time, resulting in traffic fragmentation and makeing flow level and session level features not applicable. In order to solve this problem, a DoH realtime traffic identification system is proposed. The system utilizes the DNS resolution server IP dictionary for preliminary and rapid identification, and establishes a feature extraction method for DoH realtime traffic based on the relevant characteristics of packet length, inter packet latency, and traffic surge, combined with machine learning models for accurate traffic identification. Multiple network public datasets are used, and a realtime DoH traffic dataset are independently generated for verification experiments. The experimental results show that the feature extraction method used in the traffic identification system, can accurately identify realtime DoH traffic.

Key words: DNS, DNSoverHTTPS, encrypted traffic, real time traffic, machine learning