Peek Inside the Encrypted World: Autoencoder-Based Detection of DoH Resolvers

作者：Jiating Wu, Yujia Zhu, Baiyang Li, Qingyun Liu, Binxing Fang · 发表于：2021 IEEE 20th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · 年份：2021 · DOI：10.1109/trustcom53373.2021.00113 · 被引用次数：12 · 研究领域：Internet Traffic Analysis and Secure E-voting、Network Security and Intrusion Detection、Anomaly Detection Techniques and Applications

DNS-over-HTTPS (DoH), as a rising star to improve DNS security and privacy, has developed rapidly in recent years. It mixes with HTTP features, shares ports with other web services and provides API with URI templates. The unique characteristics of DoH, as well as its fast growth, bring both promising prospects and new risks, e.g. botnet communication, name abuse and data exfiltration. It is essential for network operators to learn about adoption and usage of DoH resolvers. Active scanning may be a possible way. However, it is considered to incur significantly additional overhead, which can be inefficient and aggressive. In this paper, we present DOHUNTER, a system for automati-cally discovering DoH resolvers. DOHUNTER: (i) picks DoH flow from miscellaneous HTTPS traffic, (ii)confirms DoH resolvers based on the detected DoH flow, (iii)mines other related DoH resolvers from the known ones. Our real-world experiments demonstrate the effectiveness of DOHUNTER in detecting DoH flow and finding DoH resolvers. Utilizing DOHUNTER, we witness an alarming increase in DoH adoption. Additionally, we also reveal oblivious growing trends of DoH, which may provide advice for both users and network operators.