A DoH Traffic Detection System Based on Interpretable Deep Learning Neural Networks

Over the past few years, DNS has been a preferred target for hacker attacks, and although the DNS over HTTPS (DoH) protocol is considered ideal for Internet users, providing additional privacy protection and security, it also poses a significant problem: network administrators are unable to effectively monitor and intercept suspicious network traffic generated by malware and malicious tools. In this paper, in order to address this need in the field of cybersecurity, we develop a model to accurately detect and classify DNS over HTTPS attacks using a deep learning neural network approach based on the Canadian Center for Secure Networking's open source CIRA-CIC-DoHBrw-2020 dataset. The developed model achieves more than 97% accuracy in the detection and classification task of comprehensive traffic and very high accuracy (99. 1 %), recall (98. 1 %), and F1 score (95.8<sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">%</sup>) in the scenario classification task of malignant DoH traffic and benign DoH traffic identification. At the end of this study, according to the concept of interpretable AI methods, the potential feature contributions of the model are computed and emphasized by the novel use of game theory-based SHAP method, which enables the developed algorithm to provide transparent and interpretable results, which will be useful and instructive for future work on malignant traffic detection.