DoH Detection Method Based on Self-Attention BiLSTM

DoH (DNS over HTTPS) is an encrypted DNS Protocol encapsulated in Hyper Text Transfer Protocol over SecureSocketLayer (HTTPS). It is one of the main protocols used to encrypt traffic in the domain name system. DoH plays an important role in preventing DNS hijacking and protecting user privacy, but attackers can also use DoH to establish DNS covert tunnels to achieve botnet control and other malicious behaviors. Aiming at the difficulty of classification and low accuracy in DoH detection, this paper designs a multi-classification detection method for DoH based on Self-Attention BiLSTM model. Experimental results show that the proposed method is superior to common machine learning models and traditional deep learning models in accuracy.