LayyerX: Unveiling the Hidden Layers of DoH Server via Differential Fingerprinting

As a rapidly developing DNS security enhancement technology, DoH(DNS over HTTPS) is gaining popularity among people. It allows users to quickly set up a DoH server by combining several components which create a layered structure. However, the multi-layer setup, which involves both HTTPS and DNS protocols, makes internal structural details more difficult to be detected. To address this issue, we propose a method that utilizes cross-protocol fingerprinting and analysis techniques, which is capable of identifying various components of multi-layer DoH servers with a focus on the underlying differences within protocol. Using this approach, we developed LayyerX, a system for detecting multi-layer DoH servers. Finally, through experiments and large-scale measurements in the wild, we showcased LayyerX’s outstanding capabilities and presented a meaningful structural overview of multi-layer DoH server.