From Scarcity to Clarity: Few-Shot Learning for DoH Tunnel Detection Through Prototypical Network

The widespread adoption of DNS over HTTPS (DoH) has introduced significant challenges in network security, particularly the emergence of DoH tunnels. Existing methods, reliant on large labeled datasets, struggle to adapt to novel DoH tunnel variants. We present ProtoDoH, a novel framework for DoH tunnel detection that uniquely integrates prototypical networks with meta-learning. Our method leverages few-shot learning principles to detect DoH tunnels with minimal training samples, addressing the challenge of sample scarcity in new attack scenarios. By employing a metric-based meta-learning framework, ProtoDoH enables rapid adaptation to novel DoH tunnel variants, significantly reducing the detection time for new DoH tunnels. Experimental results demonstrate that our approach achieves over 99% accuracy in detecting DoH tunnels with as few as 5 samples, notably outperforming traditional machine learning and deep learning methods. Furthermore, our model exhibits strong generalization capabilities across different network environments and DoH tunnel tools.