An Adaptive DoH Encrypted Tunnel Detection Method Based on Contrastive Learning

The percentage of encrypted network traffic has constantly increased as network security has been continuously improved. Attackers can, however, utilize encrypted DNS over HTTPS (DoH) to conceal their malicious traffic, which makes it more difficult to identify malicious tunnels. To address this issue, we first examine the encryption features of DoH tunnel traffic. Due to the incapability of current detection techniques to properly fuse traffic attributes, a fusion learning-based method is proposed to detect DoH encrypted tunnel traffic. At the same time, we discover that the DoH traffic samples may exhibit concept drift. As a result, we present a concept drift detection approach based on a contrastive sparse autoencoder. In addition to the above method, a model retraining strategy is also suggested to improve the model’s capacity to identify new DoH encrypted tunnel traffic while reducing its reliance on expert label data. This strategy involves incrementally training the model using as few samples as possible. Experiments demonstrate that the proposed method can significantly enhance detection performance. When 7% of drift samples are used during incremental training, the detection accuracy of the model recovers from 74.02% to 99.96%.